danabot | 4165a8ea1f11af46b2ac475c41bce70b498007c31e366707c81c8890afdd77e4

Analysis

max time kernel
325s
max time network
478s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wallpaper (1).jpg
Size

28KB
MD5

bdd8868b21390b0f69a5a0dc956a492e
SHA1

c1aab129d3c0f73a143fbbce40de80b12cc4a003
SHA256

4165a8ea1f11af46b2ac475c41bce70b498007c31e366707c81c8890afdd77e4
SHA512

865347cc8637c1282aa737c1012ee05ddd2e50b255b75191f0179f7b28ee04e2fe00320b51f8cb5a9e3de640528531726a296f0b30b16b828451e7d42864362e
SSDEEP

384:glIaWtdyGKa+GorT05y/KVNC1+YwcPPmAJyyZsw4575Dwf9fsdYHl5Bp1GlT7EHj:kInd52yCPPPm97mFkmLp1m7ED

Score

10^/10

danabot revengerat banker botnet evasion macro macro_on_action persistence rezer0 stealer trojan upx

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
botnet

Processes:

resource yara_rule

C:\Users\Admin\DOWNLO~1\DanaBot.dll family_danabot

resource	yara_rule
C:\Users\Admin\DOWNLO~1\DanaBot.dll	family_danabot

Modifies WinLogon for persistence 2 TTPs 25 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

winupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3512 3364 rundll32.exe
RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
rezer0

Processes:

resource yara_rule

behavioral1/memory/8664-18342-0x0000000004650000-0x0000000004678000-memory.dmp rezer0
RevengeRat Executable 1 IoCs
stealer

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467 revengerat
Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

529 3644 rundll32.exe
532 3644 rundll32.exe
551 3644 rundll32.exe
552 3644 rundll32.exe
568 1716 rundll32.exe
569 1716 rundll32.exe
Downloads MZ/PE file
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
macro macro_on_action

Processes:

resource yara_rule

C:\Users\Admin\Downloads\iTYnKgiK.doc.part office_macro_on_action

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	3364	rundll32.exe

resource	yara_rule
behavioral1/memory/8664-18342-0x0000000004650000-0x0000000004678000-memory.dmp	rezer0

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467	revengerat

flow	pid	process
529	3644	rundll32.exe
532	3644	rundll32.exe
551	3644	rundll32.exe
552	3644	rundll32.exe
568	1716	rundll32.exe
569	1716	rundll32.exe

resource	yara_rule
C:\Users\Admin\Downloads\iTYnKgiK.doc.part	office_macro_on_action

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
6260
16448
18160
17780
5672	attrib.exe
6732	attrib.exe
8140
12744
14112
13884
12228
15468
11316
13596
14496
6524	attrib.exe
10772
12300
18084
19320
18976
11576
12868
15660
7968	attrib.exe
7488	attrib.exe
11412
13300
13380
5788	attrib.exe
6716	attrib.exe
7956	attrib.exe
15620
3424	attrib.exe
15764
12332
17468
7292	attrib.exe
12768
12864
16200
18448
6660	attrib.exe
6032	attrib.exe
12100
4268	attrib.exe
11708
12404
14308
19428
3456	attrib.exe
4552	attrib.exe
3288	attrib.exe
5700	attrib.exe
12016
2304	attrib.exe
5644	attrib.exe
16836
15528
5544	attrib.exe
14836
16188
6060	attrib.exe
14136

Executes dropped EXE 27 IoCs

Processes:

DanaBot.exeDanaBot.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

pid	process
2476	DanaBot.exe
2504	DanaBot.exe
3920	Blackkomet.exe
3640	winupdate.exe
3472	winupdate.exe
2628	winupdate.exe
1128	winupdate.exe
3168	winupdate.exe
1472	winupdate.exe
3300	winupdate.exe
3660	winupdate.exe
2100	winupdate.exe
3140	winupdate.exe
3512	winupdate.exe
664	winupdate.exe
2304	winupdate.exe
2512	winupdate.exe
1256	winupdate.exe
3048	winupdate.exe
1844	winupdate.exe
3292	winupdate.exe
1468	winupdate.exe
3656	winupdate.exe
2692	winupdate.exe
3392	winupdate.exe
1580	winupdate.exe
864	winupdate.exe

Loads dropped DLL 64 IoCs

Processes:

rundll32.exerundll32.exeregsvr32.exerundll32.exeBlackkomet.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exe

pid	process
3524	rundll32.exe
3644	rundll32.exe
2772	regsvr32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
1716	rundll32.exe
3920	Blackkomet.exe
3640	winupdate.exe
3640	winupdate.exe
3640	winupdate.exe
3640	winupdate.exe
3472	winupdate.exe
3472	winupdate.exe
3472	winupdate.exe
3472	winupdate.exe
2628	winupdate.exe
2628	winupdate.exe
2628	winupdate.exe
2628	winupdate.exe
1128	winupdate.exe
1128	winupdate.exe
1128	winupdate.exe
1128	winupdate.exe
3168	winupdate.exe
3168	winupdate.exe
3168	winupdate.exe
3168	winupdate.exe
1472	winupdate.exe
1472	winupdate.exe
1472	winupdate.exe
1472	winupdate.exe
3300	winupdate.exe
3300	winupdate.exe
3300	winupdate.exe
3300	winupdate.exe
3660	winupdate.exe
3660	winupdate.exe
3660	winupdate.exe
3660	winupdate.exe
2100	winupdate.exe
2100	winupdate.exe
2100	winupdate.exe
2100	winupdate.exe
3140	winupdate.exe
3140	winupdate.exe
3140	winupdate.exe
3140	winupdate.exe
3512	winupdate.exe
3512	winupdate.exe
3512	winupdate.exe
3512	winupdate.exe
664	winupdate.exe
664	winupdate.exe
664	winupdate.exe
664	winupdate.exe
2304	winupdate.exe
2304	winupdate.exe
2304	winupdate.exe
2304	winupdate.exe
2512	winupdate.exe
2512	winupdate.exe
2512	winupdate.exe
2512	winupdate.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
persistence

Logon Script (Windows)
T1037.001

Processes:

rundll32.exe

description ioc process

Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\mrset.bat" rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\mrset.bat"	rundll32.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\DB.EXE	upx
C:\Users\Admin\AppData\Local\Temp\EN.EXE	upx
behavioral1/memory/18604-43855-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/17448-43853-0x0000000000400000-0x0000000000445000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 50 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

winupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exewinupdate.exenotepad.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exewinupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exewinupdate.exenotepad.exenotepad.exewinupdate.exewinupdate.exewinupdate.exenotepad.exenotepad.exenotepad.exewinupdate.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exewinupdate.exenotepad.exenotepad.exeBlackkomet.exewinupdate.exewinupdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	notepad.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	Blackkomet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe"	winupdate.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

Processes:

flow	ioc
81	camo.githubusercontent.com
110	camo.githubusercontent.com
521	raw.githubusercontent.com
47	raw.githubusercontent.com
61	camo.githubusercontent.com
63	camo.githubusercontent.com
111	camo.githubusercontent.com
112	camo.githubusercontent.com
181	camo.githubusercontent.com
41	camo.githubusercontent.com
194	camo.githubusercontent.com
250	camo.githubusercontent.com
519	raw.githubusercontent.com
126	camo.githubusercontent.com
168	camo.githubusercontent.com
183	camo.githubusercontent.com
193	camo.githubusercontent.com
224	camo.githubusercontent.com
102	camo.githubusercontent.com
515	camo.githubusercontent.com
184	camo.githubusercontent.com
232	camo.githubusercontent.com
213	camo.githubusercontent.com
83	camo.githubusercontent.com
242	camo.githubusercontent.com
245	camo.githubusercontent.com
254	camo.githubusercontent.com
512	camo.githubusercontent.com
71	camo.githubusercontent.com
62	camo.githubusercontent.com
195	camo.githubusercontent.com
39	camo.githubusercontent.com
109	camo.githubusercontent.com
222	camo.githubusercontent.com
518	raw.githubusercontent.com
103	camo.githubusercontent.com
64	camo.githubusercontent.com
212	camo.githubusercontent.com
223	camo.githubusercontent.com
244	camo.githubusercontent.com
137	camo.githubusercontent.com
205	camo.githubusercontent.com
253	camo.githubusercontent.com
93	camo.githubusercontent.com
233	camo.githubusercontent.com
73	camo.githubusercontent.com
579	0.tcp.ngrok.io
513	camo.githubusercontent.com
553	camo.githubusercontent.com
98	camo.githubusercontent.com
169	camo.githubusercontent.com
72	camo.githubusercontent.com
178	raw.githubusercontent.com
51	raw.githubusercontent.com
166	camo.githubusercontent.com
180	camo.githubusercontent.com
204	camo.githubusercontent.com
225	camo.githubusercontent.com
516	camo.githubusercontent.com
38	camo.githubusercontent.com
192	camo.githubusercontent.com
557	camo.githubusercontent.com
42	camo.githubusercontent.com
243	camo.githubusercontent.com

Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum rundll32.exe
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	rundll32.exe

Drops file in System32 directory 64 IoCs

Processes:

winupdate.exeattrib.exenotepad.exeattrib.exeattrib.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeattrib.exeattrib.exenotepad.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exeattrib.exeattrib.exewinupdate.exenotepad.exeattrib.exeBlackkomet.exewinupdate.exenotepad.exenotepad.exewinupdate.exewinupdate.exeattrib.exeattrib.exeattrib.exewinupdate.exewinupdate.exeattrib.exenotepad.exewinupdate.exeattrib.exenotepad.exeattrib.exeattrib.exeattrib.exenotepad.exenotepad.exeattrib.exewinupdate.exenotepad.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exenotepad.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	Blackkomet.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe\:Zone.Identifier:$DATA	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\	Blackkomet.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	attrib.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt\winupdate.exe	winupdate.exe
File opened for modification	C:\Windows\SysWOW64\Windupdt	attrib.exe
File created	C:\Windows\SysWOW64\Windupdt\winupdate.exe	notepad.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

pid pid_target process target process

16528 18252
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

pid	pid_target	process	target process
16528	18252

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

pid process

8732
10956
8268
14656

pid	process
8732
10956
8268
14656

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEfirefox.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE

NTFS ADS 5 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Blackkomet.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\APT28DecoyDocument.doc:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\APT28Hospital.doc:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\DanaBot.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Adwind.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXEWINWORD.EXE

pid process

2700 WINWORD.EXE
2340 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

chrome.exerundll32.exe

pid process

3040 chrome.exe
3040 chrome.exe
3644 rundll32.exe

pid	process
2700	WINWORD.EXE
2340	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe
Token: SeShutdownPrivilege	3040	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

Processes:

chrome.exefirefox.exeWINWORD.EXE

pid	process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
2340	WINWORD.EXE
2340	WINWORD.EXE

Suspicious use of SendNotifyMessage 35 IoCs

Processes:

chrome.exefirefox.exe

pid	process
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
3040	chrome.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe

Suspicious use of SetWindowsHookEx 42 IoCs

Processes:

firefox.exeWINWORD.EXEWINWORD.EXE

pid	process
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
2700	WINWORD.EXE
2700	WINWORD.EXE
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
2340	WINWORD.EXE
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe
1092	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3040 wrote to memory of 2176	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2176	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2176	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2024	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2096	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2096	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2096	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe
PID 3040 wrote to memory of 2540	3040	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

pid	process
18036
6876
12028
11044
14884
16912
5140	attrib.exe
7064	attrib.exe
7772	attrib.exe
16392
3920	attrib.exe
5544	attrib.exe
13840
19328
11616
12244
4588	attrib.exe
6732	attrib.exe
7292	attrib.exe
11088
3740	attrib.exe
15112
17908
15468
4984	attrib.exe
5820	attrib.exe
9128
14580
14832
3164	attrib.exe
7940
9136
18084
18472
7076	attrib.exe
6456	attrib.exe
7092	attrib.exe
11240
1256	attrib.exe
5936	attrib.exe
12296
16052
13380
15980
5700	attrib.exe
5304	attrib.exe
12444
14256
3288	attrib.exe
16208
17484
11936
15224
16048
17664
12564
13732
14264
15768
4500	attrib.exe
11164
11284
13020
17912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen "C:\Users\Admin\AppData\Local\Temp\wallpaper (1).jpg"
1⤵
PID:2976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6849758,0x7fef6849768,0x7fef6849778
2⤵
PID:2176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:2
2⤵
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:8
2⤵
PID:2096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:8
2⤵
PID:2540

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2252 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:1
2⤵
PID:1632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2260 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:1
2⤵
PID:1136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1176 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:2
2⤵
PID:1216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2180 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:1
2⤵
PID:2088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3388 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:8
2⤵
PID:656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3552 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:8
2⤵
PID:1028

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --reenable-autoupdates --system-level
2⤵
PID:844

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13fa77688,0x13fa77698,0x13fa776a8
3⤵
PID:2400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:8
2⤵
PID:1128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3752 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:1
2⤵
PID:1140

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2416 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:1
2⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3864 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:8
2⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3696 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:8
2⤵
PID:2968

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2060 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:1
2⤵
PID:2556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1148 --field-trial-handle=984,i,13739349233398553242,12540281798718641168,131072 /prefetch:1
2⤵
PID:1896

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:2036

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.0.1535816741\710210054" -parentBuildID 20221007134813 -prefsHandle 1244 -prefMapHandle 1236 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9787add9-6a42-4b20-8103-3abe27176068} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 1308 41de858 gpu
3⤵
PID:288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.1.540054502\530245343" -parentBuildID 20221007134813 -prefsHandle 1484 -prefMapHandle 1480 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5335d5c7-614a-4e37-bb7e-d703a7841465} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 1496 e6f858 socket
3⤵
PID:1140

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.2.1494931134\1342444648" -childID 1 -isForBrowser -prefsHandle 2068 -prefMapHandle 2064 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f247f911-f2dc-4f52-8edf-c39ef5518ceb} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 2080 1a19e658 tab
3⤵
PID:2224

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.3.1165145055\1913661677" -childID 2 -isForBrowser -prefsHandle 2692 -prefMapHandle 2688 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1794c953-8f0e-44ac-9f0a-db2cecb6d348} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 2704 e62858 tab
3⤵
PID:2220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.4.1013030263\1490591742" -childID 3 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6082c59-2695-40ee-90a9-a6ceae509f78} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 2940 1bc7e758 tab
3⤵
PID:2852

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.5.1774721412\1728532347" -childID 4 -isForBrowser -prefsHandle 3660 -prefMapHandle 3656 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd166dbb-b313-4491-a6e7-a2320afbe009} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 3676 1e0a3d58 tab
3⤵
PID:2072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.6.1557458526\844587698" -childID 5 -isForBrowser -prefsHandle 3784 -prefMapHandle 3788 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f3d7b90-f552-4772-8a28-133fdb22b6c9} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 3772 1e1f2758 tab
3⤵
PID:2720

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.7.429086274\1518240626" -childID 6 -isForBrowser -prefsHandle 3960 -prefMapHandle 3964 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fca621d-f1a2-4197-9656-d8c4666dc559} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 3948 1e1f3c58 tab
3⤵
PID:2924

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.8.874360222\322876210" -childID 7 -isForBrowser -prefsHandle 4232 -prefMapHandle 4228 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f28ea91e-4b4f-4c00-9620-79f19f93c67f} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 4212 b8d4f58 tab
3⤵
PID:2732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.9.1119875016\1937191807" -childID 8 -isForBrowser -prefsHandle 3752 -prefMapHandle 3748 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a2276a1-1013-49f7-a1e7-eedd5364b58f} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 3736 b818a58 tab
3⤵
PID:1716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.10.1430391003\1247145727" -childID 9 -isForBrowser -prefsHandle 3672 -prefMapHandle 1628 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1020d4cf-4799-4cf4-ad47-7363c625ca82} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 3212 1e153258 tab
3⤵
PID:1228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.11.1887166555\290771940" -childID 10 -isForBrowser -prefsHandle 4260 -prefMapHandle 3756 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e9dd50a-a174-4cd3-9a94-29358cb5821b} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 4340 e2f658 tab
3⤵
PID:1648

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.12.977738110\879103869" -childID 11 -isForBrowser -prefsHandle 4360 -prefMapHandle 980 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45092adb-5ad9-4ba1-b322-c9607bb94f9e} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 4320 1f03de58 tab
3⤵
PID:3372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.13.2104168839\66673482" -childID 12 -isForBrowser -prefsHandle 2632 -prefMapHandle 4532 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4259106e-9fc0-4321-a0a3-90697ed65d07} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 4020 b826b58 tab
3⤵
PID:3748

