850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa

Analysis

user interaction
yes
max time kernel
299s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MAS_AIO.cmd
Size 744KB
Sample261001-sbv79aee64
SHA256 850f979665fb93999acae93f4790c1ff8ed2041532060b7966a121c2d29a0bfa
MD5 8e0a0b48ad0289d647e55d802170d795
SHA1 6adced8154ebaa02e06efcb85715d2663c731bd0
SHA512 58edc773d275dec130cc5ede3c55edc5680f52e1b7ca4d78b349323f6d64b565ba052366b59ff4a94640fb49d14c2ec490dc69946bac9f921cb82bb62bffe563
SSDEEP 6144:g3IufxkU5/8BcEvTGmFOE8THncQx4Oz0ykw7Auj:g3IuuhcEvTGGOEmcAXz0ykw7x
TLSH
T192F41A466D0261A601B3F379DE53814EFB2AC2638375526879ADC044BF36309A2FEF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
700	powershell.exe
4568	powershell.exe
3032	powershell.exe
3464	powershell.exe
4868	powershell.exe
3232	powershell.exe

Enumerates connected drives 3 TTPs 20 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3252	sc.exe
2112	sc.exe
2016	sc.exe
4512	sc.exe
1672	sc.exe
4964	sc.exe
3988	sc.exe
4656	sc.exe
1876	sc.exe
3648	sc.exe
4064	sc.exe
1652	sc.exe
3516	sc.exe
4256	sc.exe
4316	sc.exe
4216	sc.exe
3320	sc.exe
1820	sc.exe
1036	sc.exe
2544	sc.exe
3580	sc.exe
4064	sc.exe
3060	sc.exe
1916	sc.exe
4760	sc.exe
1636	sc.exe
2336	sc.exe
4848	sc.exe
4868	sc.exe
3936	sc.exe
1932	sc.exe
1904	sc.exe
4768	sc.exe
1068	sc.exe
812	sc.exe
4568	sc.exe
4800	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 35 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4376	cmd.exe
1632	cmd.exe
2928	cmd.exe
3828	cmd.exe
3972	cmd.exe
2560	cmd.exe
2852	cmd.exe
1716	cmd.exe
736	cmd.exe
3768	cmd.exe
3708	cmd.exe
4088	cmd.exe
2384	cmd.exe
4364	cmd.exe
4156	cmd.exe
4316	cmd.exe
856	cmd.exe
1344	cmd.exe
2320	cmd.exe
4884	cmd.exe
5040	cmd.exe
2044	cmd.exe
4468	cmd.exe
3300	cmd.exe
4368	cmd.exe
3012	cmd.exe
3216	cmd.exe
4676	cmd.exe
4892	cmd.exe
4780	cmd.exe
4756	cmd.exe
1396	cmd.exe
684	cmd.exe
1156	cmd.exe
3844	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 24 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1716	cmd.exe
4976	PING.EXE
4376	cmd.exe
3800	PING.EXE
2320	cmd.exe
4348	PING.EXE

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5212	msedge.exe
5660	msedge.exe
2888	chrome.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry key 1 TTPs 53 IoCs

Modify Registry

T1112

pid	Process
2332	reg.exe
4712	reg.exe
312	reg.exe
972	reg.exe
1956	reg.exe
5008	reg.exe
4884	reg.exe
4976	reg.exe
1584	reg.exe
4464	reg.exe
1168	reg.exe
4012	reg.exe
2856	reg.exe
3368	reg.exe
736	reg.exe
3988	reg.exe
3020	reg.exe
2892	reg.exe
2268	reg.exe
2576	reg.exe
1736	reg.exe
4724	reg.exe
1044	reg.exe
3724	reg.exe
3916	reg.exe
1388	reg.exe
4332	reg.exe
3980	reg.exe
1860	reg.exe
2460	reg.exe
812	reg.exe
4608	reg.exe
2732	reg.exe
4092	reg.exe
2924	reg.exe
4928	reg.exe
3712	reg.exe
4084	reg.exe
8	reg.exe
1640	reg.exe
1932	reg.exe
3800	reg.exe
2064	reg.exe
700	reg.exe
3708	reg.exe
1780	reg.exe
1136	reg.exe
1068	reg.exe
1656	reg.exe
3456	reg.exe
4224	reg.exe
3600	reg.exe
2004	reg.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6104	NOTEPAD.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3800	PING.EXE
4348	PING.EXE
4976	PING.EXE

