d654d0e277ff3f5618bfcbafce94678dd5fceefb2419897dc856cadba834e5c9

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
135s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 89KB
Sample260905-gc971sca92
SHA256 d654d0e277ff3f5618bfcbafce94678dd5fceefb2419897dc856cadba834e5c9
MD5 dcfe5422567cd53f3019e90796b3c495
SHA1 9f5b371c3b4bc814230c652cb034cc94755f4ec1
SHA512 eaa110e8aacee067eab2f4faf1b0361aead6d05c3426c53fb3d0b7207cffae955c47722b4ff34e69a09b7b117aadb970042b3ec5ded42e081944ea5a2ff7489f
SSDEEP 1536:f7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfJwk:T7DhdC6kzWypvaQ0FxyNTBfJd
TLSH
T118936D41F3E102F7EAF2053100A6722F973663389764E8DBC75C2E529913AD5A63D3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
37	3008	powershell.exe
38	3008	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5552	powershell.exe
1500	powershell.exe
1264	powershell.exe
4144	powershell.exe
892	powershell.exe
6012	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
143	camo.githubusercontent.com
144	camo.githubusercontent.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\temA454.tmp	Clipup.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1068	sc.exe
4300	sc.exe
4300	sc.exe
2636	sc.exe
1360	sc.exe
4136	sc.exe
1572	sc.exe
4836	sc.exe
1572	sc.exe
3416	sc.exe
1572	sc.exe
4752	sc.exe
1560	sc.exe
1264	sc.exe
1656	sc.exe
2452	sc.exe
732	sc.exe
1032	sc.exe
4492	sc.exe
1500	sc.exe
1344	sc.exe
4024	sc.exe
4836	sc.exe
3912	sc.exe
1560	sc.exe
1032	sc.exe
1448	sc.exe
3464	sc.exe
3156	sc.exe
3592	sc.exe
2216	sc.exe
3104	sc.exe
3380	sc.exe
4300	sc.exe
1048	sc.exe
3464	sc.exe
4796	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 41 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1996	cmd.exe
1000	cmd.exe
5536	cmd.exe
5800	cmd.exe
3552	cmd.exe
4204	cmd.exe
704	cmd.exe
4264	cmd.exe
2452	cmd.exe
2176	cmd.exe
3972	cmd.exe
4992	cmd.exe
3364	cmd.exe
1208	cmd.exe
3616	cmd.exe
1604	cmd.exe
4028	cmd.exe
2572	cmd.exe
4704	cmd.exe
4864	cmd.exe
4940	cmd.exe
2172	cmd.exe
1192	cmd.exe
3224	cmd.exe
4704	cmd.exe
2268	cmd.exe
1192	cmd.exe
4216	cmd.exe
2948	cmd.exe
2564	cmd.exe
1304	cmd.exe
1032	cmd.exe
4840	cmd.exe
1336	cmd.exe
2416	cmd.exe
3104	cmd.exe
4372	cmd.exe
4024	cmd.exe
2184	cmd.exe
2696	cmd.exe
4300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4264	cmd.exe
1572	PING.EXE
1808	PING.EXE
3364	cmd.exe
3224	cmd.exe
1432	PING.EXE

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2400	chrome.exe
5604	msedge.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe

Delays execution with timeout.exe 21 IoCs

defense_evasion

pid	Process
2848	timeout.exe
4304	timeout.exe
2448	timeout.exe
988	timeout.exe
4840	timeout.exe
3372	timeout.exe
4224	timeout.exe
4792	timeout.exe
2840	timeout.exe
3988	timeout.exe
1580	timeout.exe
3464	timeout.exe
1276	timeout.exe
2544	timeout.exe
2748	timeout.exe
3052	timeout.exe
3888	timeout.exe
1956	timeout.exe
3708	timeout.exe
4032	timeout.exe
4184	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330605493886164"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{0ACFB0A7-E6CF-40FC-AE08-041DF8DAB26C}	msedge.exe