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.14.2010861148\521964382" -childID 13 -isForBrowser -prefsHandle 3040 -prefMapHandle 2992 -prefsLen 26796 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2830f83c-97c4-4377-8fed-bb3c6d3c672d} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 2980 23efc958 tab
3⤵
PID:1340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.15.44246186\1993278935" -childID 14 -isForBrowser -prefsHandle 3132 -prefMapHandle 4016 -prefsLen 26845 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {058fcab8-5a9a-4945-bc8d-bddc8e986e5a} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 3856 1bc3a358 tab
3⤵
PID:3136

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1092.16.457612996\1589996146" -childID 15 -isForBrowser -prefsHandle 4888 -prefMapHandle 4896 -prefsLen 26845 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7f98481-e1b3-4f7e-a4a6-1e7507d20762} 1092 "\\.\pipe\gecko-crash-server-pipe.1092" 4876 b898b58 tab
3⤵
PID:3128

C:\Users\Admin\Downloads\DanaBot.exe
"C:\Users\Admin\Downloads\DanaBot.exe"
3⤵
- Executes dropped EXE
PID:2476

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\DanaBot.exe@2476
4⤵
- Loads dropped DLL
PID:2772

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\DanaBot.dll,f0
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1716

C:\Users\Admin\Downloads\DanaBot.exe
"C:\Users\Admin\Downloads\DanaBot.exe"
3⤵
- Executes dropped EXE
PID:2504

C:\Users\Admin\Downloads\Blackkomet.exe
"C:\Users\Admin\Downloads\Blackkomet.exe"
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3920

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
- Adds Run key to start application
PID:1236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\Downloads\Blackkomet.exe" +s +h
4⤵
PID:4056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\Downloads" +s +h
4⤵
PID:2728

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3640

C:\Windows\SysWOW64\notepad.exe
notepad
5⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
5⤵
PID:3720

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
5⤵
PID:3560

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3472

C:\Windows\SysWOW64\notepad.exe
notepad
6⤵
- Adds Run key to start application
PID:2500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
6⤵
- Drops file in System32 directory
PID:3852

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
6⤵
- Views/modifies file attributes
PID:3740

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2628

C:\Windows\SysWOW64\notepad.exe
notepad
7⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
7⤵
PID:988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
7⤵
PID:3200

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1128

C:\Windows\SysWOW64\notepad.exe
notepad
8⤵
- Adds Run key to start application
PID:2036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
8⤵
PID:3432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
8⤵
- Drops file in System32 directory
PID:3452

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3168

C:\Windows\SysWOW64\notepad.exe
notepad
9⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3624

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
9⤵
- Drops file in System32 directory
PID:1580

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
9⤵
- Drops file in System32 directory
PID:3104

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1472

C:\Windows\SysWOW64\notepad.exe
notepad
10⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
10⤵
- Drops file in System32 directory
PID:3216

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
10⤵
- Drops file in System32 directory
PID:2636

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3300

C:\Windows\SysWOW64\notepad.exe
notepad
11⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3256

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
11⤵
PID:1932

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
11⤵
PID:3552

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
11⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:3660

C:\Windows\SysWOW64\notepad.exe
notepad
12⤵
- Adds Run key to start application
PID:4076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
12⤵
- Views/modifies file attributes
PID:3288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
12⤵
PID:3052

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2100

C:\Windows\SysWOW64\notepad.exe
notepad
13⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2384

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
13⤵
PID:2012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
13⤵
PID:2244

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
13⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3140

C:\Windows\SysWOW64\notepad.exe
notepad
14⤵
- Adds Run key to start application
PID:3548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
14⤵
- Drops file in System32 directory
PID:632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
14⤵
- Drops file in System32 directory
PID:3104

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
14⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:3512

C:\Windows\SysWOW64\notepad.exe
notepad
15⤵
- Adds Run key to start application
PID:2168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
15⤵
PID:3292

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
15⤵
PID:3920

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
15⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:664

C:\Windows\SysWOW64\notepad.exe
notepad
16⤵
- Adds Run key to start application
PID:4036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
16⤵
- Drops file in System32 directory
PID:3852

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
16⤵
PID:3876

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
16⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2304

C:\Windows\SysWOW64\notepad.exe
notepad
17⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
17⤵
PID:1464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
17⤵
PID:3428

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
17⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2512

C:\Windows\SysWOW64\notepad.exe
notepad
18⤵
- Adds Run key to start application
PID:2244

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
18⤵
- Drops file in System32 directory
PID:1292

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
18⤵
- Drops file in System32 directory
PID:3588

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
18⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1256

C:\Windows\SysWOW64\notepad.exe
notepad
19⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
19⤵
- Drops file in System32 directory
PID:2416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
19⤵
- Drops file in System32 directory
PID:3208

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
19⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3048

C:\Windows\SysWOW64\notepad.exe
notepad
20⤵
- Adds Run key to start application
PID:3620

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
20⤵
- Drops file in System32 directory
PID:4028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
20⤵
- Drops file in System32 directory
PID:3440

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
20⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1844

C:\Windows\SysWOW64\notepad.exe
notepad
21⤵
- Adds Run key to start application
PID:832

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
21⤵
PID:2024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
21⤵
PID:900

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
21⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:3292

C:\Windows\SysWOW64\notepad.exe
notepad
22⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
22⤵
PID:3860

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
22⤵
PID:3736

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
22⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1468

C:\Windows\SysWOW64\notepad.exe
notepad
23⤵
- Adds Run key to start application
PID:3240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
23⤵
- Drops file in System32 directory
PID:4012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
23⤵
- Drops file in System32 directory
PID:2812

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
23⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:3656

C:\Windows\SysWOW64\notepad.exe
notepad
24⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
24⤵
PID:3504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
24⤵
- Drops file in System32 directory
PID:3084

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
24⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:2692

C:\Windows\SysWOW64\notepad.exe
notepad
25⤵
- Adds Run key to start application
PID:3172

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
25⤵
- Drops file in System32 directory
PID:3540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
25⤵
PID:1228

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
25⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:3392

C:\Windows\SysWOW64\notepad.exe
notepad
26⤵
- Adds Run key to start application
PID:3728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
26⤵
PID:2508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
26⤵
- Drops file in System32 directory
PID:2772

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
26⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
PID:1580

C:\Windows\SysWOW64\notepad.exe
notepad
27⤵
- Adds Run key to start application
PID:3176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
27⤵
- Drops file in System32 directory
PID:2848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
27⤵
- Drops file in System32 directory
PID:756

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
27⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:864

C:\Windows\SysWOW64\notepad.exe
notepad
28⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3220

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
28⤵
PID:1800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
28⤵
- Drops file in System32 directory
PID:3232

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
28⤵
PID:3048

C:\Windows\SysWOW64\notepad.exe
notepad
29⤵
PID:3544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
29⤵
- Sets file to hidden
PID:2304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
29⤵
PID:1752

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
29⤵
PID:2024

C:\Windows\SysWOW64\notepad.exe
notepad
30⤵
PID:3740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
30⤵
PID:2724

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
30⤵
PID:3052

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
30⤵
PID:3108

C:\Windows\SysWOW64\notepad.exe
notepad
31⤵
PID:3360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
31⤵
PID:4040

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
31⤵
PID:3424

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
31⤵
PID:3916

C:\Windows\SysWOW64\notepad.exe
notepad
32⤵
PID:1596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
32⤵
- Sets file to hidden
PID:3456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
32⤵
PID:2552

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
32⤵
PID:3860

C:\Windows\SysWOW64\notepad.exe
notepad
33⤵
PID:3088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
33⤵
- Views/modifies file attributes
PID:3164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
33⤵
PID:2544

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
33⤵
PID:3920

C:\Windows\SysWOW64\notepad.exe
notepad
34⤵
PID:2860

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
34⤵
PID:3140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
34⤵
PID:1580

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
34⤵
PID:3608

C:\Windows\SysWOW64\notepad.exe
notepad
35⤵
PID:372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
35⤵
PID:3100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
35⤵
PID:2648

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
35⤵
PID:3140

C:\Windows\SysWOW64\notepad.exe
notepad
36⤵
PID:876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
36⤵
PID:632

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
36⤵
PID:656

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
36⤵
PID:3216

C:\Windows\SysWOW64\notepad.exe
notepad
37⤵
PID:664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
37⤵
PID:4028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
37⤵
PID:3204

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
37⤵
PID:3288

C:\Windows\SysWOW64\notepad.exe
notepad
38⤵
PID:3468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
38⤵
PID:2676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
38⤵
PID:1028

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
38⤵
PID:3388

C:\Windows\SysWOW64\notepad.exe
notepad
39⤵
PID:3340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
39⤵
- Sets file to hidden
PID:3424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
39⤵
PID:3704