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
4472	powershell.exe
4472	powershell.exe
4640	powershell.exe
4640	powershell.exe
1032	powershell.exe
1032	powershell.exe
4928	powershell.exe
4928	powershell.exe
700	powershell.exe
700	powershell.exe
3960	powershell.exe
3960	powershell.exe
3232	powershell.exe
3232	powershell.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
4568	powershell.exe
4568	powershell.exe
4568	powershell.exe
3768	powershell.exe
3768	powershell.exe
3768	powershell.exe
4840	powershell.exe
4840	powershell.exe
4840	powershell.exe
2924	powershell.exe
2924	powershell.exe
2924	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
3464	powershell.exe
3464	powershell.exe
3464	powershell.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
3476	powershell.exe
3476	powershell.exe
3476	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3992	msedge.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeIncreaseQuotaPrivilege	1652	WMIC.exe
Token: SeSecurityPrivilege	1652	WMIC.exe
Token: SeTakeOwnershipPrivilege	1652	WMIC.exe
Token: SeLoadDriverPrivilege	1652	WMIC.exe
Token: SeSystemProfilePrivilege	1652	WMIC.exe
Token: SeSystemtimePrivilege	1652	WMIC.exe
Token: SeProfSingleProcessPrivilege	1652	WMIC.exe
Token: SeIncBasePriorityPrivilege	1652	WMIC.exe
Token: SeCreatePagefilePrivilege	1652	WMIC.exe
Token: SeBackupPrivilege	1652	WMIC.exe
Token: SeRestorePrivilege	1652	WMIC.exe
Token: SeShutdownPrivilege	1652	WMIC.exe
Token: SeDebugPrivilege	1652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1652	WMIC.exe
Token: SeRemoteShutdownPrivilege	1652	WMIC.exe
Token: SeUndockPrivilege	1652	WMIC.exe
Token: SeManageVolumePrivilege	1652	WMIC.exe
Token: 33	1652	WMIC.exe
Token: 34	1652	WMIC.exe
Token: 35	1652	WMIC.exe
Token: 36	1652	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1652	WMIC.exe
Token: SeSecurityPrivilege	1652	WMIC.exe
Token: SeTakeOwnershipPrivilege	1652	WMIC.exe
Token: SeLoadDriverPrivilege	1652	WMIC.exe
Token: SeSystemProfilePrivilege	1652	WMIC.exe
Token: SeSystemtimePrivilege	1652	WMIC.exe
Token: SeProfSingleProcessPrivilege	1652	WMIC.exe
Token: SeIncBasePriorityPrivilege	1652	WMIC.exe
Token: SeCreatePagefilePrivilege	1652	WMIC.exe
Token: SeBackupPrivilege	1652	WMIC.exe
Token: SeRestorePrivilege	1652	WMIC.exe
Token: SeShutdownPrivilege	1652	WMIC.exe
Token: SeDebugPrivilege	1652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1652	WMIC.exe
Token: SeRemoteShutdownPrivilege	1652	WMIC.exe
Token: SeUndockPrivilege	1652	WMIC.exe
Token: SeManageVolumePrivilege	1652	WMIC.exe
Token: 33	1652	WMIC.exe
Token: 34	1652	WMIC.exe
Token: 35	1652	WMIC.exe
Token: 36	1652	WMIC.exe
Token: SeDebugPrivilege	1032	powershell.exe
Token: SeIncreaseQuotaPrivilege	1544	WMIC.exe
Token: SeSecurityPrivilege	1544	WMIC.exe
Token: SeTakeOwnershipPrivilege	1544	WMIC.exe
Token: SeLoadDriverPrivilege	1544	WMIC.exe
Token: SeSystemProfilePrivilege	1544	WMIC.exe
Token: SeSystemtimePrivilege	1544	WMIC.exe
Token: SeProfSingleProcessPrivilege	1544	WMIC.exe
Token: SeIncBasePriorityPrivilege	1544	WMIC.exe
Token: SeCreatePagefilePrivilege	1544	WMIC.exe
Token: SeBackupPrivilege	1544	WMIC.exe
Token: SeRestorePrivilege	1544	WMIC.exe
Token: SeShutdownPrivilege	1544	WMIC.exe
Token: SeDebugPrivilege	1544	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1544	WMIC.exe
Token: SeRemoteShutdownPrivilege	1544	WMIC.exe
Token: SeUndockPrivilege	1544	WMIC.exe
Token: SeManageVolumePrivilege	1544	WMIC.exe
Token: 33	1544	WMIC.exe
Token: 34	1544	WMIC.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe
5732	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3516	4892	cmd.exe	87
PID 4892 wrote to memory of 2396	4892	cmd.exe	88
PID 4892 wrote to memory of 2644	4892	cmd.exe	89
PID 4892 wrote to memory of 1344	4892	cmd.exe	90
PID 4892 wrote to memory of 4580	4892	cmd.exe	91
PID 4892 wrote to memory of 4992	4892	cmd.exe	92
PID 4892 wrote to memory of 5016	4892	cmd.exe	93
PID 4892 wrote to memory of 4440	4892	cmd.exe	94
PID 4892 wrote to memory of 4368	4892	cmd.exe	95
PID 4368 wrote to memory of 4812	4368	cmd.exe	96
PID 4368 wrote to memory of 2588	4368	cmd.exe	97
PID 4892 wrote to memory of 1080	4892	cmd.exe	98
PID 4892 wrote to memory of 2260	4892	cmd.exe	99
PID 4892 wrote to memory of 3320	4892	cmd.exe	100
PID 4892 wrote to memory of 3012	4892	cmd.exe	101
PID 3012 wrote to memory of 4472	3012	cmd.exe	102
PID 4892 wrote to memory of 3216	4892	cmd.exe	103
PID 3216 wrote to memory of 4836	3216	cmd.exe	104
PID 4892 wrote to memory of 1584	4892	cmd.exe	106
PID 4892 wrote to memory of 2676	4892	cmd.exe	107
PID 4892 wrote to memory of 4712	4892	cmd.exe	108
PID 4892 wrote to memory of 5040	4892	cmd.exe	109
PID 4892 wrote to memory of 1736	4892	cmd.exe	110
PID 5040 wrote to memory of 4256	5040	cmd.exe	113
PID 5040 wrote to memory of 3680	5040	cmd.exe	114
PID 5040 wrote to memory of 1156	5040	cmd.exe	115
PID 5040 wrote to memory of 4500	5040	cmd.exe	116
PID 5040 wrote to memory of 436	5040	cmd.exe	117
PID 5040 wrote to memory of 4780	5040	cmd.exe	118
PID 5040 wrote to memory of 4488	5040	cmd.exe	119
PID 5040 wrote to memory of 4928	5040	cmd.exe	120
PID 5040 wrote to memory of 1536	5040	cmd.exe	121
PID 5040 wrote to memory of 1036	5040	cmd.exe	122
PID 5040 wrote to memory of 4756	5040	cmd.exe	123
PID 4756 wrote to memory of 4912	4756	cmd.exe	124
PID 4756 wrote to memory of 808	4756	cmd.exe	125
PID 5040 wrote to memory of 5084	5040	cmd.exe	126
PID 5040 wrote to memory of 556	5040	cmd.exe	127
PID 5040 wrote to memory of 2384	5040	cmd.exe	130
PID 5040 wrote to memory of 3972	5040	cmd.exe	131
PID 3972 wrote to memory of 4640	3972	cmd.exe	132
PID 5040 wrote to memory of 4676	5040	cmd.exe	133
PID 4676 wrote to memory of 684	4676	cmd.exe	134
PID 5040 wrote to memory of 4376	5040	cmd.exe	136
PID 4376 wrote to memory of 3800	4376	cmd.exe	137
PID 5040 wrote to memory of 2320	5040	cmd.exe	138
PID 2320 wrote to memory of 4348	2320	cmd.exe	140
PID 5040 wrote to memory of 3836	5040	cmd.exe	141
PID 5040 wrote to memory of 4012	5040	cmd.exe	142
PID 5040 wrote to memory of 2528	5040	cmd.exe	143
PID 5040 wrote to memory of 4760	5040	cmd.exe	144
PID 5040 wrote to memory of 2560	5040	cmd.exe	145
PID 2560 wrote to memory of 4316	2560	cmd.exe	146
PID 5040 wrote to memory of 2728	5040	cmd.exe	147
PID 5040 wrote to memory of 2064	5040	cmd.exe	150
PID 5040 wrote to memory of 3516	5040	cmd.exe	151
PID 5040 wrote to memory of 4724	5040	cmd.exe	152
PID 5040 wrote to memory of 1996	5040	cmd.exe	153
PID 5040 wrote to memory of 4952	5040	cmd.exe	154
PID 5040 wrote to memory of 2264	5040	cmd.exe	156
PID 5040 wrote to memory of 4216	5040	cmd.exe	157
PID 5040 wrote to memory of 4260	5040	cmd.exe	158
PID 5040 wrote to memory of 3632	5040	cmd.exe	159
PID 5040 wrote to memory of 2604	5040	cmd.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:3516
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:2396
- C:\Windows\System32\findstr.exe
  findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
  2⤵
  PID:2644
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:1344
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:4580
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4992
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:5016
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:4440
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:4812
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:2588
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
  2⤵
  PID:1080
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:2260
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:3320
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:4836
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:1584
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2676
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:4712
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:4256
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:3680
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd"
    3⤵
    PID:1156
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:4500
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:436
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:4780
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:4488
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4928
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:1536
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:1036
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:4912
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:808
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd" "
    3⤵
    PID:5084
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:556
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:2384
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4640
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:684
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\System32\PING.EXE
      ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3800
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\System32\PING.EXE
      ping -n 1 updatecheck312.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4348
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:3836
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:4012
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:2528
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:4760
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:4316
- - C:\Windows\System32\mode.com
    mode 76, 34
    3⤵
    PID:2728
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:2064
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:3516
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:4724
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:1996
- - C:\Windows\System32\choice.exe
    choice /C:12345678EH0 /N
    3⤵
    PID:4952
- - C:\Windows\System32\mode.com
    mode 110, 34
    3⤵
    PID:2264
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:4216
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:4260
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:3632
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:2604
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:812
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:3324
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:4512
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:4120
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:2256
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    - Executes a command shell one-liner
    PID:4088
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:1652
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:2464
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
    3⤵
    - Executes a command shell one-liner
    PID:1632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1032
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1156
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
      4⤵
      PID:4976
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:1544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4928
- - C:\Windows\System32\find.exe
    find /i "Subscription_is_activated"
    3⤵
    PID:2188
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    PID:2384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:700
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
    3⤵
    PID:1164
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:1640
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:1932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:3960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3232
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:5036
- - C:\Windows\System32\findstr.exe
    findstr /i "Windows"
    3⤵
    PID:4092
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    - Executes a command shell one-liner
    PID:2044
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:4900
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:4884
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1716
  - - C:\Windows\System32\PING.EXE
      ping -n 1 l.root-servers.net
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4976
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:3692
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:2544
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4768
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5084