Modifies registry key 1 TTPs 53 IoCs

Modify Registry

T1112

pid	Process
4124	reg.exe
732	reg.exe
4384	reg.exe
1448	reg.exe
2696	reg.exe
1208	reg.exe
2452	reg.exe
1032	reg.exe
2424	reg.exe
2808	reg.exe
3912	reg.exe
1656	reg.exe
3464	reg.exe
3880	reg.exe
1908	reg.exe
3380	reg.exe
3416	reg.exe
3416	reg.exe
4136	reg.exe
4704	reg.exe
4372	reg.exe
1572	reg.exe
4704	reg.exe
4144	reg.exe
1448	reg.exe
4300	reg.exe
4384	reg.exe
2180	reg.exe
2216	reg.exe
2180	reg.exe
1572	reg.exe
2808	reg.exe
4124	reg.exe
2460	reg.exe
2152	reg.exe
3104	reg.exe
1032	reg.exe
3880	reg.exe
3464	reg.exe
1684	reg.exe
1500	reg.exe
2416	reg.exe
1432	reg.exe
4492	reg.exe
4136	reg.exe
1448	reg.exe
4752	reg.exe
2636	reg.exe
2808	reg.exe
4144	reg.exe
1264	reg.exe
4704	reg.exe
3592	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1572	PING.EXE
1808	PING.EXE
1432	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
1808	powershell.exe
1808	powershell.exe
1808	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
4228	powershell.exe
4228	powershell.exe
4228	powershell.exe
1432	powershell.exe
1432	powershell.exe
1432	powershell.exe
1500	powershell.exe
1500	powershell.exe
1500	powershell.exe
1684	powershell.exe
1684	powershell.exe
1684	powershell.exe
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
4384	powershell.exe
4384	powershell.exe
4384	powershell.exe
1264	powershell.exe
1264	powershell.exe
1264	powershell.exe
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
3900	powershell.exe
3900	powershell.exe
3900	powershell.exe
1124	powershell.exe
1124	powershell.exe
1124	powershell.exe
5068	powershell.exe
5068	powershell.exe
5068	powershell.exe
2808	powershell.exe
2808	powershell.exe
2808	powershell.exe
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
892	powershell.exe
892	powershell.exe
892	powershell.exe
2920	chrome.exe
2920	chrome.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe
5904	powershell.exe
5904	powershell.exe
5904	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe
Token: SeCreatePagefilePrivilege	2920	chrome.exe
Token: SeShutdownPrivilege	2920	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe
2920	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4028	1952	Setup.exe	82
PID 4028 wrote to memory of 3044	4028	cmd.exe	83
PID 4028 wrote to memory of 3552	4028	cmd.exe	84
PID 4028 wrote to memory of 3972	4028	cmd.exe	86
PID 4028 wrote to memory of 1996	4028	cmd.exe	87
PID 4028 wrote to memory of 4204	4028	cmd.exe	88
PID 4028 wrote to memory of 4184	4028	cmd.exe	91
PID 4028 wrote to memory of 3888	4028	cmd.exe	93
PID 4028 wrote to memory of 3372	4028	cmd.exe	94
PID 4028 wrote to memory of 1956	4028	cmd.exe	95
PID 4028 wrote to memory of 4224	4028	cmd.exe	96
PID 4028 wrote to memory of 2848	4028	cmd.exe	97
PID 4028 wrote to memory of 4304	4028	cmd.exe	98
PID 4028 wrote to memory of 2448	4028	cmd.exe	99
PID 4028 wrote to memory of 1276	4028	cmd.exe	100
PID 4028 wrote to memory of 3708	4028	cmd.exe	101
PID 4028 wrote to memory of 2544	4028	cmd.exe	102
PID 4028 wrote to memory of 988	4028	cmd.exe	103
PID 4028 wrote to memory of 4792	4028	cmd.exe	104
PID 4028 wrote to memory of 4032	4028	cmd.exe	105
PID 4028 wrote to memory of 2748	4028	cmd.exe	106
PID 4028 wrote to memory of 2840	4028	cmd.exe	107
PID 4028 wrote to memory of 3988	4028	cmd.exe	108
PID 4028 wrote to memory of 4840	4028	cmd.exe	109
PID 4028 wrote to memory of 3052	4028	cmd.exe	110
PID 4028 wrote to memory of 1580	4028	cmd.exe	111
PID 4028 wrote to memory of 3464	4028	cmd.exe	112
PID 2920 wrote to memory of 3572	2920	chrome.exe	114
PID 2920 wrote to memory of 240	2920	chrome.exe	115
PID 2920 wrote to memory of 240	2920	chrome.exe	115
PID 2920 wrote to memory of 2400	2920	chrome.exe	116
PID 2920 wrote to memory of 4064	2920	chrome.exe	117
PID 2920 wrote to memory of 4064	2920	chrome.exe	117
PID 2920 wrote to memory of 2608	2920	chrome.exe	118
PID 2920 wrote to memory of 2608	2920	chrome.exe	118
PID 2920 wrote to memory of 896	2920	chrome.exe	119
PID 2920 wrote to memory of 896	2920	chrome.exe	119
PID 2920 wrote to memory of 4024	2920	chrome.exe	121
PID 2920 wrote to memory of 4024	2920	chrome.exe	121
PID 2920 wrote to memory of 4748	2920	chrome.exe	123
PID 2920 wrote to memory of 4748	2920	chrome.exe	123
PID 2920 wrote to memory of 3172	2920	chrome.exe	124
PID 2920 wrote to memory of 908	2920	chrome.exe	126
PID 2920 wrote to memory of 908	2920	chrome.exe	126
PID 2920 wrote to memory of 4304	2920	chrome.exe	127
PID 2920 wrote to memory of 4304	2920	chrome.exe	127
PID 2920 wrote to memory of 4492	2920	chrome.exe	131
PID 2920 wrote to memory of 1132	2920	chrome.exe	132
PID 2920 wrote to memory of 1580	2920	chrome.exe	133
PID 3008 wrote to memory of 2268	3008	powershell.exe	134
PID 3008 wrote to memory of 704	3008	powershell.exe	135
PID 704 wrote to memory of 4796	704	cmd.exe	137
PID 704 wrote to memory of 4840	704	cmd.exe	138
PID 704 wrote to memory of 3416	704	cmd.exe	139
PID 704 wrote to memory of 4992	704	cmd.exe	140
PID 704 wrote to memory of 3592	704	cmd.exe	141
PID 704 wrote to memory of 4704	704	cmd.exe	142
PID 704 wrote to memory of 4032	704	cmd.exe	143
PID 704 wrote to memory of 4940	704	cmd.exe	144
PID 704 wrote to memory of 4000	704	cmd.exe	145
PID 704 wrote to memory of 1128	704	cmd.exe	146
PID 704 wrote to memory of 4864	704	cmd.exe	147
PID 4864 wrote to memory of 1132	4864	cmd.exe	148
PID 4864 wrote to memory of 4492	4864	cmd.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\430F.tmp\4310.tmp\4311.bat C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3044
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:3552
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:3972
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:1996
- - C:\Windows\system32\cmd.exe
    cmd /c exit
    3⤵
    - Executes a command shell one-liner
    PID:4204
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4184
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3888
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3372
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1956
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4224
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2848
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4304
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2448
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1276
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3708
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2544
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:988
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4032
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2748
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2840
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3988
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4840