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
39⤵
PID:3348

C:\Windows\SysWOW64\notepad.exe
notepad
40⤵
PID:2648

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
40⤵
PID:3388

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
40⤵
PID:3928

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
40⤵
PID:1316

C:\Windows\SysWOW64\notepad.exe
notepad
41⤵
PID:3608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
41⤵
PID:4116

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
41⤵
PID:4124

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
41⤵
PID:4188

C:\Windows\SysWOW64\notepad.exe
notepad
42⤵
PID:4360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
42⤵
PID:4536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
42⤵
PID:4544

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
42⤵
PID:4604

C:\Windows\SysWOW64\notepad.exe
notepad
43⤵
PID:4756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
43⤵
PID:4932

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
43⤵
PID:4940

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
43⤵
PID:5004

C:\Windows\SysWOW64\notepad.exe
notepad
44⤵
PID:2588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
44⤵
PID:3928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
44⤵
- Views/modifies file attributes
PID:3920

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
44⤵
PID:4104

C:\Windows\SysWOW64\notepad.exe
notepad
45⤵
PID:4288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
45⤵
PID:4460

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
45⤵
PID:4468

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
45⤵
PID:4544

C:\Windows\SysWOW64\notepad.exe
notepad
46⤵
PID:4652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
46⤵
PID:4892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
46⤵
PID:4900

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
46⤵
PID:4956

C:\Windows\SysWOW64\notepad.exe
notepad
47⤵
PID:3216

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
47⤵
PID:4136

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
47⤵
PID:3392

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
47⤵
PID:988

C:\Windows\SysWOW64\notepad.exe
notepad
48⤵
PID:4296

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
48⤵
PID:4496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
48⤵
- Views/modifies file attributes
PID:4500

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
48⤵
PID:4512

C:\Windows\SysWOW64\notepad.exe
notepad
49⤵
PID:4888

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
49⤵
PID:4940

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
49⤵
PID:4900

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
49⤵
PID:4984

C:\Windows\SysWOW64\notepad.exe
notepad
50⤵
PID:3660

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
50⤵
PID:4276

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
50⤵
PID:3104

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
50⤵
PID:4124

C:\Windows\SysWOW64\notepad.exe
notepad
51⤵
PID:4336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
51⤵
PID:4536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
51⤵
- Sets file to hidden
PID:4552

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
51⤵
PID:4640

C:\Windows\SysWOW64\notepad.exe
notepad
52⤵
PID:4700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
52⤵
PID:5024

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
52⤵
PID:3436

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
52⤵
PID:2464

C:\Windows\SysWOW64\notepad.exe
notepad
53⤵
PID:3588

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
53⤵
PID:4232

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
53⤵
PID:4240

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
53⤵
PID:4160

C:\Windows\SysWOW64\notepad.exe
notepad
54⤵
PID:4496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
54⤵
PID:4672

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
54⤵
PID:4680

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
54⤵
PID:864

C:\Windows\SysWOW64\notepad.exe
notepad
55⤵
PID:4512

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
55⤵
PID:5084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
55⤵
PID:5092

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
55⤵
PID:3928

C:\Windows\SysWOW64\notepad.exe
notepad
56⤵
PID:4212

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
56⤵
PID:4472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
56⤵
PID:4476

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
56⤵
PID:4348

C:\Windows\SysWOW64\notepad.exe
notepad
57⤵
PID:4868

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
57⤵
PID:4964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
57⤵
PID:4968

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
57⤵
PID:4644

C:\Windows\SysWOW64\notepad.exe
notepad
58⤵
PID:2636

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
58⤵
PID:4316

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
58⤵
PID:3248

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
58⤵
PID:4408

C:\Windows\SysWOW64\notepad.exe
notepad
59⤵
PID:4584

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
59⤵
PID:3336

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
59⤵
PID:5024

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
59⤵
PID:4976

C:\Windows\SysWOW64\notepad.exe
notepad
60⤵
PID:2348

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
60⤵
- Views/modifies file attributes
PID:4984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
60⤵
PID:4524

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
60⤵
PID:4492

C:\Windows\SysWOW64\notepad.exe
notepad
61⤵
PID:4472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
61⤵
PID:4676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
61⤵
PID:4696

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
61⤵
PID:5028

C:\Windows\SysWOW64\notepad.exe
notepad
62⤵
PID:4840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
62⤵
PID:3104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
62⤵
PID:2416

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
62⤵
PID:4184

C:\Windows\SysWOW64\notepad.exe
notepad
63⤵
PID:4428

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
63⤵
PID:4576

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
63⤵
PID:4820

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
63⤵
PID:4660

C:\Windows\SysWOW64\notepad.exe
notepad
64⤵
PID:3084

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
64⤵
PID:4152

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
64⤵
PID:4116

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
64⤵
PID:5104

C:\Windows\SysWOW64\notepad.exe
notepad
65⤵
PID:4124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
65⤵
PID:4820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
65⤵
PID:4480

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
65⤵
PID:5048

C:\Windows\SysWOW64\notepad.exe
notepad
66⤵
PID:5052

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
66⤵
PID:4936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
66⤵
PID:4388

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
66⤵
PID:2512

C:\Windows\SysWOW64\notepad.exe
notepad
67⤵
PID:3344

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
67⤵
PID:4408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
67⤵
PID:4644

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
67⤵
PID:5080

C:\Windows\SysWOW64\notepad.exe
notepad
68⤵
PID:3920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
68⤵
PID:2544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
68⤵
PID:5108

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
68⤵
PID:4776

C:\Windows\SysWOW64\notepad.exe
notepad
69⤵
PID:4860

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
69⤵
- Sets file to hidden
PID:3288

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
69⤵
PID:5068

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
69⤵
PID:4304

C:\Windows\SysWOW64\notepad.exe
notepad
70⤵
PID:4380

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
70⤵
PID:4804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
70⤵
PID:4576

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
70⤵
PID:3380

C:\Windows\SysWOW64\notepad.exe
notepad
71⤵
PID:5060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
71⤵
PID:4372

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
71⤵
PID:4556

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
71⤵
PID:4188

C:\Windows\SysWOW64\notepad.exe
notepad
72⤵
PID:4804

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
72⤵
PID:2504

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
72⤵
PID:4168

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
72⤵
PID:3100

C:\Windows\SysWOW64\notepad.exe
notepad
73⤵
PID:4284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
73⤵
PID:2772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
73⤵
PID:4156

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
73⤵
PID:4500

C:\Windows\SysWOW64\notepad.exe
notepad
74⤵
PID:4204

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
74⤵
- Views/modifies file attributes
PID:1256

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
74⤵
PID:4728

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
74⤵
PID:4900

C:\Windows\SysWOW64\notepad.exe
notepad
75⤵
PID:4776

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
75⤵
PID:4944

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
75⤵
PID:4640

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
75⤵
PID:2544

C:\Windows\SysWOW64\notepad.exe
notepad
76⤵
PID:1752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
76⤵
PID:4304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
76⤵
PID:4552

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
76⤵
PID:4768

C:\Windows\SysWOW64\notepad.exe
notepad
77⤵
PID:4728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
77⤵
PID:5112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
77⤵
PID:4228

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
77⤵
PID:5068

C:\Windows\SysWOW64\notepad.exe
notepad
78⤵
PID:4280

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
78⤵
PID:3236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
78⤵
PID:4996

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
78⤵
PID:5036

C:\Windows\SysWOW64\notepad.exe
notepad
79⤵
PID:4316

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
79⤵
PID:3436

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
79⤵
PID:3236

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
79⤵
PID:3104

C:\Windows\SysWOW64\notepad.exe
notepad
80⤵
PID:4872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
80⤵
- Sets file to hidden
PID:4268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
80⤵
PID:3436

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
80⤵
PID:3380

C:\Windows\SysWOW64\notepad.exe
notepad
81⤵
PID:2100

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
81⤵
PID:2676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
81⤵
PID:4552

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
81⤵
PID:4944

C:\Windows\SysWOW64\notepad.exe
notepad
82⤵
PID:4188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
82⤵
PID:4464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
82⤵
- Views/modifies file attributes
PID:4588

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
82⤵
PID:5112

C:\Windows\SysWOW64\notepad.exe
notepad
83⤵
PID:4948

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
83⤵
PID:5132

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
83⤵
PID:5140

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
83⤵
PID:5208

C:\Windows\SysWOW64\notepad.exe
notepad
84⤵
PID:5360

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
84⤵
PID:5536

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
84⤵
- Sets file to hidden
PID:5544