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4668
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:4684
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:1904
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:4024
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:832
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:1036
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
    3⤵
    PID:3744
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
    3⤵
    - Executes a command shell one-liner
    PID:3844
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      PID:4848
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:4568
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:1672
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
    3⤵
    - Modifies registry key
    PID:312
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
    3⤵
    - Modifies registry key
    PID:1044
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
    3⤵
    - Modifies registry key
    PID:2460
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
    3⤵
    - Modifies registry key
    PID:4464
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
    3⤵
    - Modifies registry key
    PID:972
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
    3⤵
    - Modifies registry key
    PID:3724
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
    3⤵
    - Modifies registry key
    PID:700
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
    3⤵
    - Modifies registry key
    PID:1068
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:4964
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:4800
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:812
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
    3⤵
    - Modifies registry key
    PID:1168
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
    3⤵
    - Modifies registry key
    PID:3988
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
    3⤵
    - Modifies registry key
    PID:4608
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:1656
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
    3⤵
    - Modifies registry key
    PID:4012
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
    3⤵
    - Modifies registry key
    PID:3020
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
    3⤵
    - Modifies registry key
    PID:1956
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:4316
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:4064
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:2732
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
    3⤵
    - Modifies registry key
    PID:2892
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
    3⤵
    - Modifies registry key
    PID:1860
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
    3⤵
    - Modifies registry key
    PID:3916
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:1388
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
    3⤵
    - Modifies registry key
    PID:2332
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
    3⤵
    - Modifies registry key
    PID:3712
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
    3⤵
    - Modifies registry key
    PID:5008
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:2016
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:1652
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
    3⤵
    - Modifies registry key
    PID:4092
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
    3⤵
    - Modifies registry key
    PID:3456
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
    3⤵
    - Modifies registry key
    PID:4224
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
    3⤵
    - Modifies registry key
    PID:4884
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
    3⤵
    - Modifies registry key
    PID:2268
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
    3⤵
    - Modifies registry key
    PID:4976
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
    3⤵
    - Modifies registry key
    PID:2576
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
    3⤵
    - Modifies registry key
    PID:2924
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:2544
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:4768
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
    3⤵
    - Modifies registry key
    PID:4084
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
    3⤵
    - Modifies registry key
    PID:8
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
    3⤵
    - Modifies registry key
    PID:2856
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
    3⤵
    - Modifies registry key
    PID:3368
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
    3⤵
    - Modifies registry key
    PID:3600
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
    3⤵
    - Modifies registry key
    PID:4928
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
    3⤵
    - Modifies registry key
    PID:736
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
    3⤵
    - Modifies registry key
    PID:2004
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:2336
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:4848
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
    3⤵
    - Modifies registry key
    PID:3708
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
    3⤵
    - Modifies registry key
    PID:1780
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
    3⤵
    - Modifies registry key
    PID:1136
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
    3⤵
    - Modifies registry key
    PID:4332
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
    3⤵
    - Modifies registry key
    PID:1640
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
    3⤵
    - Modifies registry key
    PID:1932
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
    3⤵
    - Modifies registry key
    PID:3980
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
    3⤵
    - Modifies registry key
    PID:3800
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:1916
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:4760
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:1068
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:4868
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:4216
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:3320
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:1636
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4260
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:1876
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:1820
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4532
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:3252
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:812
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:3944
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:3988
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:3648
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:1084
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:3936
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:3580
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:3020
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:2112
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:4064
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:1840
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:4656
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1324
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:2640
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService get Version
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3788
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    - Executes a command shell one-liner
    PID:4364
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
    3⤵
    PID:4864
- - C:\Windows\System32\findstr.exe
    findstr /i "0x800410 0x800440 0x80131501"
    3⤵
    PID:4396
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
    3⤵
    PID:4468
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1396
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
      4⤵
      PID:1528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4568
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:4348
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
    3⤵
    PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:3768
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4840
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
    3⤵
    PID:1956
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
    3⤵
    PID:5112
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4316
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2704
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:4656
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:3796
- - C:\Windows\System32\sc.exe
    sc query wlms
    3⤵
    - Launches sc.exe
    PID:3060
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
    3⤵
    PID:3788
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
    3⤵
    PID:4364
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
    3⤵
    PID:4092
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
    3⤵
    PID:4396
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4468
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
      4⤵
      PID:4488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2924
- - C:\Windows\System32\findstr.exe
    findstr /i "KMS_"
    3⤵
    PID:808
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
      4⤵
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4848
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "
    3⤵
    PID:4268
- - C:\Windows\System32\find.exe
    find /i "Ready"
    3⤵
    PID:312
- - C:\Windows\System32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
    3⤵
    PID:2204
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
    3⤵
    PID:1932
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
    3⤵
    PID:3160
- - C:\Windows\System32\findstr.exe
    findstr /i "Removed Not Found"
    3⤵
    PID:2608
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:2604
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "
    3⤵
    PID:4252
- - C:\Windows\System32\find.exe
    find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
    3⤵
    PID:4868
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:3096
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    - Executes a command shell one-liner
    PID:3768
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:2200
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2928
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Name
      4⤵
      PID:3020
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3828
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Nation
      4⤵
      PID:3076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS_AIO.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3464
- - C:\Windows\System32\ClipUp.exe
    clipup -v -o
    3⤵
    PID:4560
  - - C:\Windows\System32\clipup.exe
      clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem37DF.tmp
      4⤵
      Checks SCSI registry key(s)
      PID:1844
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    PID:856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3032
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
    3⤵
    PID:2936
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:1800
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:2528
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    - Executes a command shell one-liner
    PID:3708
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    PID:1420
- - C:\Windows\System32\findstr.exe
    findstr /i "Windows"
    3⤵
    PID:4392
- - C:\Windows\System32\reg.exe
    reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f
    3⤵
    PID:2944
- - C:\Windows\System32\reg.exe
    reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f
    3⤵
    PID:832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"
    3⤵
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:3476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:4868
- - C:\Windows\System32\choice.exe
    choice /C:10 /N
    3⤵
    PID:4260
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:1736

