409b4c34daef7a3d3e9d8afa8fe5a7272af81a86ed714eb62eefa363a9a68348

Analysis

max time kernel
11s
max time network
67s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gooonernicer.exe
Size 44.0MB
Sample260907-mremjsvdle
SHA256 409b4c34daef7a3d3e9d8afa8fe5a7272af81a86ed714eb62eefa363a9a68348
MD5 7e61cc4b40b4abd78d4ce651e591e534
SHA1 8638c901d42a47601d81a9479e8e6abd50f9090b
SHA512 8674073fea8a0ddd9d5e4f65ade5de96ff539791978676d187f64514602ad84131e3eb11acd19e2d3eb99a6647645fe183ec63e80fa9e94019ebc98077660b37
SSDEEP 786432:t+gX4BMdhwzTQXR5FbPp3CYFcSS5U/LT2KVVyPVLIvdwY61gnGCnkri2nRwm45Ug:nXGMK4XR3b9CHSCU/+UyPlKw1gnGCnkI
TLSH
T1BCA73321E8C805D7E5AB1D35D0A3E74ADB98F8AA0B61D2FF407401574D73AE0663BB78
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Loads dropped DLL 55 IoCs

pid	Process
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
3460	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gooonernicer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
2616	powershell.exe
4824	powershell.exe
5056	powershell.exe
3292	powershell.exe

Discovers running processes 1 TTPs 11 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5620	tasklist.exe
5992	tasklist.exe
472	tasklist.exe
2736	tasklist.exe
5816	tasklist.exe
3624	tasklist.exe
5180	tasklist.exe
464	tasklist.exe
5116	tasklist.exe
3512	tasklist.exe
2524	tasklist.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gooonernicer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gooonernicer.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5312	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
4352	taskkill.exe
4760	taskkill.exe
3512	taskkill.exe
5280	taskkill.exe
5844	taskkill.exe
2408	taskkill.exe
4216	taskkill.exe
6116	taskkill.exe
2796	taskkill.exe
4660	taskkill.exe
4820	taskkill.exe
2820	taskkill.exe
1432	taskkill.exe
4660	taskkill.exe
3524	taskkill.exe
4868	taskkill.exe
4108	taskkill.exe
3232	taskkill.exe
4580	taskkill.exe
5956	taskkill.exe
2196	taskkill.exe
4528	taskkill.exe
5756	taskkill.exe
3800	taskkill.exe
4320	taskkill.exe
5264	taskkill.exe
3472	taskkill.exe
756	taskkill.exe
2340	taskkill.exe
4404	taskkill.exe
4960	taskkill.exe
5004	taskkill.exe
3356	taskkill.exe
2772	taskkill.exe
6016	taskkill.exe
2560	taskkill.exe
992	taskkill.exe
4364	taskkill.exe
2272	taskkill.exe
3784	taskkill.exe
2924	taskkill.exe
5556	taskkill.exe
5900	taskkill.exe
5352	taskkill.exe
2504	taskkill.exe
4404	taskkill.exe
5628	taskkill.exe
548	taskkill.exe
4680	taskkill.exe
3068	taskkill.exe
2512	taskkill.exe
3928	taskkill.exe
2988	taskkill.exe
4164	taskkill.exe
988	taskkill.exe
3800	taskkill.exe
5936	taskkill.exe
3512	taskkill.exe
3788	taskkill.exe
1764	taskkill.exe
3476	taskkill.exe
3848	taskkill.exe
3728	taskkill.exe
1384	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe
2660	gooonernicer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5976	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	taskkill.exe
Token: SeDebugPrivilege	1464	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe
Token: SeDebugPrivilege	5336	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	2824	taskkill.exe
Token: SeDebugPrivilege	6016	taskkill.exe
Token: SeDebugPrivilege	2660	gooonernicer.exe
Token: SeDebugPrivilege	2912	taskkill.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeBackupPrivilege	2660	gooonernicer.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2492	wmic.exe
Token: SeSecurityPrivilege	2492	wmic.exe
Token: SeTakeOwnershipPrivilege	2492	wmic.exe
Token: SeLoadDriverPrivilege	2492	wmic.exe
Token: SeSystemProfilePrivilege	2492	wmic.exe
Token: SeSystemtimePrivilege	2492	wmic.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 3460	3220	gooonernicer.exe	89
PID 3460 wrote to memory of 2660	3460	gooonernicer.exe	91
PID 3460 wrote to memory of 1280	3460	gooonernicer.exe	92
PID 3460 wrote to memory of 1464	3460	gooonernicer.exe	94
PID 3460 wrote to memory of 4108	3460	gooonernicer.exe	96
PID 3460 wrote to memory of 5336	3460	gooonernicer.exe	98
PID 3460 wrote to memory of 4768	3460	gooonernicer.exe	100
PID 3460 wrote to memory of 2824	3460	gooonernicer.exe	182
PID 3460 wrote to memory of 6016	3460	gooonernicer.exe	104
PID 3460 wrote to memory of 2912	3460	gooonernicer.exe	106
PID 3460 wrote to memory of 4320	3460	gooonernicer.exe	108
PID 2660 wrote to memory of 456	2660	gooonernicer.exe	198
PID 2660 wrote to memory of 2492	2660	gooonernicer.exe	111
PID 2660 wrote to memory of 676	2660	gooonernicer.exe	113
PID 2660 wrote to memory of 2548	2660	gooonernicer.exe	117
PID 2660 wrote to memory of 5312	2660	gooonernicer.exe	116
PID 3460 wrote to memory of 5936	3460	gooonernicer.exe	120
PID 2660 wrote to memory of 1784	2660	gooonernicer.exe	122
PID 3460 wrote to memory of 5036	3460	gooonernicer.exe	124
PID 3460 wrote to memory of 5164	3460	gooonernicer.exe	126
PID 2660 wrote to memory of 1384	2660	gooonernicer.exe	128
PID 3460 wrote to memory of 1496	3460	gooonernicer.exe	203
PID 3460 wrote to memory of 4540	3460	gooonernicer.exe	399
PID 3460 wrote to memory of 2796	3460	gooonernicer.exe	338
PID 3460 wrote to memory of 3524	3460	gooonernicer.exe	370
PID 3460 wrote to memory of 3800	3460	gooonernicer.exe	300
PID 3460 wrote to memory of 3476	3460	gooonernicer.exe	140
PID 3460 wrote to memory of 3256	3460	gooonernicer.exe	454
PID 3460 wrote to memory of 5920	3460	gooonernicer.exe	554
PID 2660 wrote to memory of 5976	2660	gooonernicer.exe	146
PID 5976 wrote to memory of 5048	5976	msedgewebview2.exe	147
PID 3460 wrote to memory of 2132	3460	gooonernicer.exe	148
PID 3460 wrote to memory of 4580	3460	gooonernicer.exe	593
PID 3460 wrote to memory of 4236	3460	gooonernicer.exe	395
PID 5976 wrote to memory of 1328	5976	msedgewebview2.exe	154
PID 5976 wrote to memory of 1328	5976	msedgewebview2.exe	154
PID 5976 wrote to memory of 1328	5976	msedgewebview2.exe	154
PID 5976 wrote to memory of 1328	5976	msedgewebview2.exe	154
PID 5976 wrote to memory of 5924	5976	msedgewebview2.exe	155
PID 5976 wrote to memory of 2228	5976	msedgewebview2.exe	156
PID 5976 wrote to memory of 2228	5976	msedgewebview2.exe	156
PID 5976 wrote to memory of 2228	5976	msedgewebview2.exe	156
PID 5976 wrote to memory of 3820	5976	msedgewebview2.exe	157
PID 5976 wrote to memory of 3820	5976	msedgewebview2.exe	157
PID 5976 wrote to memory of 3820	5976	msedgewebview2.exe	157
PID 5976 wrote to memory of 3820	5976	msedgewebview2.exe	157
PID 5976 wrote to memory of 3820	5976	msedgewebview2.exe	157