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3052
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1580
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:3464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4d91c728,0x7ffd4d91c734,0x7ffd4d91c740
  2⤵
  PID:3572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,11457800009016789312,5329993609770154624,262144 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,4105528648750533441,6477648887996656866,524288 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,3863313823980407330,13200058597995365893,524288 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2468 /prefetch:13
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,9413993077330573499,6273608534872575140,2097152 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,15604912807552197287,16128377426455412301,2097152 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4372,i,5246199004630946177,8663532215371204186,2097152 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:9
  2⤵
  PID:4024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,12126039516621714189,328572064753783036,2097152 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,10042196236111840413,6898240446828067564,524288 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5840,i,10510511901576719799,11493202107230538293,2097152 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4744,i,8070176497396197881,4421804110556516539,2097152 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,3129925031504944021,7588903235957890244,524288 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:14
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3600,i,16480645636720693811,14123979191161971291,524288 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3536 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,2880634378270505476,15719206791669778271,524288 --field-trial-handle=1876,i,12766022060413752749,13944146539019266483,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3700 /prefetch:14
  2⤵
  PID:1580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "echo CMD is working"
  2⤵
  - Executes a command shell one-liner
  PID:2268
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd" -el "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:4796
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4840
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd"
    3⤵
    PID:3416
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-el" "
    3⤵
    PID:4992
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:3592
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:4704
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:4032
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4940
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:4000
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:1128
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:1132
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4492
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd" "
    3⤵
    PID:2424
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:1208
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3096
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1808
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    PID:2572
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:3988
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:3592
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:2948
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:1684
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd" -el -qedit"
    3⤵
    - Executes a command shell one-liner
    PID:4940
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:732
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2424
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd"
      4⤵
      PID:1344
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:2176
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:4036
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:1192
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:3224
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:4024
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:3840
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:4796
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Executes a command shell one-liner
      PID:4992
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:2416
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:3948
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd" "
      4⤵
      PID:2808
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:2948
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:4000
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1304
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      Executes a command shell one-liner
      PID:2172
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:3768
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4264
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1572
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3364
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck312.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1808
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:4704
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:412
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:4876
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:4032
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      PID:2948
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:4000
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:1908
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:1208
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:4300
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:4124
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:3416
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:2496
  - - C:\Windows\System32\mode.com
      mode 110, 34
      4⤵
      PID:4796
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:4144
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:3616
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3592
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:412
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:1560
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4032
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1360
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:732
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:4136
  - - C:\Windows\System32\cmd.exe
      cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
      4⤵
      Executes a command shell one-liner
      PID:1208
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get CreationClassName /value
        5⤵
        