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:3044
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\tem2E0B.tmp
  2⤵
  - Checks SCSI registry key(s)
  PID:836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault70208099h065dh4224h99cdhfd87fbb25ab5
1⤵
PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault70208099h065dh4224h99cdhfd87fbb25ab5 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x278,0x7ffc828cc188,0x7ffc828cc194,0x7ffc828cc1a0
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,3485303782900760571,16543285009580280459,524288 --field-trial-handle=2296,i,1411287676369149229,12827469669227035058,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,3390703176955470929,16393909788959531070,262144 --field-trial-handle=2296,i,1411287676369149229,12827469669227035058,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,1156524927925273187,11657328102524410959,524288 --field-trial-handle=2296,i,1411287676369149229,12827469669227035058,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3112,i,7023852527333944565,17087152366010217743,2097152 --field-trial-handle=2296,i,1411287676369149229,12827469669227035058,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:2
    3⤵
    PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultcfdad682h845eh4184h8ac6h4e50c0ea6146
1⤵
- Enumerates system info in registry
PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x2c8,0x7ffc828cc188,0x7ffc828cc194,0x7ffc828cc1a0
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,3505366576949461244,16860465330059366543,262144 --field-trial-handle=2480,i,10799925926271416841,9347826528669041860,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,11422820146758212512,689971538961963786,524288 --field-trial-handle=2480,i,10799925926271416841,9347826528669041860,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,8564507466732845620,13618011999597941764,524288 --field-trial-handle=2480,i,10799925926271416841,9347826528669041860,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5708