C:\Users\Admin\AppData\Local\Temp\gooonernicer.exe
"C:\Users\Admin\AppData\Local\Temp\gooonernicer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Users\Admin\AppData\Local\Temp\gooonernicer.exe
  "C:\Users\Admin\AppData\Local\Temp\gooonernicer.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Users\Admin\AppData\Local\Temp\gooonernicer.exe
    C:\Users\Admin\AppData\Local\Temp\gooonernicer.exe --child
    3⤵
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic bios get Manufacturer,Name,Version,ReleaseDate,SerialNumber /format:list
      4⤵
      PID:456
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic bios get Manufacturer,Name,Version,ReleaseDate,SerialNumber /format:list
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2492
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic baseboard get Manufacturer,Product,SerialNumber,Version /format:list
      4⤵
      PID:676
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic path win32_VideoController get Name,AdapterRAM,DriverVersion,VideoProcessor,CurrentHorizontalResolution,CurrentVerticalResolution /format:list
      4⤵
      Detects videocard installed
      PID:5312
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic desktopmonitor get Name,ScreenHeight,ScreenWidth,MonitorManufacturer,MonitorType /format:list
      4⤵
      PID:2548
  - - C:\Windows\SYSTEM32\whoami.exe
      whoami /user /fo list
      4⤵
      PID:1784
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic baseboard get Manufacturer,Product,SerialNumber,Version /format:list
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=gooonernicer.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2660.4368.14756766375749077085 /pfhostedapp:abad079028709badd2fd44c843e7e0d19ee57183
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:5976
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView /prefetch:4 /pfhostedapp:abad079028709badd2fd44c843e7e0d19ee57183 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x180,0x15c,0x7ffba88d5fd8,0x7ffba88d5fe4,0x7ffba88d5ff0
        5⤵
        
        PID:5048
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView" --webview-exe-name=gooonernicer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1708 --field-trial-handle=1712,i,13378162575734911501,9037291563819245767,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:abad079028709badd2fd44c843e7e0d19ee57183
        5⤵
        