        PID:4124
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:2520
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
      4⤵
      Executes a command shell one-liner
      PID:4840
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4228
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3616
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
        5⤵
        
        PID:4540
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1336
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
        5⤵
        
        PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1432
  - - C:\Windows\System32\find.exe
      find /i "Subscription_is_activated"
      4⤵
      PID:732
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:1192
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1500
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "
      4⤵
      PID:1132
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:1360
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1684
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4144
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:1560
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:4372
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      Executes a command shell one-liner
      PID:2564
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        5⤵
        
        PID:1572
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:2416
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3224
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 l.root-servers.net
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1432
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:3912
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:2152
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2452
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:1032
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3156
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3692
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4136
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:4888
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:2216
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:1572
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
      4⤵
      PID:3900
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      Executes a command shell one-liner
      PID:1304
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
        5⤵
        
        PID:4928
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:1068
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:4300
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
      4⤵
      Modifies registry key
      PID:4124
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
      4⤵
      Modifies registry key
      PID:2460
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
      4⤵
      Modifies registry key
      PID:2152
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
      4⤵
      Modifies registry key
      PID:2452
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
      4⤵
      Modifies registry key
      PID:1032
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
      4⤵
      Modifies registry key
      PID:1500
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
      4⤵
      Modifies registry key
      PID:3880
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
      4⤵
      Modifies registry key
      PID:4372
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:1656
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:4836
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:2416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
      4⤵
      Modifies registry key
      PID:2424
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:1908
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:1432
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:3104
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:732
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
      4⤵
      Modifies registry key
      PID:4492
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
      4⤵
      Modifies registry key
      PID:3380
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2452
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:1032
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:3416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
      4⤵
      Modifies registry key
      PID:4136
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:2696
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:2216
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:1572
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:4704
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      Modifies registry key
      PID:1448
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
      4⤵
      Modifies registry key
      PID:2808
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:4300
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:3912
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
      4⤵
      Modifies registry key
      PID:4144
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
      4⤵
      Modifies registry key
      PID:4384
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
      4⤵
      Modifies registry key
      PID:2180
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
      4⤵
      Modifies registry key
      PID:4752
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
      4⤵
      Modifies registry key
      PID:1032
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
      4⤵
      Modifies registry key
      PID:3416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
      4⤵
      Modifies registry key
      PID:4136
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
      4⤵
      Modifies registry key
      PID:2636
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:3464
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:1572
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
      4⤵
      Modifies registry key
      PID:4704
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
      4⤵
      Modifies registry key
      PID:1448
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
      4⤵
      Modifies registry key
      PID:2808
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
      4⤵
      Modifies registry key
      PID:4300
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
      4⤵
      Modifies registry key
      PID:3912
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
      4⤵
      Modifies registry key
      PID:4144
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
      4⤵
      Modifies registry key
      PID:4384
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
      4⤵
      Modifies registry key
      PID:2180
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4752
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:1032
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
      4⤵
      Modifies registry key
      PID:3880
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
      4⤵
      Modifies registry key
      PID:1264
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
      4⤵
      Modifies registry key
      PID:1656
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
      4⤵
      Modifies registry key
      PID:3464
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
      4⤵
      Modifies registry key
      PID:1572
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
      4⤵
      Modifies registry key
      PID:4704
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      Modifies registry key
      PID:1448
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
      4⤵
      Modifies registry key
      PID:2808
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:4300
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:1048
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4492
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:3156
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:3592
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:1500
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:1344
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1032
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:2216
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:2636
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2520
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:3464
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:1572
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1908
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1448
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:3104
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:732
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:3380
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:1560
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4384
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:4024
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:3416
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2696
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:1264
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:2636
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:4484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version
      4⤵
      PID:4880
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:3104
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
      4⤵
      PID:4492
  - - C:\Windows\System32\findstr.exe
      findstr /i "0x800410 0x800440 0x80131501"
      4⤵
      PID:4032
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
      4⤵
      PID:1560
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4372
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
        5⤵
        