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\test.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6104

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc9223c728,0x7ffc9223c734,0x7ffc9223c740
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1788,i,1555140346115170241,440454394826133607,262144 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2184,i,4219896955720079905,15808899951340734745,524288 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1924 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,16535753029875297868,6452614450652877161,524288 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,8525707965150757915,11300384030452354044,2097152 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,16799742127346770330,5595739833385590994,2097152 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3952,i,5544129449597633150,5224333390681105092,2097152 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4500 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,10335849890445741786,6977114081544387283,2097152 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,3175875014083593118,11368536274116576348,524288 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5996,i,9907870401897236590,8828848302899490711,2097152 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3180,i,4778747557467308429,3257046674464026282,524288 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3476,i,12438490683210012465,15470587284456534421,524288 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4648,i,18380600789460444116,11071519210668197675,524288 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3408,i,11988241991930618925,822419208759984738,2097152 --field-trial-handle=2060,i,6558612917731023120,10424883951579199730,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GenuineTicket

Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket
Size 1KB
SHA256 5cf3ae9ca793d9a8517d05864eacca525ae8b4db3d13943edcc4bf3f2131dab4
MD5 5e22ef25ec6bdbe63cedfbdf75011316
SHA1 d828c721daf6c630960838dd3a9391d2ec62e88f
SHA512 8599d461fbe166906bc42d2ac6235d32a0f32ea247dbf1bad76ca72233df7b5907c7ebb57b943a3e51d0dae8825baca396f2dd79a34b00197f9dcaa8d6a37714
TLSH
T1381123B4D5356C10221C67F086713BD3BB1C314BC6935D29FB41579835AA2823B57029
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 23ae5ee27137deefb856e64c55b9bd971484ad0222c3fe750a62ca9c92e94838
MD5 f7a4fc3e57cf950e8fc0be99c8e72b91
SHA1 a6647df67488234c23a83cd4441bdfa139f65928
SHA512 0f1fe5634d050541db0e62dda8bca2a144277837c43d82016ebeae088368a36e1990ac8871cdf505c034629dacb0226f32c67d1afb0bf92c0888e3b87d33f0cd
TLSH
T1CAF02DB9CD31BC3718FD1B6960A40B4AE75113672752884B7B3D820D4FB453B865685C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0af7f2a641abbaf6ce9d1cbe9d1feaf7feddec2db92335185811bdbb967608e0
MD5 bb76c00b435fa6f54fdc323e1c418b86
SHA1 c66f6d9231758eb89db8934167f1f2bc6da9093c
SHA512 d0da899fca467c889181bc6048d101853f4d7aeffc84f3bc06656739d7bb5b138ed6e7f4b74ccdee83d37fac967dd5e1e3b84fe68ff45209a847b28cc96f305d
TLSH
T1C211101C26D19C90FFE30AF85DF6FA6C274A14A84E47031E8C7454553E42B70FA35488
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 126a1e7f9ed44dd52dfe61c387d63b624f293936bfa6b7c9a9e3fa83b5ca5489
MD5 7e5a36d237148303082cfc91e4bbd674
SHA1 5967867eb40a05ffd9a4bad59e036207830e34ce
SHA512 7df254645f9fcf747154645c0131f9cb3fd2c19f7f3af71de97eca8d1d42b81c51dee07aa06023db7f3e18d05643906834668f2ef456026ecdedcfed8c74b670
SSDEEP 192:D9H22il4bYJ2J/2SgHJiHKEbD7TaP9vd5fPMNPkrOR:D9H22il4bYJ2J/2SgHJiHKEbD7Ta115U
TLSH
T14EE1CDF7C7D8C62DD91156F49725BF1FCE2A0A28421C3C66C8D8AE4B93E2872D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f9bf9c74ac27bbcd7844a9e3b2f0a5b549f4b9fb63497055763a8f907ec05ed6
MD5 147486f708f660565cfc64ca5facd86a
SHA1 5f72710ed170f668f0a119b500103b1224862b3a
SHA512 c9657c6c59b666c4daaea547e94e9f4cf60395fd6fe5e4a0d47ce8fae75471e5cf080d5e6d42360d8153c400eabe7f168a631ee99567aa7c758d8ce6a23fc492
SSDEEP 192:WRwcBz3FL+7kYov7VJpAPRp2iWR9fHsb+WNnEz4fU2cnvDkw00NVyIsnAUgraJ:WRwmz1q0vUXihwEL2c7UCe
TLSH
T1AD52B42EF910757B9DD6D32AF9217B62E7F5202221842E88E6F8C93C11E76CD6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 905f4a7f725cfbbfec6e1989d5a7efd7dcc02952066625f42b482797921ce6a1
MD5 2b4f8d6a6e548e139dd7afff7c32a00f
SHA1 7365b5240701acf2fbf59713fbfdde5b41a266ef
SHA512 baa11f063cb9c948488320408c28a4845dd0a6654c64e26a8729281e6db22b1c4d579b1f1e12083be6296a9fa6d5ff36e05ff4efe3892df8a6072acc7b35ca98
SSDEEP 192:WRY3FL+7kYov7VJpAPRp2B9fHsb+WNnEz0c/vDkw00sVyIsnAUgtaJ:WRY1q0vUXGhwE0cjUV8
TLSH
T16A42A32EFE10753B9DDAD32AF9627A53D7F6202221802E84EAF8C93C15D76CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a9ffaabc725c2006cda600f0b426498b577577b987adebeae2fa19bb8b8f70e3
MD5 f9580f297e9e2ea86027ae1c06b156fa
SHA1 ae50cc2da9da9fd0f6025a7f3d8b1ad010735f61
SHA512 b3f77f783eca00a0bde55a237dc8365a04415b258f6ec08dae9f9ebe72ec7f9f8fe84cd8c1d87d4c9bfb1c58e6e656eae2c606046605c135e972dc6e6e1a9dca
TLSH
T102B01254C4815711C00203F4155034887164DF11FB05170251F00D469C35260D21B098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c0e9e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c0e9e.TMP
Size 96B
SHA256 c2ecb5a65a64a84401e13e614554bb083d2fc695447920d73c1e7aceb75f6461
MD5 112f625a0668beedfe295de89fd329d4
SHA1 53c6ac8a7cdc4ddab43ad45554b765234a3223fa
SHA512 35420207105a640f4a9cbae297658e09de4f611a1de7e311513eae4cf30a41f57d9042c25a3d1300817d5b4fbd719a78d22d2d9f88978f3b6f645ab70148a078
TLSH
T135B00255C102E252C0420BB06DA595E971A0EF25C6071356D3E01E67EC69770C526561
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 2371741f6eb7a23c425e123aa876b86b7b28f8bd0bf4f55b0ba64fc8a8ba0274
MD5 8ea185b022079e88eac7b9ccab652ee8
SHA1 1293a0871ef403bef832b10b7183846420c56525
SHA512 b20766be2b3151a64c0601fbe02b52467f8c9742f1a7d627682b4f7f17de97626ee7393e88f4f49d845a3f227c81a8ff47c2f5ffda0830b7bdb81bcecfc3b6fa
TLSH
T1CFB012510061B943C4060BF4E1D3044037A25A180352040113D00890B8001515541640
MD5 SHA1 SHA512 TLSH