        PID:1328
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView" --webview-exe-name=gooonernicer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2072 --field-trial-handle=1712,i,13378162575734911501,9037291563819245767,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:abad079028709badd2fd44c843e7e0d19ee57183
        5⤵
        
        PID:5924
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView" --webview-exe-name=gooonernicer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2248 --field-trial-handle=1712,i,13378162575734911501,9037291563819245767,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:abad079028709badd2fd44c843e7e0d19ee57183
        5⤵
        
        PID:2228
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView" --webview-exe-name=gooonernicer.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3348 --field-trial-handle=1712,i,13378162575734911501,9037291563819245767,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:abad079028709badd2fd44c843e7e0d19ee57183 /prefetch:1
        5⤵
        
        PID:3820
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic bios get Manufacturer,Name,Version,ReleaseDate,SerialNumber /format:list
      4⤵
      PID:1000
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic baseboard get Manufacturer,Product,SerialNumber,Version /format:list
      4⤵
      PID:4428
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM explorer.exe
      4⤵
      PID:4132
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5992
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5620
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:472
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      PID:5580
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4540
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      PID:5316
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      PID:2800
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      PID:4256
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      PID:4544
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      Kills process with taskkill
      PID:2272
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2736
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:3788
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      PID:4820
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:2144
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      PID:1408
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      PID:5168
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      PID:4144
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      PID:5920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3256
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      Kills process with taskkill
      PID:4216
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      PID:800
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      Kills process with taskkill
      PID:5956
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      Kills process with taskkill
      PID:3784
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5180
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:5624
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      PID:5812
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:548
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      PID:5496
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      Kills process with taskkill
      PID:4660
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      PID:4580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      PID:4812
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      PID:5580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      PID:4824
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      PID:1900
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5816
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      Kills process with taskkill
      PID:2772
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:1140
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      PID:5380
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:5932
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      PID:416
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      Kills process with taskkill
      PID:3512
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      PID:1952
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      Kills process with taskkill
      PID:5280
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      PID:1404
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5920
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      PID:2272
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      Kills process with taskkill
      PID:4164
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      Kills process with taskkill
      PID:6016
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:464
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:3784
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      Kills process with taskkill
      PID:1384
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:5860
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      PID:2772
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      PID:1000
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      Kills process with taskkill
      PID:5756
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      PID:2616
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      PID:3932
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      Kills process with taskkill
      PID:4868
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      PID:3492
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3624
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      PID:5908
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:2816
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      PID:1760
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:1632
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      PID:5992
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      PID:5564
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      PID:5764
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      PID:2728
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      PID:5580
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:5116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -ExpandProperty Model; Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SerialNumber; Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2616
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      PID:2444
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      PID:2508
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      PID:4144
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:3800
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      PID:5380
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      Kills process with taskkill
      PID:3788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-NetAdapter | Select-Object -ExpandProperty InterfaceDescription"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5056
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      PID:1632
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:1596
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      Kills process with taskkill
      PID:548
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      Kills process with taskkill
      PID:1432
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      PID:1568
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      PID:1056
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      PID:3492
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:3512
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      PID:4264
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snippingtool.exe
      4⤵
      PID:3936
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:1632
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM screenclippinghost.exe
      4⤵
      PID:2100
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      PID:1256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -ExpandProperty Model; Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty SerialNumber; Get-CimInstance -ClassName Win32_BaseBoard | Select-Object -ExpandProperty Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4824
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM lightshot.exe
      4⤵
      PID:4716
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:4112
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM sharex.exe
      4⤵
      PID:4740
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      PID:4580
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM bandicam.exe
      4⤵
      PID:3900
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      PID:548
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FO CSV /NH
      4⤵
      Discovers running processes
      PID:2524
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM camtasia.exe