        PID:3880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1264
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:892
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
      4⤵
      PID:3880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4888
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3900
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
      4⤵
      PID:4492
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
      4⤵
      PID:3464
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4704
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
        5⤵
        
        PID:3104
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:4032
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:2452
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
        5⤵
        
        PID:1560
  - - C:\Windows\System32\sc.exe
      sc query wlms
      4⤵
      Launches sc.exe
      PID:4836
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
      4⤵
      PID:1908
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
      4⤵
      PID:1264
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
      4⤵
      PID:892
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
      4⤵
      PID:4136
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1000
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
        5⤵
        
        PID:2416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1124
  - - C:\Windows\System32\findstr.exe
      findstr /i "KMS_"
      4⤵
      PID:4960
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4300
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5068
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "
      4⤵
      PID:2152
  - - C:\Windows\System32\find.exe
      find /i "Ready"
      4⤵
      PID:2496
  - - C:\Windows\System32\reg.exe
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
      4⤵
      PID:4752
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
      4⤵
      PID:732
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
      4⤵
      PID:1908
  - - C:\Windows\System32\findstr.exe
      findstr /i "Removed Not Found"
      4⤵
      PID:3380
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1604
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
        5⤵
        
        PID:2808
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 92fb8726-92a8-4ffc-94ce-f82e07444653 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "
      4⤵
      PID:3156
  - - C:\Windows\System32\find.exe
      find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
      4⤵
      PID:4136
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
      4⤵
      PID:1344
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:2176
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:2460
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4024
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Name
        5⤵
        
        PID:3380
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1032
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Nation
        5⤵
        
        PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_bf2b5317-556a-4ddb-9876-d3340c64a8a4.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:892
  - - C:\Windows\System32\ClipUp.exe
      clipup -v -o
      4⤵
      PID:5420
    - - C:\Windows\System32\clipup.exe
        
        clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\temA57D.tmp
        5⤵
        Checks SCSI registry key(s)
        
        PID:5448
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:5536
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5552
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "
      4⤵
      PID:5664
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:5672
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:5700
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:5800
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:5812
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:5820
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f
      4⤵
      PID:5876
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f
      4⤵
      PID:5892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5904
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6012
  - - C:\Windows\System32\choice.exe
      choice /C:10 /N
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://git.activated.win/Microsoft-Activation-Scripts
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:3852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffd2d6ec188,0x7ffd2d6ec194,0x7ffd2d6ec1a0
        5⤵
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10984719518660142559,7975288625280821515,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1508,i,1870719320322269376,9642446807926776029,262144 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:2
        5⤵
        
        PID:5600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,10061243717464116050,6210569290261621758,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
        5⤵
        
        PID:5584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,16269779796662302795,6780213897775974643,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:5708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,10954463484870834584,17347596296738095456,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        5⤵
        
        PID:5804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,18384467228063951179,1390064317356325136,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
        5⤵
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,6510797415071217514,5639805027420275243,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
        5⤵
        
        PID:5128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4392,i,16950409157235229759,12283415022654597065,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
        5⤵
        
        PID:5844
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,7017276060993818442,16341822860980353967,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
        5⤵
        
        PID:5816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4664,i,10068302290579543850,16037212965401522380,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5180,i,414909487860903034,13073220640126385020,2097152 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
        5⤵
        
        PID:5968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,16113123608763483727,5720822399097025341,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,12757691324409190704,7108250380456592729,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13946446941618003695,9210475092551749411,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1246779934187455106,17275460882654662691,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
        5⤵
        
        PID:4136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,10790038909343758628,8092315526917584160,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
        5⤵
        
        PID:6048
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        6⤵
        
        PID:5888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,4960615700018984090,14068981259574766189,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
        5⤵
        
        PID:5412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,4960615700018984090,14068981259574766189,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
        5⤵
        
        PID:5932
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,16015091568154005066,12332045761327314127,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,5214340895683308668,3069198203129976020,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
        5⤵
        
        PID:5960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,3411091248178544400,11473718420209308842,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
        5⤵
        
        PID:2520
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,11462026342634597481,9638790788960914875,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
        5⤵
        
        PID:5924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,270921110002687380,16271427102169947661,524288 --field-trial-handle=1992,i,16958820513581044999,10235060748062931635,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
        5⤵
        
        PID:6716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/massgravel/Microsoft-Activation-Scripts
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://massgrave.dev/in-place_repair_upgrade
      4⤵
      PID:3860
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3464

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:5244
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\temA454.tmp
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GenuineTicket

Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket
Size 1KB
SHA256 5cf3ae9ca793d9a8517d05864eacca525ae8b4db3d13943edcc4bf3f2131dab4
MD5 5e22ef25ec6bdbe63cedfbdf75011316
SHA1 d828c721daf6c630960838dd3a9391d2ec62e88f
SHA512 8599d461fbe166906bc42d2ac6235d32a0f32ea247dbf1bad76ca72233df7b5907c7ebb57b943a3e51d0dae8825baca396f2dd79a34b00197f9dcaa8d6a37714
TLSH
T1381123B4D5356C10221C67F086713BD3BB1C314BC6935D29FB41579835AA2823B57029
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b31c120253dd7c0a95791afff589cd9f009fb9eac3b23ef03fe11eee6a83163
MD5 7dd8dc730634b474e7e7e3dfd6ece6fb
SHA1 d7c0e8321082c524aff6d731397251e8575cb6ad
SHA512 02bbbe95c7d5ffe24da0d5f532ba41cd27ea03ae8fe4e671e804311fb141b91c8204399fd5b07816f386a5cb70c9644466f5a1710774812e40cae953609d08e0
TLSH
T1EBE022AACE21EC2F2CFC4B1866544E87EA14036B2750490F3B3D822A8FB22764586C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 222d0cc294d27f1f01f87bd12155ffc7537c65bf0a420003d5cd2a43202e86fc
MD5 01781f97b2d69ce703b39785d744aea3
SHA1 8570da66c28a716919fc0a1a263dcc310a34f9fb
SHA512 fa273bb416d80fe7a0863910b57551e37f6ac25ac40209667b380a88bb7b28a1bc87a1170f69f4fa74e1fbba89922c83c6cc255ec0ea236b1ce65322f30e3126
TLSH
T1BFD022C2E8C01062EF8F63BC47420C62BE30005400C10B4330CCCCB54E233DAA398D13
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 53e499a15bcfbf78a10128de042c358569f7722c9f6bdfc3df3540c63c3d1a5b
MD5 8c28d5ffe82cb01c220fef18559d41e6
SHA1 b9d558da83070be7e27985b985e312898a39492c
SHA512 665617cd07c5181c479bfed228e19a68a54a7e0c55c10ce84a9faab9dd6f550156f1985d1993bbeb0320ddd2af72638b96264742ae631b25bf2033f383233e95
TLSH
T1B8D012C268C00595EF5F01BC47524D917D60051540D1171371CCCDA559177E59388D53
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a296603b-85b0-4442-a78b-89dbdcfa897e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a296603b-85b0-4442-a78b-89dbdcfa897e.tmp
Size 3KB
SHA256 000196fb5a5f2ed43ed517ccf0088707f28c5450aa02f4f456f53d61b7153522
MD5 6cae2b89e5b5ad44eae15dc71ecf5888
SHA1 86b12ba06d6a92232c9802e7f1b656130e70cc86
SHA512 93b8d7a04213db00f165cd9ce1e70dfa1f733755916894889645b4daf85331519ee18a0f4284894a93c49be49a9426a2ee3c2a9b5063e20219ab05abf6adfb61
TLSH
T1E2717BF7C7E8856DC90156F4EA256E2FCE2D0A14532C3C66C8D4AE5F53E2872D24168E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 b321854ca5fc608607759f11858f64aa57d84fd3204693c915c5c8309473cd04
MD5 f6c2eccc7f005bd536b30e0940c1984a
SHA1 bca6def3430ade4c73d85c294079339cad64be9e
SHA512 483529c669d6a85f3eaaa6ddefce6c4876c8eb4b024312cf3ad5efafb90593163de50dea5543ff7166692b336ba018a12d1773d5653ecd8974cc3a5468a8a2f3
SSDEEP 192:6RJr1hjb7ybKpv7sBpAPRp2I2z9NHsb+WNnZ//VSA2EYykwQIAVyIsnAUgtaJ:6RJp5Rp8UXcrwRb2Ryu8
TLSH
T1F042D86EBD10697B6CDBD229FD227F13E7F6102225951E84EAFC8A2C19D79CD2217007
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 983549208057e0fb4a3712515339f751fb5f4e91742b09ae5aadda4094acd419
MD5 676804ad82a78460971c092ae089ecd3
SHA1 907fa076def831a748a020d7d717f918f1ad4cb4
SHA512 a1b89a310c095471c9ac014bf4679c785fd0a7911907b9e975d44deafed3524a38c5c97ed283e45034e89bc9ca1647a652cccf315e9a8e25b27eea612ff64ade
SSDEEP 192:6RJr1ujb7ybKpv7sBpAPRp2I2z9NHsb+WNnZ//VSA20YykwQIAVyIsnAUgraJ:6RJpIRp8UXcrwRb2Byqe
TLSH
T12052E96EBD10697B6CDBD229F9227F13E7F5202221911E84EAFC8A2C19D79CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 326136c016bb28efe4207294b86ccdc921ac7e1591aac1d540f61f84b6ff55ab
MD5 e588f5acf8e028fbe896d6adae8fa968
SHA1 70b50d186fbcc708b03bd1571cf6d103f06bd645
SHA512 721ff488c164971af7c0aae1cfe593b5dd63ef1772796fed16a7adf0ca292f0534fc33b1d74911767e228051b79fdef972dc37dc31728b7300f57dc2c2a7b130
TLSH
T120B01280C0015102C00A06F5154254C87154BF10960B370143E4ED36DD291908015061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590219.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590219.TMP
Size 96B
SHA256 316d919028610fd774ba97c1e777b3c5d7a12df3f8382b3ed19f72162feb72a8
MD5 03da681f4f0d810689eb92af426b7f39
SHA1 d73031eb2418e13669eba3b780a5e5fd3e4da819
SHA512 9f337ea47dd11cb2ece10c673983b2e62bf70a7806bd44138b0866beaff104f6f36e2c3b4f066a79b117abc3d4d952fd5f9f9b2f09c3f78864ca732abe731fbb
TLSH
T163B022B8C0022202C00E03B038A088CC3220CF20C3830303F2E00F23CC202202822030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 e2b4c6758fe90287018687e005e976d027785f3300ee27ed69b0982e40169fbf
MD5 35eb8198e70fdca770379f9752317403
SHA1 3fb81bd15d10d89c40c4f2634672d64f21a65f60
SHA512 4429f902ad11be1ecb9616d9b1046dd79fcb8e9ec1adf499047e6670255b3fd126536efac113f62382876cbd2bd47261b9573c4f17ea46373c02f3d81881a3eb
SSDEEP 6144:faWwAIxDTF9vR4O5je9Z/Vm7Rkm1tYpBeh2BAoI:CW2DTr5nMc9oBGcAoI
TLSH
T18B34133F0E7DBE366EF66B4E314D141A2DF5DA979419AA4B98C41F0623DD1E81F02A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 f64f77d93651ea533e88af552230172feb4622e0a7e270619e23fafbcc3e1bdb
MD5 f92cea1885209d9f14c7e90eb661e6b8
SHA1 7f83391d8a31b304ff743f86738580815f84b108
SHA512 99533aa0ffd6a532854beb3a4e0b6d9fd976adce8603f9f09ddbccf12f2e5ac045a552af05edce760d457301120849e977702c9ebdbc6cf4ebc4ad3e85bb26e9
SSDEEP 6144:waWwAIxDTF9vR4O5je9Z/Vm7Rkm1tYpBeh2BAoI:vW2DTr5nMc9oBGcAoI
TLSH
T19634233F0E7DBE366FE66B4E314D141A2AF6DA969015668798C41F0723DD1E81F02A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 4d4353af5ce6cd630269248da1ed684073d260ccdf2331de604180475cf43cf1
MD5 8d03997d34319b6df3da8258f408178b
SHA1 937466223f497aaf5850c55ef32abc638974a9ca
SHA512 bcd139a0c94e1809d07995a4374b3bcea89936484a70c006665b5f760197a6fb33f10d7da797535eb30d55bdcf5e904514beec575333e202792811a7c4521558
SSDEEP 6144:AaWwAIxDTF9vR4O5je9Z/Vm7Rkm1tYpBeh2BAoI:/W2DTr5nMc9oBGcAoI
TLSH
T1F034233F0E7DBE366EF66B4E314D141A2DF5DA979419AA4798C41F0623DD1E81F02A30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 e118258619742d1c2a1cdd5dd9a89a1dddec4dd4fcb9df99573f3e68eca8bcab
MD5 0da45d7958092c22af371498b2cec430
SHA1 fb329828b4e02a7e05e0968e67ec4863dc56aa3f
SHA512 a5fdef82ea4fdd434e2730eb27fc732f0e6432fada4c35a6b49d1bfdb606279bfe9f8bce1b11e0ef453a07cba42b3e4f154d59da7dd3d86beec7b049db9d1cbe
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Fm7Rkm1tYpBeh2BAoe
TLSH
T144C3122B5E65A97759B5A70EB08E0B1F1EF14EA7C930DE82C8D85B0427EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 03f350534e854f8fd0daac10bc646d3c80648b7626b34a0637443cd8c046c2fa
MD5 5804bb707481efde264cf8c1103ca515
SHA1 62ae00013f9dc394bcf9ec6a4a0659db1f17f2ba
SHA512 40b88793f8921ab4b03a1a96eceabc3e0eaf57814ac662dd4ad7627e5e4d2fed21f8b522f46a8f1df5e82bbf248b4b89df2cfe4db0a5f57fd5758a11335ec743
SSDEEP 6144:naWwAIxDTF9vR4O5je9Z/Vm7Rkm1tYpBeh2BAoI:aW2DTr5nMc9oBGcAoI
TLSH
T12D34233F0E7DBE366FE66B4E314D142A2AF5DA9690156A8798C41F0723DD1E81F02A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