Submit Download

a0aeaed4-87cf-4783-a787-a1ad54ea15a0.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a0aeaed4-87cf-4783-a787-a1ad54ea15a0.tmp
Size 17KB
SHA256 1f54a63591e6dde1b69486f2c8df6aaa98f633d0dd8c27d42b25af96f2f70962
MD5 5cab65b9e642c268f5e70f2293b70c27
SHA1 9b7f8ea2e54c186b6be63179827f24fefd5b4203
SHA512 aaedba4547233d39a1d47ce7a59630f5cd2b806b21bbc46f0287631c30dbc811e831b70b7718e86c903808f8295a1c84b1c15b731955021a00b7e0db90e5171f
SSDEEP 384:JvjFE7KxkXqKf/pUZNCgVLH2HfgslsS7pLuLceSbWXODFs+ErU3kTHGDrUWmrgas:JbFE7KxkXqKf/pUZNCgVLH2HfgsKS7p9
TLSH
T1D8721967AC4C9E3B4F94C6CCD8167B4FADB5024B65DE886483FA982503D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 6ea6f2a388c32eb1cd9c9634aba18ad6c94c070cab3ad3f05d897003c6256d18
MD5 bd41f5a270db8b899dd8391fcab01365
SHA1 05cac31d60cf6b84b0764215dc254fc6243bbbdc
SHA512 0de117893033a46fd22e8bca9296abec4bd8fd17f12dcf58da40d4f5aec72b1b8f56830409d9eaefb8c75bf74109dd3e19e979e41bceb12591ce2aed5468b113
SSDEEP 3072:wJY+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+g3:wy+hFD+7t56OD9ZfSAppr3
TLSH
T154D31232AA94C8BBC9BD6541F157A300CE626CED45DE7A09444A9F8EE09FD5C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 ffd1d0b224fb860b75090e181b3cecb9a5372d832d04d7c55d142eb325e5d711
MD5 d46639d77f386a035a0eca9c6a1ac03b
SHA1 96ba49dd90561f96e3f534a22ae6c8238fab56cc
SHA512 60cc6793917a60a32e7eaadff38f5da0940ee42ed7c761cd9c3f790a12d448fe917e37efd20b0db1f63681d89aead29bed980faf31c1cc4280282a3112017b07
SSDEEP 6144:866vriLVZv+yA3yglHaQevFM2+hFD+7t56OD9ZfSApprN:AMZWyex9avXyFSXD9ZfS4/
TLSH
T1E54422636D65EEF749FD9287E043AE40CDB12CDD84DF69C9408AAB82909B98C4773D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 9401fa651425054063efcc3b88522969e3594a73a19efacf3afd5c77836db6a7
MD5 8e0f0e9cc023c7d2db4635829325eb20
SHA1 dba529b5bacc5c306af9de4fbb25d440d33b1487
SHA512 675f409255f12c08f3d687e4dd82727aea3afc875a50891ffa88163c42e08a08b6bc057ab09dc1ce8b797a4bda09573f658743f953569b197783de6da02f2175
SSDEEP 6144:v66vriLVZv+yA3yglHaQevFM2+hFD+7t56OD9ZfSApprN:PMZWyex9avXyFSXD9ZfS4/
TLSH
T16E4422636D65EEF749FD9287E043AE40CDB12CDD84DF69C9408AAB82909B98C4773D31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 f7cc602519ec44dbf61ffa837d4215f6ea4163c81e5928b2bd5942c834a9bc73
MD5 1f5d7f47c0cee28c48e3686d24d94f31
SHA1 c1fc41c4c842d83397357cce8c8a31f7ac226759
SHA512 86eed57fbc4b7903dd2f6e9522725eb7ad4b36edef1605968550303271d7f97f461e00c8a68d82edc882028ce79cbdb8432006b213b154a1aa45bb03590568f3
SSDEEP 6144:vWn16vriLVZv+yA3yglHaQevFM2+hFD+7t56OD9ZfSApprN:UUMZWyex9avXyFSXD9ZfS4/
TLSH
T14A4412736D55EDF78DFD9686A003BA10CDB17DDE88DE69CC408A6B82909F94C4B72D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