      4⤵
      Kills process with taskkill
      PID:988
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM captura.exe
      4⤵
      PID:4960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-NetAdapter | Select-Object -ExpandProperty InterfaceDescription"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3292
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM greenshot.exe
      4⤵
      PID:4472
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit32.exe
      4⤵
      PID:2444
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM snagit64.exe
      4⤵
      Kills process with taskkill
      PID:3800
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM gamebarftserver.exe
      4⤵
      PID:1432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5936
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5036
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:5164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1496
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4540
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:2796
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:3524
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3800
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:3476
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:3256
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:5920
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2132
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:4236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5844
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3484
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:3812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4256
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2796
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4720
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:2408
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:6092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3100
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2824
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5880
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:424
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:3676
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3964
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:5556
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:2340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:456
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2036
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:472
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1496
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:3572
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4616
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3800
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:4352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:4364
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4680
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:1092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:3320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:852
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4340
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:756
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:1832
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:1956
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:5900
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3572
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:3068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:4760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:5628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2860
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5496
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5988
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4768
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3364
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:2900
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:5936
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:6080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:1748
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:5372
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5264
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3776
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:456
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:3444
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:3472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:3512
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:2512
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5860
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:2392
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:3800
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2772
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3624
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5600
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:4404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5116
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:4580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:3928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5916
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3728
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5180
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:3848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3572
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5456
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:1280
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2560
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2796
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:992
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5496
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4164
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:6124
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:4660
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4908
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:5352
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:3784
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:3728
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:3356
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:4072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:2196
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5948
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3524
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4476
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:1784
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2012
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3684
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:1140
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:3320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:1348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:2608
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4064
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:2636
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:3900
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4936
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:1348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:6020
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2860
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5300
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:2472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:3504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:6096
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:2504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:3932
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2324
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:1544
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:2664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:4960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2988
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:4404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5468
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2444
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5168
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:5004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:4528
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2444
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3292
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:3132
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:1568
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4136
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:2848
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2480
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:756
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5016
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:5764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:2924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:716