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
84⤵
PID:5608

C:\Windows\SysWOW64\notepad.exe
notepad
85⤵
PID:5760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
85⤵
- Views/modifies file attributes
PID:5936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
85⤵
PID:5944

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
85⤵
PID:6004

C:\Windows\SysWOW64\notepad.exe
notepad
86⤵
PID:4812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
86⤵
PID:4404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
86⤵
PID:4980

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
86⤵
PID:4376

C:\Windows\SysWOW64\notepad.exe
notepad
87⤵
PID:5256

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
87⤵
PID:5444

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
87⤵
PID:5452

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
87⤵
PID:5520

C:\Windows\SysWOW64\notepad.exe
notepad
88⤵
PID:5676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
88⤵
PID:5876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
88⤵
PID:5884

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
88⤵
PID:5936

C:\Windows\SysWOW64\notepad.exe
notepad
89⤵
PID:6128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
89⤵
PID:4468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
89⤵
PID:4532

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
89⤵
PID:4588

C:\Windows\SysWOW64\notepad.exe
notepad
90⤵
PID:5264

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
90⤵
PID:5492

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
90⤵
PID:5452

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
90⤵
PID:5476

C:\Windows\SysWOW64\notepad.exe
notepad
91⤵
PID:5692

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
91⤵
PID:5924

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
91⤵
PID:5884

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
91⤵
PID:5992

C:\Windows\SysWOW64\notepad.exe
notepad
92⤵
PID:4500

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
92⤵
PID:4404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
92⤵
PID:4464

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
92⤵
PID:5128

C:\Windows\SysWOW64\notepad.exe
notepad
93⤵
PID:5312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
93⤵
PID:5108

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
93⤵
PID:5460

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
93⤵
PID:5596

C:\Windows\SysWOW64\notepad.exe
notepad
94⤵
PID:5800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
94⤵
PID:5488

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
94⤵
PID:6020

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
94⤵
PID:6080

C:\Windows\SysWOW64\notepad.exe
notepad
95⤵
PID:4552

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
95⤵
PID:5148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
95⤵
PID:5344

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
95⤵
PID:5276

C:\Windows\SysWOW64\notepad.exe
notepad
96⤵
PID:5468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
96⤵
PID:5704

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
96⤵
PID:5712

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
96⤵
PID:5840

C:\Windows\SysWOW64\notepad.exe
notepad
97⤵
PID:5996

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
97⤵
PID:4224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
97⤵
PID:2464

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
97⤵
PID:4852

C:\Windows\SysWOW64\notepad.exe
notepad
98⤵
PID:6120

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
98⤵
PID:4524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
98⤵
PID:6088

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
98⤵
PID:5576

C:\Windows\SysWOW64\notepad.exe
notepad
99⤵
PID:5128

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
99⤵
PID:6048

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
99⤵
PID:6024

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
99⤵
PID:6076

C:\Windows\SysWOW64\notepad.exe
notepad
100⤵
PID:5184

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
100⤵
PID:5508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
100⤵
PID:5396

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
100⤵
PID:5372

C:\Windows\SysWOW64\notepad.exe
notepad
101⤵
PID:5300

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
101⤵
PID:5824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
101⤵
PID:5828

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
101⤵
PID:5888

C:\Windows\SysWOW64\notepad.exe
notepad
102⤵
PID:5968

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
102⤵
PID:4236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
102⤵
PID:4156

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
102⤵
PID:2772

C:\Windows\SysWOW64\notepad.exe
notepad
103⤵
PID:5472

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
103⤵
- Views/modifies file attributes
PID:5700

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
103⤵
PID:5308

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
103⤵
PID:5852

C:\Windows\SysWOW64\notepad.exe
notepad
104⤵
PID:3236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
104⤵
PID:5856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
104⤵
PID:5840

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
104⤵
PID:4768

C:\Windows\SysWOW64\notepad.exe
notepad
105⤵
PID:5404

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
105⤵
- Sets file to hidden
PID:5644

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
105⤵
PID:5636

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
105⤵
PID:5728

C:\Windows\SysWOW64\notepad.exe
notepad
106⤵
PID:5884

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
106⤵
PID:5116

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
106⤵
PID:5960

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
106⤵
PID:6060

C:\Windows\SysWOW64\notepad.exe
notepad
107⤵
PID:5752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
107⤵
PID:5688

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
107⤵
- Sets file to hidden
PID:5672

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
107⤵
PID:5420

C:\Windows\SysWOW64\notepad.exe
notepad
108⤵
PID:5792

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
108⤵
PID:5236

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
108⤵
PID:1028

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
108⤵
PID:5204

C:\Windows\SysWOW64\notepad.exe
notepad
109⤵
PID:5768

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
109⤵
PID:5708

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
109⤵
PID:4556

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
109⤵
PID:5932

C:\Windows\SysWOW64\notepad.exe
notepad
110⤵
PID:4224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
110⤵
PID:5328

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
110⤵
PID:5356

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
110⤵
PID:5888

C:\Windows\SysWOW64\notepad.exe
notepad
111⤵
PID:5492

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
111⤵
PID:5612

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
111⤵
PID:5484

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
111⤵
PID:5936

C:\Windows\SysWOW64\notepad.exe
notepad
112⤵
PID:5852

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
112⤵
PID:5548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
112⤵
PID:5212

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
112⤵
PID:5608

C:\Windows\SysWOW64\notepad.exe
notepad
113⤵
PID:5960

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
113⤵
PID:3052

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
113⤵
PID:5816

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
113⤵
PID:5324

C:\Windows\SysWOW64\notepad.exe
notepad
114⤵
PID:5208

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
114⤵
PID:5140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
114⤵
PID:5936

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
114⤵
PID:5636

C:\Windows\SysWOW64\notepad.exe
notepad
115⤵
PID:4376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
115⤵
PID:6036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
115⤵
- Views/modifies file attributes
PID:5304

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
115⤵
PID:4556

C:\Windows\SysWOW64\notepad.exe
notepad
116⤵
PID:5308

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
116⤵
PID:5340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
116⤵
PID:5924

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
116⤵
PID:5540

C:\Windows\SysWOW64\notepad.exe
notepad
117⤵
PID:5904

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
117⤵
PID:5240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
117⤵
- Sets file to hidden
PID:5788

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
117⤵
PID:5136

C:\Windows\SysWOW64\notepad.exe
notepad
118⤵
PID:5604

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
118⤵
PID:4900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
118⤵
- Views/modifies file attributes
PID:5140

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
118⤵
PID:4168

C:\Windows\SysWOW64\notepad.exe
notepad
119⤵
PID:5036

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
119⤵
PID:5940

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
119⤵
PID:5076

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
119⤵
PID:4328

C:\Windows\SysWOW64\notepad.exe
notepad
120⤵
PID:5408

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
120⤵
PID:5892

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
120⤵
PID:6032

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
120⤵
PID:5024

C:\Windows\SysWOW64\notepad.exe
notepad
121⤵
PID:5788

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
121⤵
PID:6060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
121⤵
PID:5848

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
121⤵
PID:5076

C:\Windows\SysWOW64\notepad.exe
notepad
122⤵
PID:6080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
122⤵
PID:5648

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
122⤵
PID:5464

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
122⤵
PID:5372

C:\Windows\SysWOW64\notepad.exe
notepad
123⤵
PID:3052

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
123⤵
PID:5464

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
123⤵
PID:5820

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
123⤵
PID:5744

C:\Windows\SysWOW64\notepad.exe
notepad
124⤵
PID:2544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
124⤵
PID:5476

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
124⤵
PID:4168

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
124⤵
PID:3924

C:\Windows\SysWOW64\notepad.exe
notepad
125⤵
PID:4468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
125⤵
PID:5744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
125⤵
- Sets file to hidden
PID:6060

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
125⤵
PID:4820

C:\Windows\SysWOW64\notepad.exe
notepad
126⤵
PID:5728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
126⤵
PID:5448

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
126⤵
PID:5720

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
126⤵
PID:4464

C:\Windows\SysWOW64\notepad.exe
notepad
127⤵
PID:5140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
127⤵
PID:4168

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
127⤵
PID:5324

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
127⤵
PID:6064

C:\Windows\SysWOW64\notepad.exe
notepad
128⤵
PID:2676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
128⤵
PID:5840

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
128⤵
PID:4464

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
128⤵
PID:5544

C:\Windows\SysWOW64\notepad.exe
notepad
129⤵
PID:5848

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
129⤵
PID:6244

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
129⤵
PID:6252

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
129⤵
PID:6320

C:\Windows\SysWOW64\notepad.exe
notepad
130⤵
PID:6476

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
130⤵
PID:6652

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
130⤵
- Sets file to hidden
PID:6660