5a660e2c-9806-413b-9e58-944ba9201771.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a660e2c-9806-413b-9e58-944ba9201771.tmp
Size 24KB
SHA256 0176bb1eb3f6b76f434ec6afd7a6579ee493f341573ae76e57559175ed842906
MD5 b79150b87de9d7ccaefaa9b314c0e276
SHA1 594dde4e1512b89fa3949408c192bd513102ca93
SHA512 426867aa264c2f1a21e3b6d9723b14be459189a3fb8ef8e7f47813d24eb66ea28627470aa0e61a351d7d76c4b112c44c51486878680619e3d859bdaa7d2391c0
SSDEEP 768:c3IzhWN0/eFDJsbOj3QfFI1KGfk3FuBMthT:c3IMyEeLdI1KQk3FuBMD
TLSH
T1D1B27C7D9CA45D3F49AEB344AA0E39379DA8013BC1B46E48C7995F0EC6BA48CF306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 707c0a63a018be182dd327d61f24ae614d8bf02ffda39fdb66cfe859df8e6d90
MD5 2c06dd9a8eeb3e210783d42396870f59
SHA1 ce3b609af27d6c15d832d559b6c1f61710ec43dd
SHA512 9d0211e9b2e3b08c98a2e522305d7c597845ab72a08bf4e84d98dabce6778c27176a8a6048e98c7d318423219947cbcc6a95ea0cc735fb94e03d9ba054a7a5a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P72:fwUQC5VwBIiElEd2K57P72
TLSH
T159B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 38ba26462721fa4539315e5c61e16b2e66cf895dfeac015059c533fcc74468a7
MD5 6c9dc6036bddc5ea6982d1e425b38d79
SHA1 5a461676646861eea5db72c083292b922faadbae
SHA512 f4c1d9d53b4034b27e5e31f6c2e96817b2cd88888e156abb174e093bcd2ab75a6c1b6a5f66270895fb61335da4b797b72143d78a04fa6daa439c6ae8d5ac582c
TLSH
T19FD02370365F7456F7040179540393157F55448636E7C203D5558D8F7F5507453C21D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 34KB
SHA256 0d9e78df936b9683fa5525a68b9b03cbe6fcb92589d30acc8b27105923f2d9d8
MD5 0d65f83c32c9ed6515807a60bf57608f
SHA1 63148255fd90ae58a57b51409aec5e282b14c97e
SHA512 62ddb21bc60fa5903cae1ad657f1257cc2966320bf49413dcc34593523cca573a09521ba406035d1202b7c5b5b5db6b345db537ec0c60008e094425e5702b73d
SSDEEP 768:vocEc0WbL4sB91gny70pzDF/eXgkTbHYQ0qx20TiCLwmWi:gWPNgbpF/eFqT0WCLwti
TLSH
T1F4F2F2EDA630ED19D61D5EA50B9F32F1DC1F0DC3A04EC37B4D2C894582946958E9B48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 02f09e315a75d46cdc8bbbcabed7bd84003d7d079aad8d656e69ec726fd5f481
MD5 f344f743f561929f5b8c53a33ba8430e
SHA1 c1d9c7ca68f68c666c79848b4235757fcea865ea
SHA512 72eed4dbd6a8797d9deefcf3a8953314bec006262a5e2a2f747e7a37ddfaa45076993ca059fabbeacabc23fd824201ec518ca25d0ce100ae19fafac55c7137d0
SSDEEP 96:vDc3+7UxndZ9TtBTmDpagWM6A5/QLJTcV1BU3D3W:bc3UydrttQhIpck3D3W
TLSH
T15CC12B057F56840BFB54F676A3D9068738B10109C2C79F3E0B90CCB811B6766F99D0B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir3852_492373217\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir3852_492373217\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6c8f650c5aa2df402ab826445dca239d31fa242f7f680610a8a2d9977062e6c2
MD5 bb8e196dc1de4d8a4156282a41794b17
SHA1 57d35d7e492c10ad2b985becbbfa3a57a1e67be8
SHA512 3fff6db2ed78b2940a472e51a2a03ce9fb5f8e651e5022b3a56e6aff9031dcada081910f39db7a6a451559cb4a9c5eb68e46549e65c76c6bec117ee07f58a8e9
SSDEEP 96:DZOipjmP7XTzT1labgbeQlK9Bwv/GmnBmrmFmDmO+mH:DcipjmPjTv1labgbeQlK7S/GmBmrmFmj
TLSH
T1B4918CF787F5856DCA0256F0AA18AE2BCE1D0524432C7C6AC8E4AE57D3E3871E10174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dcad0b175c2aeebbb9c58b0182c5b2d12791e6d3d74a16d2b0e8f2d128e84aba
MD5 9d7e70688c3afdb9f87ad5d2594e7d06
SHA1 e5add7dbc1360dccdd13f149aee0f4238de26603
SHA512 ab1e2b570217b25ab0153246593f395304fa61da1884874080a10946a3ef988020f60399b926147461620f960175e20720c200077b2fd5f30293948b022e8580
SSDEEP 192:sxZFRsyM/jK1Ml8MNb/fLsCXuhQIBIdpsg2p/W6+WN7NIHd07RVy5/Y0aC4tAIgc:sxZFq1b/fLsCXuOFO/bW+g/5Nc
TLSH
T1A052FA11AA346977CCDBD209FA55BF53D7F90562D2804E449AFCCA1C09E6AED720382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a8016b89a5c42614dbc584038cecca7b7af91b10513a8cbfee60f7376cabef6b
MD5 d6a6567925de887699431dda982d80cc
SHA1 d47ff6860133db00a768c1a174c0f3c1acc34ce8
SHA512 5eb093df40b6991b76cbe818eecfe10817484dd4f0be420a0b26513a0c48220655b352595b2d25bdc97dc038652dfe234b2060396a34572e0bc54db64a44b2b4
SSDEEP 192:sxZFRsyM/jK1Ml8qccb/fLscWpVUXuhQIxIdpsg2p/W6+WN7KLemLe9yLeINIHdr:sxZFq/b/fLscWvUXuOBO/bp+4X53ye
TLSH
T1D472E711A9345A7BCCDBC219FA45BF53D7F91462D2904E44AAFC8A1C09E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1b12bb6b91476a5f0ca6c77d31532cb5ee620253f625b8727dd2c0b84a751684