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:4580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:5916
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:4820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:1952
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:2820
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5676
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:6096
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5708
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:3584
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:3100
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    - Kills process with taskkill
    PID:2560
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2420
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3492
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4544
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:4448
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:1004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:4084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:1784
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:2924
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:2476
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:992
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5736
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:6116
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:1764
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:4780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:1784
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    PID:4156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:3788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    PID:5156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp64.exe
    3⤵
    PID:5948
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM processhacker.exe
    3⤵
    - Kills process with taskkill
    PID:5628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM taskmgr.exe
    3⤵
    PID:5580
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM procexp.exe
    3⤵
    - Kills process with taskkill
    PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\PyQt5\Qt5\bin\MSVCP140.dll
Size 576KB
SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
MD5 01b946a2edc5cc166de018dbb754b69c
SHA1 dbe09b7b9ab2d1a61ef63395111d2eb9b04f0a46
SHA512 65dc3f32faf30e62dfdecb72775df870af4c3a32a0bf576ed1aaae4b16ac6897b62b19e01dc2bf46f46fbe3f475c061f79cbe987eda583fee1817070779860e5
SSDEEP 12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
TLSH
T1DBC40923A74901A0E196E3B891C78306D7F17C468312E3C792FAD66D2F5B7D5AB3B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\PyQt5\Qt5\bin\MSVCP140_1.dll
Size 30KB
SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
MD5 0fe6d52eb94c848fe258dc0ec9ff4c11
SHA1 95cc74c64ab80785f3893d61a73b8a958d24da29
SHA512 c39a134210e314627b0f2072f4ffc9b2ce060d44d3365d11d8c1fe908b3b9403ebdd6f33e67d556bd052338d0ed3d5f16b54d628e8290fd3a155f55d36019a86
SSDEEP 384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
TLSH
T1F9E24C8AEB688883E963587085B9DD47FC3DF7D15B60529F1259E7680CD33C2AB3461C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\PyQt5\Qt5\bin\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\PyQt5\QtCore.pyd
Size 2.4MB
SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
MD5 678fa1496ffdea3a530fa146dedcdbcc
SHA1 c80d8f1de8ae06ecf5750c83d879d2dcc2d6a4f8
SHA512 8d9e3fa49fb42f844d8df241786ea9c0f55e546d373ff07e8c89aac4f3027c62ec1bd0c9c639afeabc034cc39e424b21da55a1609c9f95397a66d5f0d834e88e
SSDEEP 49152:ZYS8YHrNj4/7RsRLvYpiW3pCBU+Z7bJWvCSBYgbxGJ5M2GM/fXR1fUdihfSbCo6e:9bpj4/7RsRLvYpiW3pCBU+Z7bJWvCSBv
TLSH
T1C8B51957631965D4C4FAD638C90F860AF6F370111346A3CF24248BA92F637EA6BBDB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\PyQt5\sip.cp313-win_amd64.pyd
Size 117KB
SHA256 7a54c971af695af612a1cda68924a2170d4a2afe48dd32770b60fde5b2dd7dab
MD5 2d6576a84b75174a95410762971fca3c
SHA1 11b7a1b56fd4ca01bae27692b57fefcaa9f11ab3
SHA512 b8aeb89f03a7f5079381693695d622386b2ed1ff93b6f7eb80c509624a8568ba56ea573b3f9882f4af205b4a4ff8abf5a624d6e4c68c342e1c2e62608ed0cb0b
SSDEEP 3072:lePO8Y+E74YgjAlluOQxD1Y6QqE9Icnbdrc:lePOV+YgclkVl1WbIcnbVc
TLSH
T1B0C32A5B73D8008AEAA6917C8833A503D7F3B461271157CF12A0C65A2F67EE67DBE740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_hashlib.pyd
Size 67KB
SHA256 5eb4a2aa9e28b49cb2a4f6ecee21f3c2b629b43a0709bad1d7e6204bac74eac2
MD5 648a300c9deda89218f23faacd7b0d17
SHA1 fd5fda7807cbfbaa23d052fcd8140d7ff4e98ff6
SHA512 27a8dc1dc1dad7aeed93912b9544760a984e5e3da0014fce1b66170079992cfea36c18212024982336d415ddb17db114ca0c45c85dabf7218b9467bed2d3fe6d
SSDEEP 1536:XMqXn1yAu1lEAXfXhfcV5TaSZ6CAxIFvIdy1Ni9/kfIbH5OnM:B1w1uAJfcySZ6CAxIFvIFNT5Z
TLSH
T152637C95A6494092E92382B5C4A34F83F9B1F3521711ABDFA2A8C18D2F237C38777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_queue.pyd
Size 34KB
SHA256 6d77d15d668cb5ddff53cff1479dffc97db5858451d4b98f6e60a23cfb529e01
MD5 fee7303e90a0bb9197ec83a4a7ab7669
SHA1 c0a9edd7070a06f9a6c35002ec947abbe14644a1
SHA512 dedf77507ab46a6f2a9b34191f7c3e1b4a2af5ff6ee52f914653dde0d81f3fd8b580a73ce8742b47e175098649a1add77b2dc271616af68a3c3389273c32db3e
SSDEEP 768:H2Zhyt9jf8lIF9UJyy1KPuBL2Ip4PTxf1ml6Z+7U/Fg5U6:2+9jf8lIF9UUy1Ni91fILYqU6
TLSH
T133F26DC66B685047E663C630C1E7EE92F535F7D35A018B6F20A8D28A1E233C2D376359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_socket.pyd
Size 84KB
SHA256 ba944001aa6b53350f8c64e93643742abf1a08dd07c7dbbc13996e7d4d8a9efa
MD5 a40238c4b5c9821defaef7cbf70574c3
SHA1 cd478ef13743ff1fb0bdea95a5260b38e6fd0ae0
SHA512 abe79ecd594a1366de25e05f3be81f5a0da7616fb5d0481bf5cda156e55212680a6e9fb1966cde3ca470737e2d56dc167108b08aca8f314fa48ca38283895187
SSDEEP 1536:3Fl/fFBFu9aBvtgYKyNEyJw7QlyJ+i+nzmQwLvxtq388ZlIFywvy1Ni9JfIYbQ:3FR1u9mvPEyJw7QlyJL+nzmQSvxSxlII
TLSH
T1CE836B01A66040F6EB73C075C2639E63FB74B1C01395A75F0466C55A2F33782AF7AA86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_ssl.pyd
Size 177KB
SHA256 1cf939510359f5aa3c5f51a0ad994d9b819f5603dd100872cd30a1e25cd83f05
MD5 d41518f976563868b1626afd2eafb825
SHA1 2d1189562e4d37949d8b254ee3b94825d3787e29
SHA512 f9e1284720bd98e9e53feb2f2d16a0b86a6ddef4245789a9593e3e0bf230595577f1509f9050fae26619850661c6f5892ca5d33429b92efc6976565dd47bb98e
SSDEEP 3072:L9fZJvjN6U2kGMlfV6Cv/1UOmI7IM/cbPuC/Je5IFL7Oa5:L9xJrEU2tqV6CvqOss05
TLSH
T1AB048C47B5945AF7D813E4F9C1234903EBB0F155331247DE48D6E64A0F03B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_uuid.pyd
Size 27KB
SHA256 e196b2a878b8a57976e9ab5d7610e35a85e2fe3043fd3952934a54b415bd2854
MD5 8339c4c57827e3a294b9f711652ee4a3
SHA1 f940f35834b04c9896c7f2cad36ff6443fc3cb54
SHA512 bc35fdcaf87d3135863e41dbbe97c454dd8b6eeda9297ce3bd051b70ab7384bbafbe7fb24138aa5a1001b7b53565b1291c90e602f41d1244eacbd6e41a274a6e
SSDEEP 768:1TNg5n5IF0w2y1KPuBL2Ip40zTxf1mlRaX1Cbel:1xg5n5IF0w2y1Ni9MfIY1ll
TLSH
T12BC26DCA9A748043FE5396B0C1F6DE83B939BBD35911976B317591860E133C1A31B36D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\_wmi.pyd
Size 38KB
SHA256 ca38a50c27413a5acfd14b30b0433fcf80a64ad0020e41aceeb3666f8439aba4
MD5 39bf31877dd6b64700451021a91cd32e
SHA1 dca8e58dfe221c74f22c8bf56871e49a4f187966
SHA512 340765268b60520f6cf72cd37e6e9b5d1f728448ce2fd29427823f2bbb9630ee6894799c68744cf5bf65685772ba8b514e7735b76a298b94f5fc557513cfee55
SSDEEP 768:Z2/EEqrVmjsuuD2cru5IFLi9y1KPuBL2Ip4ETxf1ml6Z+7UBFg58:UE9BEKD2cru5IFLi9y1Ni9YfILqq8
TLSH
T192037D86E6680082FA6BC674C5A5CE93F575F7D35B12838F326582590F233D1D73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\base_library.zip
Size 1.3MB
SHA256 569f32ade5742fe4095a2302111e323107663beb1146fd1cdb54d6bc0f053213
MD5 65e5a6f6308345c08875b6ac474006f7
SHA1 304195eeddcc14ea40e0fd3d5ce4c887f180fa7c
SHA512 8f4fb19007bfe58aa7940950b6e3569738cfcd5215a785d57743a4e3c8fc7c8d0ea0682cb6cfac7a258853417854fb94f8d5c0a7dc1d3f69e7525f3a4b213bb0
SSDEEP 12288:7iOUhtYzGN8TxuuIva80201jwCVRDVoioSYwwsEwi2cPPdxhYdW7WpkrdjdTOPgd:XSuTxu8w05cPPdxhYM7WpudZCVwpW+
TLSH
T19D651982B9527953FF54F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\libssl-3.dll
Size 776KB
SHA256 28c395290279fa4f4f54a57b85cd66d853895f925fefb8f6fdebc0d8b1cdd07c
MD5 08ce4a95de930fd27157c67117f9a613
SHA1 286599acbf6695aba6ce0db02d70ce93d08d8ec7
SHA512 36df1092ad0c6474781e6a3a4f12bc6de57619628d76ff49cc98c53ea05f6b7a81f78b19c01ea188b8703f986527f23fc55725d4478656317da306e728e7fd18
SSDEEP 12288:0ZTYMn3pvH8hSil3nuZEV+sIP+US9dFe9XbI:tMn3pvH8Uil3uZEV+sIP+xFe9XbI
TLSH
T1A7F44CADB37C05DCD8B6C17986934623E3B6F4562330EBEB065186790F277D52B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\python3.dll
Size 70KB
SHA256 16f109e8411bc08341497c87704b7cf0d22a2678f1e3a7dca416ea7bff995469
MD5 c460c13c3fa9038cf9c5e379b6d91281
SHA1 500df0f6ff1641983bf1abafd2829ce3c06912ff
SHA512 08eba88a8c9457568d201f6a64592ebeb037f33efe4cc081672a707a62fdc7cc5924520528386461c36a4ec5fdf16999ee0b99bc82f7ec6c2eabc0973f1289dc
SSDEEP 768:x+QEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxE:kotssyKcunV8PSlIFy0Ay1Ni9ifIkZE
TLSH
T113633BC25B5BF8A2D6F665FC78DDD9CD242B02CC57268D9FA47893920F1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