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
130⤵
PID:6736

C:\Windows\SysWOW64\notepad.exe
notepad
131⤵
PID:6900

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
131⤵
- Views/modifies file attributes
PID:7076

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
131⤵
PID:7084

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
131⤵
PID:7152

C:\Windows\SysWOW64\notepad.exe
notepad
132⤵
PID:6200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
132⤵
PID:6268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
132⤵
PID:6256

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
132⤵
PID:5544

C:\Windows\SysWOW64\notepad.exe
notepad
133⤵
PID:6484

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
133⤵
PID:6676

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
133⤵
PID:6700

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
133⤵
PID:6320

C:\Windows\SysWOW64\notepad.exe
notepad
134⤵
PID:6920

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
134⤵
PID:7080

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
134⤵
PID:7076

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
134⤵
PID:5324

C:\Windows\SysWOW64\notepad.exe
notepad
135⤵
PID:6224

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
135⤵
PID:6312

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
135⤵
PID:6284

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
135⤵
PID:6380

C:\Windows\SysWOW64\notepad.exe
notepad
136⤵
PID:6560

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
136⤵
PID:6760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
136⤵
PID:6768

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
136⤵
PID:6840

C:\Windows\SysWOW64\notepad.exe
notepad
137⤵
PID:7012

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
137⤵
- Sets file to hidden
PID:6032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
137⤵
PID:5888

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
137⤵
PID:6260

C:\Windows\SysWOW64\notepad.exe
notepad
138⤵
PID:5520

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
138⤵
- Views/modifies file attributes
PID:6456

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
138⤵
PID:6532

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
138⤵
PID:6556

C:\Windows\SysWOW64\notepad.exe
notepad
139⤵
PID:6668

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
139⤵
PID:6936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
139⤵
PID:6940

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
139⤵
PID:7028

C:\Windows\SysWOW64\notepad.exe
notepad
140⤵
PID:5340

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
140⤵
PID:5640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
140⤵
PID:5148

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
140⤵
PID:6316

C:\Windows\SysWOW64\notepad.exe
notepad
141⤵
PID:6496

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
141⤵
PID:6872

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
141⤵
PID:6464

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
141⤵
PID:6768

C:\Windows\SysWOW64\notepad.exe
notepad
142⤵
PID:4156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
142⤵
PID:6160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
142⤵
PID:5888

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
142⤵
PID:6172

C:\Windows\SysWOW64\notepad.exe
notepad
143⤵
PID:6056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
143⤵
- Sets file to hidden
PID:6524

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
143⤵
PID:6216

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
143⤵
PID:6596

C:\Windows\SysWOW64\notepad.exe
notepad
144⤵
PID:6824

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
144⤵
PID:7088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
144⤵
PID:7084

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
144⤵
PID:6736

C:\Windows\SysWOW64\notepad.exe
notepad
145⤵
PID:6192

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
145⤵
PID:6364

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
145⤵
PID:6536

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
145⤵
PID:4976

C:\Windows\SysWOW64\notepad.exe
notepad
146⤵
PID:6680

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
146⤵
PID:6936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
146⤵
PID:7024

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
146⤵
PID:7112

C:\Windows\SysWOW64\notepad.exe
notepad
147⤵
PID:7004

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
147⤵
PID:7156

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
147⤵
PID:7152

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
147⤵
PID:6536

C:\Windows\SysWOW64\notepad.exe
notepad
148⤵
PID:6232

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
148⤵
- Views/modifies file attributes
PID:5544

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
148⤵
PID:6952

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
148⤵
PID:7056

C:\Windows\SysWOW64\notepad.exe
notepad
149⤵
PID:5748

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
149⤵
PID:3928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
149⤵
PID:6428

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
149⤵
PID:6260

C:\Windows\SysWOW64\notepad.exe
notepad
150⤵
PID:6760

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
150⤵
PID:7032

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
150⤵
PID:6164

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
150⤵
PID:7132

C:\Windows\SysWOW64\notepad.exe
notepad
151⤵
PID:6552

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
151⤵
PID:5028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
151⤵
PID:6304

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
151⤵
PID:6628

C:\Windows\SysWOW64\notepad.exe
notepad
152⤵
PID:6548

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
152⤵
PID:6260

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
152⤵
PID:6184

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
152⤵
PID:5244

C:\Windows\SysWOW64\notepad.exe
notepad
153⤵
PID:6376

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
153⤵
PID:6720

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
153⤵
PID:6424

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
153⤵
PID:6268

C:\Windows\SysWOW64\notepad.exe
notepad
154⤵
PID:6164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
154⤵
PID:7144

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
154⤵
- Views/modifies file attributes
PID:7092

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
154⤵
PID:4976

C:\Windows\SysWOW64\notepad.exe
notepad
155⤵
PID:6964

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
155⤵
PID:6952

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
155⤵
PID:6960

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
155⤵
PID:6324

C:\Windows\SysWOW64\notepad.exe
notepad
156⤵
PID:6268

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
156⤵
PID:6936

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
156⤵
- Sets file to hidden
- Views/modifies file attributes
PID:6732

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
156⤵
PID:6868

C:\Windows\SysWOW64\notepad.exe
notepad
157⤵
PID:4976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
157⤵
PID:6876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
157⤵
PID:6208

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
157⤵
PID:6512

C:\Windows\SysWOW64\notepad.exe
notepad
158⤵
PID:6880

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
158⤵
PID:6088

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
158⤵
PID:6628

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
158⤵
PID:7144

C:\Windows\SysWOW64\notepad.exe
notepad
159⤵
PID:7056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
159⤵
PID:7028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
159⤵
PID:7076

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
159⤵
PID:6860

C:\Windows\SysWOW64\notepad.exe
notepad
160⤵
PID:6440

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
160⤵
- Sets file to hidden
PID:6716

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
160⤵
PID:5820

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
160⤵
PID:6888

C:\Windows\SysWOW64\notepad.exe
notepad
161⤵
PID:3928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
161⤵
PID:5940

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
161⤵
PID:6588

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
161⤵
PID:6372

C:\Windows\SysWOW64\notepad.exe
notepad
162⤵
PID:6508

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
162⤵
PID:6728

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
162⤵
PID:6208

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
162⤵
PID:6304

C:\Windows\SysWOW64\notepad.exe
notepad
163⤵
PID:7140

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
163⤵
PID:5352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
163⤵
- Views/modifies file attributes
PID:7064

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
163⤵
PID:6364

C:\Windows\SysWOW64\notepad.exe
notepad
164⤵
PID:6468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
164⤵
PID:7112

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
164⤵
PID:7064

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
164⤵
PID:4020

C:\Windows\SysWOW64\notepad.exe
notepad
165⤵
PID:6060

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
165⤵
PID:7064

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
165⤵
PID:4464

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
165⤵
PID:5700

C:\Windows\SysWOW64\notepad.exe
notepad
166⤵
PID:6284

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
166⤵
PID:6592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
166⤵
PID:6372

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
166⤵
PID:6608

C:\Windows\SysWOW64\notepad.exe
notepad
167⤵
PID:6628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
167⤵
- Views/modifies file attributes
PID:5820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
167⤵
- Sets file to hidden
PID:5700

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
167⤵
PID:6304

C:\Windows\SysWOW64\notepad.exe
notepad
168⤵
PID:6800

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
168⤵
PID:6876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
168⤵
PID:6580

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
168⤵
PID:6936

C:\Windows\SysWOW64\notepad.exe
notepad
169⤵
PID:5820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
169⤵
PID:5244

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
169⤵
PID:3380

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
169⤵
PID:6264

C:\Windows\SysWOW64\notepad.exe
notepad
170⤵
PID:6540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
170⤵
PID:7232

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
170⤵
PID:7240

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
170⤵
PID:7300

C:\Windows\SysWOW64\notepad.exe
notepad
171⤵
PID:7452

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
171⤵
PID:7628

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
171⤵
PID:7636

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
171⤵
PID:7700

C:\Windows\SysWOW64\notepad.exe
notepad
172⤵
PID:7852

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
172⤵
PID:8028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
172⤵
PID:8036