77fee28b-2aaf-46f7-846a-280b5f4c1db2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77fee28b-2aaf-46f7-846a-280b5f4c1db2.tmp
Size 9KB
SHA256 c4d8c7659448baade6552e072a1cb8c42ff4af7a965a42ab5a98ae1679e252e0
MD5 fcb4809a2390db9ad17bca494e90159a
SHA1 aabc4066ddb31b16c34bd51f72e428aef2ffd6ab
SHA512 8577a0bca4e9bc000ac78b78483cbadfa6046de7247f83d90972536841bb20db9ebafdd28aefc6911f9e20f1d2d9fbe28ac844bb7603014f9b7e48a4d2b8f2f4
SSDEEP 192:zDsNnC6Amwpu9QmiUyX8r9iX5FrY+s9ssFi+2ClIeq/+pUO:zDsNnC6ipu7hr9iX5Fs+s9soi+29cUO
TLSH
T118122C35B82C9C3B88D3A554F08736639FA82177DE896F99D5D81B1C01D768C2B0F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ad1fc8744deb3fca0a8f5ad3baf24219ee6f68169b973ddb60dcd26730179dab
MD5 aff493919f3af9f4827534894d4626b1
SHA1 b2d96ce3619e985c4ba868e88b7b667fda996471
SHA512 097db9300d574874a393af0a787513b2ef123272765ea031af25004a0b4ba984364c89498fd49887969a221e53d13393ee08daf95a0c20ae54f438fd76633f9a
TLSH
T16A612A81D3F070A0EB9870B065D91E9736F885B6A3835E6611ADD6F4AB473C0338D1D3
MD5 SHA1 SHA512 TLSH

Submit Download

82323657-9530-4dc0-ad53-4605f3be2bcd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\82323657-9530-4dc0-ad53-4605f3be2bcd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG
Size 303B
SHA256 9e562f905ae184ffebe2151fdce08801474ef7b93dfe8b8f155015f83cacb351
MD5 9eeeb6b550996d5454907930c7bc004b
SHA1 d9d39d28120b11d49251379e3578cc930a9cf356
SHA512 76e39af2a8175819efc424ee4dafee52273669df8a87784051b36a7a8344124072c96fcfb5bf8787e4fbc59745f39b8ff138f9b65c5bbbe96696b9441758cb3d
TLSH
T179E07DAAD5C3C12E2B2478C31224670886987473DB916E0F0B90CCC03A4F049F18A197
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