security_audit.log

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\security_audit.log
Size 3KB
SHA256 0b9afcedc8eb6bd60d8ef475cfc7bac6ce864c8a59e24293c9696df7e05240ac
MD5 6fa8e2190a4488e8f5a450bc1db940bf
SHA1 92363428f4b82dc1992ea97a56c2f0d580e1bff2
SHA512 926614ef95b44fb4429c37bb9629b75a4343c01233d5831c5d7df7734e4d2466333e2de027d1dc0a192cab859619d588ea18b6fe7e5e410c100346800e38cf8f
TLSH
T186719B22317C18BB308F99B66CE4A3845F14B6A457D2D74E3844AF18706EA72593FCB9
MD5 SHA1 SHA512 TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\select.pyd
Size 32KB
SHA256 a208997eb871b5c7785eb9bcc6a22ba8c43262255b59a3394fbe9912f38b4692
MD5 9583139460ba3a40961b03c76f12450f
SHA1 70f4d1e8015a98972eb82d3012fea6826254ca7e
SHA512 19e4865a001ecaf6ca7815b7779238e39a58e87e55e479fb4e47baa8e0262e886f8fef64304e0692577464fa92173b81d1f5e4c12a3e0f3244ffe1f1913d84de
SSDEEP 768:/pX5TZnELTaPlIF9Gzy1KPuBL2Ip40LTxf1ml9dHi7LL:hX5T5E/aPlIF9Gzy1Ni90pfIbHinL
TLSH
T1C6E28D8A6B345087EA63C671C6A2DE83F939B3E34651869F31B991991E137C1A33B314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32202\ucrtbase.dll
Size 1.1MB
SHA256 a58995e4f6b9a87abde4088d5d0d1a0f182594b9d3f9e4494ff8b1c4499cb091
MD5 b3fae8b0b718843c5c681f1bfa1a8f5e
SHA1 b460d02f4365714d4ff4f7ade3d973951ea3b452
SHA512 a9ba1d188d643787f386ba2a7a6f4e5ef5f70a027552e0434c4ce4eb278d2663c0e8b4b5dca85fc081d473417b2b673f69e18e22a60871a521160574df3aae2d
SSDEEP 24576:XRmADWOBBIHv0XESwR5H7iFZBmai0gFcszUmxvSZX0ypm:htI045H+ZB7fgDz
TLSH
T16A359E28B76C02AAC57BE17DC923550EF972380447709ACB03A74BB93E277E956B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_i0vbizpo.nz2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0vbizpo.nz2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e21226d1ed0ad668c97882dcfb3a0b90426952ef6a6388fcd4ae9dcf29a3edf8
MD5 2aec7d77aad967feda589622ea144267
SHA1 3f098ee9b038278061751c694a4f39b57a30afa0
SHA512 c32e5f8505882493bd7af6bd4a07020a53e92f07fcbb6adf2774b544c1e5db59bcba0b7bbc250d258ff01151ab5599296bf04e158292b627712958be6ad04612
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e067a17710858eab3c752c20c38f957741d8dc4b62ea4f6749c1c11f2cc64f13
MD5 32f11b3d3dfcab82aa108bfdeb5cb678
SHA1 18ff7d202045c95f7eed2f1f5eaf1dc4ae2b04ef
SHA512 8ac01792151419d09d53226698b1b0c5d38d31210b999122a13efad1b3b3710caff8410c56d11436f4b12792e17937e4130b7d551c48e782f157deb2d0c35327
TLSH
T16AD0122777211134C01026332406A6090400D70B414643406828866E2F540981D03441
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Default\Preferences
Size 4KB
SHA256 78a7cb3853385ec69f6ba681bc0f07d9088603edfc982329dcab885991bbdf00
MD5 0a0655a3b1d8af0245548a556cb94d70
SHA1 f71184fda4dedb2cd5deb136547698443087ea96
SHA512 011885ae254cc4e72ecbaf8d458f696d3543ec6b3ca381281fcfbabdf75ca98c7649ba7af6d24490d846835a4b1a935bbf1acada712f6748eac14a2311e9fb95
SSDEEP 96:rnp5WQSRLpd35h16ZZs7/x+6MhmuecmjeRK+gZw28XMZCB:rnpsFv3+sV+FijzYG8
TLSH
T16EA1B6026F64B97B4CCBF25D7E357B42E2F5212230D41A88EBF8865C089A6CD6303C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Default\Preferences
Size 4KB
SHA256 5dda7a15f19f0a78771bd4d22a4b67352329d21ec0b25483fac254a5942bad62
MD5 3d701e3d5b0cd8fc164cac68fc76e436
SHA1 3dcd007cde3d7ffc8c850f0cdf17b4fc363e5205
SHA512 2f53ea3a6ce831e2a6d51976f40f3ef7b78a5ea0d1f6bba57f2d1d747a606d82a57e020b51faa206166d58c007129a26fa194d3b1b5a4ad0492907d1890789bf
SSDEEP 96:stnp5WQSRL135h16ZZs7/x+6MhmuecmjeRK+gZw28XMZCB:stnpsFp3+sV+FijzYG8
TLSH