MD5 a034946d996aece8555d60603d3e437a
SHA1 660faacc5b0e324b9edfa23279567f7d610626fe
SHA512 0502a7a02013437d7f21a47e8076e78ac1289bd4cd42483e2ab0274b023a16ca09cb1090d502435761adf33f391ef509ffd61f5fca1c0e612bb12cf067643bbe
SSDEEP 768:Xe/zh8dF25r7pLuLzEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3LAaJjLL:Xe/zh8dF259EzEkWRmEcQXwu1jaKLLJD
TLSH
T1BA031B3F2C0CCB7E4F804E9CED2A7E9B6EE8028B5698895447FA844C03C66DF55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ff65c8b0624e3b9fcfc560dd61a3e869bc6ef4b428ac3a4f009dc82863f5b914
MD5 49cf910ae00fbf9a94f4fb4ce7dc79b4
SHA1 8f323633bb7e11d9ed99aa41be688142a1b916c4
SHA512 97fd830294045d64ea8ea81941da2c919858f0b5d70f47ff5d90206e2c7f8df9825fbf0643da9426746747c7bb42adea163e684859f9839f5c0e7047ec2816c0
SSDEEP 96:KEWgKvfN6KmAoiwgKd2GSkKHKefU9YkqW6g2Obz88gKk18SgIM8Lybz:2aDbeLda
TLSH
T165D1F31236BB02523C7F2908E2959BA71B4172637014E53B7BA90071CEAAE355FFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 449bf0ad38c8e864c48a5df90aebf4111f4142c24a306cf5cd2beda4e7a48c52
MD5 3c836c3d0b081157f6264ad832fc892d
SHA1 7f76df75a23160fe4721c7d29f1b10a59096be23
SHA512 2dc1da7a31a3e0e4079db1742ad53bc750aa8d3e86950e8f8664c0be86006c95bba146222cb1f24d98d058b78b58e19241b703356fc343758dc3bde71375e73e
SSDEEP 192:BGNE6P2UOcQmiUy7IUmqGv0bOvwSKcPU6:BGNE6eXsEIxqGsbOHKeU6
TLSH
T14502D7396D686CBB8FA2AD45B88737178FE8107BEA952B80D9D41F1C01DB65C3347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d2971cdb77d21d94d8a5ca905f1bb6837c2752f04405b0613b3d24816ef17a7f
MD5 29efaaa619c3f6a84d77a5a58dc8f763
SHA1 bcbfb927e2bb468461fe5f06fad847093535183b
SHA512 696f47820d7a12b6a4098d398cc8aaa454d6b01bdc51c53b68e3dac21c14bd9977859adbf469f52a96e4200e2012999318683c7a3fb36235eff3f2b942ab8e0d
SSDEEP 384:nt3yFaeO8W8Nh4ieA/ekCubfR1nsbOj3KzMa/8tnha06pO:t3IzhWN0/eFYJsbOj3KzMthT
TLSH
T1B6826C756C789C735AABB041F98A3793EFA810B7C5952F84D5D8DF1D09CB19C230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2e0fd1f94cedbb4e67177d41e5ddc2a592288c162d69e6c51b0ecf4a5fa18a17
MD5 156eebb3c549e5fc23f1091d69b32160
SHA1 8822bbf572f874c11fb1d26c2dd9543fffbe07ff
SHA512 72d0c3dc9a480744aedc992beb08b411da66973d26891c573e8bf51c0b5f1c1eedbe6b9b9e057bf3745e9a5d7386b374b9cdbebb0be10d8b30e20ad48c721603
SSDEEP 192:zvGNeo1P2U7WMQmiU18AH68Unv0bOjUI0YKWq+yU8:zvGNh1euxW86HnsbOj/KzU8
TLSH
T12C2218756DA8AC774EE6B044F98737638FA820B7D8856F40E5D85F1C049B69C334B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ef10114e61a2511ae2d338bb2cf75984db4a8a17eb3b059dfedce2f3a75f2260
MD5 5d281a5fd9a937c8585fa155951975d6
SHA1 92243150e799214337cddc2cc8794f158fa8cf0e
SHA512 2659ffb13dc27ee7f253b97a13229c627c2fe13655aae3a22584436b92933e42e5cb0752093c0ef20a78405114d0b24e0e941e5d64a9670fe0d10ecb0eaf4723
SSDEEP 192:7GNqV6P2UvQmiUyWEmDGv0bOjUI0BKWq+yU6:7GNM6eebhDGsbOjuKzU6
TLSH
T10C12F8756CA8AC775EA6B404F8C733638FE820B7D9856F80E5D45E1C04DBA9C374B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b141f1158041c832adcb84b1ca783326f695a63e80b50ac09bb51f41d9855707
MD5 6cb8f2090f3c3d02ea08fed390109c4a
SHA1 207c5408c24bbc4537970db1c2e43f6660b236ed
SHA512 65073b97d277f68f1ebbedaac0d120e46ec47dbe29626991f730e3fda28f37e66ae283cd96cfe7aa7d938cbd4418772128ddddebd4f8d19389b7869877841740
SSDEEP 192:zvGNeo1P2U7WMQmiU18jHuZnv0bOjUI0YKWq+yU8:zvGNh1euxWDEnsbOj/KzU8
TLSH
T1602218756D68AC774EE6B044F58737638FA820B7D8852F40D5D85F1C049B69C334B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

683cc201-ca2d-444d-bec9-ea1cc9b49f7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\683cc201-ca2d-444d-bec9-ea1cc9b49f7c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 94378ebd88a93fb6a95c46dc445cac904238a89b23c6b0130cfc86bf34d3ac51
MD5 cc7f5a831b584a288cf560de7ca91b68
SHA1 cafec1f1f2ce1c5a1fda48d473385c30378d8880
SHA512 5bb5842d5d0cbe5688c71c732486614dab24c94f3a80e652a9cf51edadd5b4e0b0d308c381d99795a130f3427cc3d804366389e58b0b4d0c3b50c039c350448c
SSDEEP 1536:LflJdah4iUxqYsYkzvHgfKQ9UpeE711kDa5ljNC+jH0IMZMXYo3tV3CNBQkj2zMN:LflJdaqiUqYsYkzvHgfKQ9UpeE711kDR
TLSH
T12C537392E9204E75E2E65F3EF15622627D30394690F8113212DC25EFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download