EdgeHubAppUsageSQLite.db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db
Size 32KB
SHA256 ee1669f1eeb64eba1a99c1ed54b017258b894f474ddab909ba346ccde84aead0
MD5 5711a195d782d583a01bfa7a1d42c900
SHA1 4ec2f0195477178236d965a4ea6e6046a7055b2e
SHA512 938a119856f8feec0067c43122abd13bfcdbf8181ff39089e4e782bb636e750024f94450d2b6f855c7e385e2b6f26191241a273d2d2591d282468266ce1f1660
SSDEEP 24:TLinga0Zb7OaIbz+UOxUDDNzWjJ0npnyX7y+j25cK5f:TCi+7f+UZD4jJ/BKcC
TLSH
T1C7E2C04D3E11F511C8EC733CB0D2C9E0AEBC647C878EB57142386CA68D52A92F49E55E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 e61fa100074b410f2d545a6a02db97521540372433255e9fda46bdf8f8a610c9
MD5 10a8790ebbeaddb95bfce8d16be62576
SHA1 18d01c6f53611331359859182a50b78381a848cb
SHA512 9285154f4c848071579794d8d96aa9415844c54f7ba7ae61062754ca14c425c884edf0af26232e9dcebc95e5b2049f7ba9096b5da3f57289ee0e6c4169f12218
TLSH
T12CE086E465CAC52DB31C68D3836D730887E97877E784390A27C9DC906606685A2DF291
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 31549212bcc8321379d3c43890393ddac3601643f507586dc0113c79be3bac4a
MD5 a460361e1996b613e3a61414840f2e64
SHA1 56047bcda0c00d39e878f3a534e29e741326725a
SHA512 1586e11a08b809bd25b78808de15936f8deab96a7e8a1cadb0e2606c6db114b44960688b34a6e58b6fb8e1a2a08bbf9ace677ad51c9b5e9d107f68dae1021ba3
TLSH
T1E3E0D8B549CFC11D630960C70329770CC7B47C3BD7882A091B58D980B406044A7C95E6
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a5e765cb16197dc1b2c51a205c115c1dac962b6821802c479881e3c617793a2b
MD5 8dceab85ea636637024fada3be262b2e
SHA1 d2685679ecb516efb95b7c901e3f9d33b8f5d2a0
SHA512 8e8d9ec20e7dc8c7afab9daeccce3fac2c86e7f677ed04ae2cdd518b9cc64e346775761889281995ad0337e4223efa1c9de58436d0e1d25ef3337daee1f4d057
SSDEEP 96:sa2jfiEDWT6kscRb9YQvdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjTo67/ZwUhgF:sxruZsNQ1rpMHW6+WNGYcZxhgF
TLSH
T19CF1E9527E28797B4CC7E15DBA267B13E2F5502165C5094CEAFC8AAC049B7CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 168fac9f55f09fc80539a3a62a8b218cc5c942a1ab94f4a4d4d10bc3362368a1
MD5 4cdbf0774da8b59dac17154c27410b3a
SHA1 da3a3f64836a8380800484db95c5241a42ed4dbf
SHA512 f50aad07eacb80b37ede4081c5fa8435b04f0a8103f4dd7f37d86d6ac383bae4d98c3eb237b59bb97c8c6c37054d89eddeea8c99dfacd6fda5d2c405c3c94e74
SSDEEP 96:sa2jfiEDWT6kscRbDYQvdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjTo67/kwUhgF:sxruZsnQ1rpMHW6+WNGYckxhgF
TLSH
T108F1D8527E28757B4CC7E15DFA267B53E2F9502265C5094CAAFC8AAC04976CD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 2519f40c0cac993b2dfae7f4f9efef90df63faf4d94bfbb687ec6df04e6fb2c2
MD5 46328b7c26e087212c5a215d9fcdefe4
SHA1 31b0baf57174b436833de88ef75d4b7cf8f2de6b
SHA512 b69eb813b6e43a7a420bccb319ca58ff4b869c565571239232604e06f456a05163adcec3f3bfc8fb7987b4af1e46e294c6f5d86542abd9b497e4d05321165bc1
SSDEEP 768:2m30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ7uXrolZM6:2m30AbSWvS2l9u1jaLmLZ1uEd
TLSH
T195C2DA3B640CCA7E4FC05A9DDC6AAF9B6F9C02C796548D4047FA984C02C77EA911B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 335B
SHA256 16365b0a85d72ad17fe6d32849a801f616aa17cc393cc12adbb7401f19c890e9
MD5 3f980442be04ea94dabbdb6c92e36c09
SHA1 10103d2de5608ed108c0b5a9b5dbc079abe3da35
SHA512 dcfefdb668a4d8e4ebd1df3541fc88900df7fc174d51bc051bbe8544e03b7f5dd47472bb7a4845a6044e531880f3745a08e41851e6535d29339a95b0e2ba3362
TLSH
T1CFE04FA00BCAC53E711A20870265A71C97A87877DBC4790A2F98CE80A587545F1DF192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 ae0178a35dd250d499c53d4cb1a3acf90736ccbd3e6ee9a71621f4ec78cb1fa5
MD5 995e53e143b345d4d842860c24aa827f
SHA1 e6598c2a5049fe17116453d1ec43600b7230a22e
SHA512 074c4266b0e88b26cd4b4802fb5334e6f89fcd3c9900b7b24827a3b1e6c3293fc09b2ac931c420a55b1fbf3503f87eab388a1f4f762b602444c4d0ebeca2aaf4
TLSH
T15FE0D8B11BCAC62F724E24CB1315E708C2BBBC33D7C42919AB4CD588B64B280F28B151
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 79b9b0e52ff48367a22beaffcde6586b85861b88ff493115c81376b4dd57eb00
MD5 adc12686ecb3aad00c2e26ae6da45ece
SHA1 8bbde23860d8ed2ca017249d3c1a260025b4f76e
SHA512 c7b8ae5a77e61cc851c623214eeb179b6209d017f595e45b4ed0e0bd2ea487a89472d19a6790622ff45dbcf08d3853147a6da7c4ba1ab51485e1866e182716f1
TLSH
T18DE04FF08BCAC63E620860C20369A70987B9BC3797843A4AA74CD494A647184F6AE591
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c83899851f8d5eee52dbade0286195aa28c5348a0920c15e5d411ac5b5b202fa
MD5 e1992c314d285d8748fa3d155513ffe8
SHA1 513f3f5a4b754fdd96b3b0b30964bdc751b94e1a
SHA512 fb04a274abc1f8330822a5c6492a4eafdaa13a301baaecbe5986492d9471a6f6dbb1bca32a4bfb7e81a89792237820734a33e0e4c13ad14807dee019668302a3
SSDEEP 192:zDsNnC6Amwpu9QmiUyU8r9iX5FrY+s9ssFi+2ClIeq/+pUO:zDsNnC6ipu7ir9iX5Fs+s9soi+29cUO
TLSH
T115122C35B86C9C3B88D7A554F08736639FA82177DE896F99D5D81B1C01D768C2B0F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 943df0c6a373e068abd2a534fe922f76c6e65396790e7cc57e8223ff97c6d657
MD5 cac8aaf1ddc4119c172fad36c0a28e02
SHA1 b641865becc29a95fe75d764dbe9133f9ef8460f
SHA512 7a91caf9d8bee6955da8da99391ff32d343604d99e715683a460a8ddda2ec72ab220a7f52245147717a563c4b793b5aec16240a9de51bb7ed8cb68df9d27ed9a
SSDEEP 192:LONs6AmwprQmiUyFH6siX5FrY+s5JiF5U6:LONs6ipde6siX5Fs+s+nU6
TLSH
T19602FA35EC786C7B8EF3AE55B54B76239FA9117BDA941F44C9E81B2C01D764C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35b75e5186b16c8f768182ab63aa47cb2d4071b1ba38373f0371ace5513d6f42
MD5 9214277aa8c3eeeb20d9b2bb857f303f
SHA1 44a4909fe454d490a776a863b4055b971eb6efcd
SHA512 dc8fd65d5badccad8b6235d1bf7b70f9a24f6b4849db836b32c2d70a19ea6c14f745053793338719b608903430d3c8ea661be8bcef4a8c28c004d47b35593563
SSDEEP 192:LONh6AmwpuQmiUy/HrsiX5FrY+s9ssFi+2ClRdq/+pU6:LONh6ipqCrsiX5Fs+s9soi+2AJU6
TLSH
T11B122B75B82DAC374DD2A650F08736639FA82177DE895F99D5E80B1C06D764C2B0F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 90587ad18271d8272eb31639be4b1066d740f1170d1dcffff0a93c74adac58a3
MD5 c4b9fbef6db47a2d9dcfff05b1c6991a
SHA1 4ab3ab33372d3c8f8994bf86b7da47861d66d736
SHA512 ca8036446f2f7e054459b34c6a385486967ae6fa4d17d04de9867b982dcb4dbad28225d601b3f8e57e30de5bf6a7a512b8bc0e1e477bee89dffeb5970d6447fc
SSDEEP 192:zDsNY6Amwpu9QmiUyTE8r9iX5FrY+s9ssFi+2Co5hBqQtUO:zDsNY6ipu7Y3r9iX5Fs+s9soi+2fhzUO
TLSH
T1CC121B35A92C6C7BC9E3AE55F0477A139FA8116BDA991F94DDE81B2C01C768C134A833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 5cd2c4d9f13524923046198c92213691539407e04fa520cdae9eade1bad3d91d
MD5 e9e365607374115b92e4abe4b9628101
SHA1 d5054ea9b22317dca83801eb3586017bfcc0e2a8
SHA512 a84d65ed53e43883e5ecb7848fbd48f5305a63e6975e6af480cf85532879720061106be54f2a5888ebc3569f7123081a0e6eb48ccb8d7dba3e1da1c8a3c50401
TLSH
T151A012078473800AE4144051C49C024114A4804A0219D0015060932314A40CA03A5435
MD5 SHA1 SHA512 TLSH

Submit Download