T163A196026E68B97B4CCBF2597E357F42E2F5216235D41A94EBF8865C089A6CD6313C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59fed8.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Default\Preferences~RFe59fed8.TMP
Size 4KB
SHA256 c41b1a527322e6d95f1b91b086f4481ea97756e22b16a5d0dd9ce24575efebd9
MD5 9461a8f00c75d4479f69d6b956ef7de8
SHA1 027509887117bcd68e82713440f8fcbf50a39a13
SHA512 19b94d506b558ecff75941550b12bda48cc16ff4995bceae34b249f9be4d523a9b8a9950f5548c7b73ea0f19a5639cc9bf7bae017567cc2718eda617b4d80576
SSDEEP 96:rnp5WQSRLpd3616ZZs7/x+6MhmuecmjeRK+gRw28XMZCB:rnpsFv3jsV+FijzQG8
TLSH
T113A1B8026F68BA7B4CCAF15D7E353F42E2F5612135D41A98EBF8865C089A5CD6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Local State
Size 2KB
SHA256 d77adf152476cdc505049897c37aaf882520164f6eedd76d396558bbbe1fc935
MD5 4600638c11d5da4163dea753797aeb46
SHA1 994e03780686c9c1a3ac2be8a80927cf7e85151d
SHA512 cee7f742ea8e98c32200d6be9b85c05a4b6ee91f61ae2997ba5ffeed453e2f0b89c25b6064c1d5a153af731c43194285cc976fe8f8f6b5b084cf6341591c7061
TLSH
T1A051A7337C24D73B9AE6964879473F27DE795161AA522F20E6EE0B1D01D754E6302C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Local State
Size 3KB
SHA256 83f958824a8ce17fc508c2cb99a91d9d7338f1556cd82c84b97b601a5acba166
MD5 69256c3fd784004be0c8750ba5c66c5b
SHA1 da93a0718bd6f75e133a7f5607bbc68fd4a3fc96
SHA512 4a050b0676a187d83178f0f99601020020b56c351cb9f904023f1b6d3a0f163c3d697f2357fbcfcea03058e1f4e0773e6bfc2347f3d62d5b1cfd59189a7a0b9a
TLSH
T16D61A5376874E63B5EF69A04B9863B1AABA55123E5813F64D6FD0F1D01D728D1342C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Local State
Size 3KB
SHA256 292a22349e361342e64d292afca3c8493cc8bbefdd5c7bbd6440dfca9d1bcf77
MD5 dd1ae30f70164f1736b047f08790b024
SHA1 3632af44e45a9b7dda9a38c309763a9f554f8c57
SHA512 f03f7018376b5862085b69031949bfbaef7c69897c76795ae7488b0294d4ec0df88691be3c5b077888b5ea374b7b66846353a3163e077382fe9c31bcb2fef573
TLSH
T17571A6326874AA3B5EF6E508B9863B17ABA45123E5917FA8D6FD0F1D01D728E1342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Local State
Size 3KB
SHA256 1ab9f1c3e0938b973c19f5a2c33bb62c70cb00354efd9e505531bede45ff2d4e
MD5 c5bfced02666c73cda8414d56afb7c45
SHA1 38c89e0f403f2c163b007128ccb5f118923ed076
SHA512 47589b5a7d7ef020ebc1e6b7d7636dde9d5313b06b314e90220cab8a0ce80011619752f1e2f41f0b5c1a59f00c4bfd23182e2e7e488a51202ca94b5e205801f2
TLSH
T1F771C7326974EA3B5EF6D544B9463B17ABA45123E4817F94D6FD0F1E01D728E1302C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Local State
Size 15KB
SHA256 ec3f1fefbec1e4e655f335de33dba1857daeb7f7cd0e5ae88cc300afc734e62a
MD5 f9ef18ba21014d77d136f0ca9bb787a5
SHA1 fa5d1ec7943876d346c8c483e51f01224502bdb9
SHA512 0d7537a78d4e06c88fee1e802afd2757f3fefba899f57285ec548a6650191253ecb3635517471d86266fe28e96bd644aec940eab8cb8b275280192d302ae40c9
SSDEEP 384:V+aQikB+z/xvxjg/qhE4NBS0XPQ2zFC9zb:g/UxvxjgC+wPJAFb
TLSH
T111728D3755787E37AAF7F6447949178FCBB9987294C26E748ABD0F0A06C32D91342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597d16.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmp7re0dnfr\EBWebView\Local State~RFe597d16.TMP
Size 1KB
SHA256 4e1137f0127c010572d2eca3b5a2c1403b1e40145c80818480c382ca71c0d87b
MD5 270df3861df2c8f99902bfa436519457
SHA1 911c09cb18e3852254a049409deb9faabc18a3a2
SHA512 1ac737c447e29c4e21fd5710b4a4195af8be5c906c35bafdd709ef8d924e518638a58606482262cafa3e0e622908120015c55d12f02bfb832fd1e492380b8e19
TLSH
T149215473E868D7377E99624532533A2FAE70112292514F00B1FE0B2F02D618EA227C32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1328-480-0x00007FFBCF850000-0x00007FFBCF851000-memory.dmp