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
172⤵
PID:8096

C:\Windows\SysWOW64\notepad.exe
notepad
173⤵
PID:6528

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
173⤵
PID:7176

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
173⤵
PID:7184

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
173⤵
PID:7232

C:\Windows\SysWOW64\notepad.exe
notepad
174⤵
PID:7392

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
174⤵
PID:7596

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
174⤵
PID:7604

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
174⤵
PID:7660

C:\Windows\SysWOW64\notepad.exe
notepad
175⤵
PID:7820

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
175⤵
PID:8016

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
175⤵
PID:8056

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
175⤵
PID:8152

C:\Windows\SysWOW64\notepad.exe
notepad
176⤵
PID:5828

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
176⤵
PID:7252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
176⤵
PID:8096

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
176⤵
PID:7320

C:\Windows\SysWOW64\notepad.exe
notepad
177⤵
PID:7520

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
177⤵
PID:7664

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
177⤵
PID:7304

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
177⤵
PID:7776

C:\Windows\SysWOW64\notepad.exe
notepad
178⤵
PID:7976

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
178⤵
PID:8160

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
178⤵
PID:8172

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
178⤵
PID:6952

C:\Windows\SysWOW64\notepad.exe
notepad
179⤵
PID:8096

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
179⤵
PID:7640

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
179⤵
PID:7616

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
179⤵
PID:7656

C:\Windows\SysWOW64\notepad.exe
notepad
180⤵
PID:7928

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
180⤵
PID:5352

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
180⤵
PID:8124

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
180⤵
PID:6764

C:\Windows\SysWOW64\notepad.exe
notepad
181⤵
PID:7188

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
181⤵
PID:7488

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
181⤵
PID:7480

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
181⤵
PID:8152

C:\Windows\SysWOW64\notepad.exe
notepad
182⤵
PID:7756

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
182⤵
PID:7988

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
182⤵
- Sets file to hidden
PID:7956

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
182⤵
PID:7700

C:\Windows\SysWOW64\notepad.exe
notepad
183⤵
PID:6028

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
183⤵
PID:7252

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
183⤵
- Sets file to hidden
PID:7968

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
183⤵
PID:7344

C:\Windows\SysWOW64\notepad.exe
notepad
184⤵
PID:7540

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
184⤵
PID:7240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
184⤵
- Sets file to hidden
- Views/modifies file attributes
PID:7292

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
184⤵
PID:7628

C:\Windows\SysWOW64\notepad.exe
notepad
185⤵
PID:7812

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
185⤵
PID:8164

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
185⤵
PID:6364

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
185⤵
PID:7268

C:\Windows\SysWOW64\notepad.exe
notepad
186⤵
PID:6992

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
186⤵
PID:7740

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
186⤵
PID:7744

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
186⤵
PID:6636

C:\Windows\SysWOW64\notepad.exe
notepad
187⤵
PID:8056

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
187⤵
PID:5244

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
187⤵
PID:6888

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
187⤵
PID:7480

C:\Windows\SysWOW64\notepad.exe
notepad
188⤵
PID:7468

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
188⤵
- Views/modifies file attributes
PID:7772

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
188⤵
PID:7884

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
188⤵
PID:8148

C:\Windows\SysWOW64\notepad.exe
notepad
189⤵
PID:7200

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
189⤵
PID:6424

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
189⤵
PID:8176

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
189⤵
PID:7220

C:\Windows\SysWOW64\notepad.exe
notepad
190⤵
PID:7432

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
190⤵
PID:7752

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
190⤵
PID:7240

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
190⤵
PID:8040

C:\Windows\SysWOW64\notepad.exe
notepad
191⤵
PID:6856

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
191⤵
PID:6304

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
191⤵
PID:6608

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
191⤵
PID:7472

C:\Windows\SysWOW64\notepad.exe
notepad
192⤵
PID:7600

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
192⤵
PID:7876

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
192⤵
PID:7340

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
192⤵
PID:8128

C:\Windows\SysWOW64\notepad.exe
notepad
193⤵
PID:7260

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
193⤵
PID:8148

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
193⤵
PID:7412

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
193⤵
PID:7960

C:\Windows\SysWOW64\notepad.exe
notepad
194⤵
PID:7240

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
194⤵
PID:8124

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
194⤵
PID:6184

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
194⤵
PID:7208

C:\Windows\SysWOW64\notepad.exe
notepad
195⤵
PID:6592

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
195⤵
PID:7744

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Windows\SysWOW64\Windupdt" +s +h
195⤵
- Sets file to hidden
PID:7488

C:\Windows\SysWOW64\Windupdt\winupdate.exe
"C:\Windows\system32\Windupdt\winupdate.exe"
195⤵
PID:7840