Download

memory/2616-597-0x000001FD3E0C0000-0x000001FD3E172000-memory.dmp

Download

memory/2616-596-0x000001FD3E0A0000-0x000001FD3E0BE000-memory.dmp

Download

memory/2616-599-0x000001FD3E620000-0x000001FD3E64A000-memory.dmp

Download

memory/2616-600-0x000001FD3E620000-0x000001FD3E644000-memory.dmp

Download

memory/2616-598-0x000001FD3E180000-0x000001FD3E18A000-memory.dmp

Download

memory/2660-389-0x000001A2E2270000-0x000001A2E227E000-memory.dmp

Download

memory/2660-388-0x000001A2FAFD0000-0x000001A2FB03C000-memory.dmp

Download

memory/2660-386-0x000001A2E22B0000-0x000001A2E22B8000-memory.dmp

Download

memory/2660-380-0x000001A2E2460000-0x000001A2E247A000-memory.dmp

Download

memory/2660-391-0x000001A2E2300000-0x000001A2E2308000-memory.dmp

Download

memory/2660-379-0x000001A2FAC90000-0x000001A2FAD04000-memory.dmp

Download

memory/2660-385-0x000001A2FB520000-0x000001A2FBADA000-memory.dmp

Download

memory/2660-378-0x00007FFBBF2B0000-0x00007FFBBF2BA000-memory.dmp

Download

memory/2660-377-0x000001A2E2290000-0x000001A2E229A000-memory.dmp

Download

memory/2660-381-0x000001A2E2450000-0x000001A2E2458000-memory.dmp

Download

memory/2660-382-0x000001A2E2490000-0x000001A2E2498000-memory.dmp

Download

memory/2660-387-0x000001A2E22B0000-0x000001A2E22B8000-memory.dmp

Download

memory/2660-376-0x00007FFBAF8B0000-0x00007FFBAFB13000-memory.dmp

Download

memory/2660-383-0x000001A2FAE10000-0x000001A2FAE18000-memory.dmp

Download

memory/2660-384-0x000001A2E2310000-0x000001A2E2332000-memory.dmp

Download

memory/3460-350-0x00007FFBAF8B0000-0x00007FFBAFB13000-memory.dmp

Download

memory/3820-481-0x00007FFBCF850000-0x00007FFBCF851000-memory.dmp

Download

memory/5056-606-0x000002B7A95D0000-0x000002B7A95EE000-memory.dmp

Download