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
194⤵
PID:8168

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
193⤵
PID:7508

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
192⤵
PID:6632

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
191⤵
PID:8164

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
190⤵
PID:7616

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
189⤵
PID:7256

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
188⤵
PID:7556

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
187⤵
PID:7316

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
186⤵
PID:7896

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
185⤵
PID:7288

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
184⤵
PID:7612

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
183⤵
PID:7336

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
182⤵
PID:7156

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
181⤵
PID:7552

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
180⤵
PID:6580

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
179⤵
PID:7396

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
178⤵
PID:6176

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
177⤵
PID:7784

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
176⤵
PID:7328

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
175⤵
PID:8144

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
174⤵
PID:7836

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
173⤵
PID:7248

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
172⤵
PID:8104

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
171⤵
PID:7708

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
170⤵
PID:7308

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
169⤵
PID:6828

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
168⤵
PID:6340

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
167⤵
PID:6832

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
166⤵
PID:6908

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
165⤵
PID:5640

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
164⤵
PID:7144

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
163⤵
PID:6324

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
162⤵
PID:5720

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
161⤵
PID:6716

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
160⤵
PID:4844

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
159⤵
PID:6732

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
158⤵
PID:6596

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
157⤵
PID:6416

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
156⤵
PID:6708

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
155⤵
PID:6844

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
154⤵
PID:6288

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
153⤵
PID:6780

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
152⤵
PID:5744

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
151⤵
PID:6924

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
150⤵
PID:7080

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
149⤵
PID:5324

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
148⤵
PID:7108

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
147⤵
PID:6408

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
146⤵
PID:6896

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
145⤵
PID:6532

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
144⤵
PID:6912

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
143⤵
PID:6604

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
142⤵
PID:6840

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
141⤵
PID:6796

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
140⤵
PID:6308

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
139⤵
PID:7040

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
138⤵
PID:6368

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
137⤵
PID:5688

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
136⤵
PID:6848

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
135⤵
PID:6388

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
134⤵
PID:5624

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
133⤵
PID:6788

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
132⤵
PID:6344

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
131⤵
PID:7160

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
130⤵
PID:6744

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
129⤵
PID:6332

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
128⤵
PID:5512

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
127⤵
PID:5316

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
126⤵
PID:5464

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
125⤵
PID:3288

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
124⤵
PID:5024

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
123⤵
PID:6072

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
122⤵
PID:5936

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
121⤵
PID:5392

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
120⤵
PID:5488

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
119⤵
PID:5484

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
118⤵
PID:4404

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
117⤵
PID:5816

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
116⤵
PID:5784

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
115⤵
PID:2772

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
114⤵
PID:4524

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
113⤵
PID:5328

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
112⤵
PID:4768

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
111⤵
PID:5172

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
110⤵
PID:5452

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
109⤵
PID:6044

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
108⤵
PID:5228

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
107⤵
PID:5896

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
106⤵
PID:4312

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
105⤵
PID:3392

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
104⤵
PID:4604

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
103⤵
PID:5832

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
102⤵
PID:4980

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
101⤵
PID:5900

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
100⤵
PID:5380

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
99⤵
PID:5596

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
98⤵
PID:5600

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
97⤵
PID:4640

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
96⤵
PID:5808

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
95⤵
PID:5284

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
94⤵
PID:6092

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
93⤵
PID:5584

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
92⤵
PID:1256

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
91⤵
PID:6140

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
90⤵
PID:5568

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
89⤵
PID:4492

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
88⤵
PID:5952

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
87⤵
PID:5532

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
86⤵
PID:4384

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
85⤵
PID:6012

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
84⤵
PID:5616

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
83⤵
PID:5216

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
82⤵
PID:864

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
81⤵
PID:4712

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
80⤵
PID:5004

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
79⤵
PID:4304

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
78⤵
PID:4972

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
77⤵
PID:4896

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
76⤵
PID:5064

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
75⤵
PID:4232

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
74⤵
PID:4536

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
73⤵
PID:2512

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
72⤵
PID:4600

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
71⤵
PID:4580

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
70⤵
PID:4692

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
69⤵
PID:4936

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
68⤵
PID:4244

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
67⤵
PID:5088

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
66⤵
PID:4400

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
65⤵
PID:4880

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
64⤵
PID:4256

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
63⤵
PID:4416

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
62⤵
PID:4216

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
61⤵
PID:3336

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
60⤵
PID:4240

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
59⤵
PID:4892

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
58⤵
PID:4568

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
57⤵
PID:5056

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
56⤵
PID:4624

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
55⤵
PID:4100

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
54⤵
PID:4716

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
53⤵
PID:4344

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
52⤵
PID:632

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
51⤵
PID:4648

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
50⤵
PID:4140

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
49⤵
PID:4744

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
48⤵
PID:4112

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
47⤵
PID:3048

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
46⤵
PID:4988

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
45⤵
PID:4564

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
44⤵
PID:4164

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
43⤵
PID:5012

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
42⤵
PID:4612

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
41⤵
PID:4196

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
40⤵
PID:3456

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
39⤵
PID:3144

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
38⤵
PID:3432

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
37⤵
PID:3156

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
36⤵
PID:3672

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
35⤵
PID:3356

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
34⤵
PID:3612

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
33⤵
PID:3016

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
32⤵
PID:3160

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
31⤵
PID:3444

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
30⤵
PID:4084

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
29⤵
PID:3428

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
28⤵
PID:3488

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
27⤵
PID:4088

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
26⤵
PID:3656

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
25⤵
PID:2756

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
24⤵
PID:1808

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
23⤵
PID:3512

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
22⤵
PID:3092

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
21⤵
PID:3296

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
20⤵
PID:1684

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
19⤵
PID:1300

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
18⤵
PID:3876

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
17⤵
PID:2708

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
16⤵
PID:3384

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
15⤵
PID:3896

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
14⤵
PID:1964

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
13⤵
PID:3480

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
12⤵
PID:920

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
11⤵
PID:3604

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
10⤵
PID:3192

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
9⤵
PID:1636

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
8⤵
PID:3244

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
7⤵
PID:2652

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
6⤵
PID:624

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
5⤵
PID:3376

C:\Windows\SysWOW64\notepad.exe
C:\Windows\SysWOW64\notepad.exe
4⤵
PID:3188

C:\Users\Admin\Downloads\RevengeRAT.exe
"C:\Users\Admin\Downloads\RevengeRAT.exe"
3⤵
PID:8088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
4⤵
PID:8188

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
5⤵
PID:7584

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Downloads\APT28DecoyDocument.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2700

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Downloads\APT28Hospital.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:3864

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Roaming\user.dat, #1
1⤵
- Process spawned unexpected child process
PID:3512

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Roaming\user.dat, #1
2⤵
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
PID:3524

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Roaming\mrset.bat
3⤵
PID:3600

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Roaming\mvtband.dat",#1
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3644

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-69980376714992064041916021383920875036-639326784357873050-19073178211017937503"
1⤵
PID:3300

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1371191355-984987321-1517257690921126561224666362-1055448754-336881332-1970759862"
1⤵
PID:3200

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "920691177318835109-827314968-1936601932-47236835792751663710478323141341399758"
1⤵
PID:1464

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-232379622141806592481271408664801852506874008856993633251082289-189573526"
1⤵
PID:3504

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1473687232-677123133-11762841201185423737-11093314051251924203180643967-1113194504"
1⤵
PID:3168

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "153667218-131712444-245844855-5067900491654665587180962746578771377-365749758"
1⤵
PID:1580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1549237791-974444826856455857-796573899-253943622-1988895712-21316073361947844520"
1⤵
PID:3140

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1858387676-1166294140959661309-1339511478-14619526071440715010-10624270491428089298"
1⤵
PID:3208

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "8071108971496349795-926086476-1024890579-195190571-1981864585-6386580931294185298"
1⤵
PID:2416

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost\vcredist2012_x86_0_vcRuntimeMinimum_x86.ico
Filesize
4KB

MD5
c398ae0c9782f218c0068cd155cb676c

SHA1
7c5bb00a34d55518a401cd3c60c8821ed58eb433

SHA256
9806476e9e8d001a2c6e1f0ceef24ec928e8d207c67888485df831e69deec2d3

SHA512
85f2b00101e4b3406f1e79033114b5ef4b9c3f6e9a0153da9cd5dff438f73ac90a29df05900061d0467c367e7aaa64a59b966d69530004e3a0517beb8cacbbb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
283aec989cc8129cf5f167bac2c57ccc

SHA1
e990699f475a0df1c1d4c9f41b6537dcbb45ab8c

SHA256
72af526b5b0aca351047b8120acca8619c64c41644c09cc3883da15605580b87

SHA512
c0bda43fc949d6d3b58c9f405a92043b96a17f35567c461e51d0a2585f586f6f4e5c3e3528f80a7ee808a723bdc1e67d4fb899d84501cb259c3212b6e463584f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
bc91e6a62debe8188b8e3bfe07224752

SHA1
e38c4f78ec69947fb37c105e022c649885465a5e

SHA256
a5353112d8bf73fa385d7923d61c43dcdd1c8f25b4db748e6ac8a486e0ea306d

SHA512
fee151d1d11e4571f83e42fb1d061db666ee2f0646d70c0aaadcbf29746c914feafcd31f589ee6072c220dd5fab32215a1a171351384ed9562c8dc42f9ff63d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
424869580d26c1238cd176d7dee99970

SHA1
71d365811db0a0412ff1c4af023573c228252f82

SHA256
cb730d0719e911ade17ebce41ddfc66bc5c359455c1afd0c7996097564c25254

SHA512
108d6211285ec27a91c5b70e0e406185ebb12f7100035b3bc3fd7c3e9635f2b3c0942edbd8c2f1fa7995d5912c0faaec3c0ae16b7bd0b3b6ec75f8410fc523e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6751f552055d4680777d4a68080be842

SHA1
1458ace4274364afadd84b3e218517982316e7e1

SHA256
5ebbe221050f8c5ffe8a4062f8bd1d1cc50b54dbd8cf5a4b5c1f045486460f50

SHA512
e01163213305bf64b4c03e7b1d8085984240037d7e97234adb4179e04c4ccc71e71d26c7693d5778cc3582d76324fcaaf68d819cb38d946ed909dd0ea0bfc86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
77a9dddf4f0f62d4c25a2a1af6352d31

SHA1
6fa262aa12f3c48370808552209486886967dc2f

SHA256
b34c257d416a2d3b64d2f12d79ff3b5eaebc3afd054d0b78d1e3e7b0561500e5

SHA512
8137a2a20696365568ae60cc761c8b20f3ab9beb21b6cd3afc4523270353e348d2670e6e3a97f4119fb07f2b8503cbb6dd4bd6db634b4e51eefa406328eab121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
623b981ce57e837d132a6640d3f8266e

SHA1
da567b8f090ca2b7b60141f672b8ae873c139365

SHA256
daf986441d6c89d335bdd53463b3403050fb127e4261d4755dbbd69e7a02c6af

SHA512
d1cd22fb7b56fd2a32bda74e392b82a04e3f1731a2132aab77e06ce9586fa805a9958a1ffd9d448705f3d551982646ab2ecd5335cb8aaeef86603d5f0c82f1a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
43373ad25e0b9ebe655b5710998599f6

SHA1
87ab40d8f0720f3da4f4355e7b9ce9ed6b33c07a

SHA256
fa0e2b10aee742ee7c4ba495c97c3ea7caeff119baba7cfa3239dd13cff1d39a

SHA512
237d47dfeb907269fc348324dcf57c59cf66bbda2a1feff7d5bb9072ac9f3a3e5be8c1e7be33fc0cb108c71a63bd1b62d98c8c76b7bed0a9abc99027f974cc06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
d9b177b317bc52a6f795c818fd1e0553

SHA1
27fbfba60725465c2d1bbe5b2ddea728fc38ad55

SHA256
d2b8ab4824f0915924151dfb526f28ba09c3664ee22ea0f49ae15ee89df95498

SHA512
8a4093d9ca4e204016ebcea4a40c14be1c23d1ed0ab326ad42cc3b6680c29f0880018b2c85ebe77b03573c725be85bb74e24e3a52d74f3b28e446e5ed8d93e83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\912dd353-8d79-4baa-af49-0cfdfc91bb55.tmp
Filesize
278KB

MD5
2a997cbab8ce8934a0d98b4217021288

SHA1
4d80ebe31ecae22ba81c302f305b8dab763db507

SHA256
b9e0c6ac0725ce779c28d42e632a212f76740f556669460a4f2c36c2fee7836a

SHA512
5e3b2bb873d364e2ad1dc6748c1e3c9166261f469671e3c87e4d464ff467055283520b76140e270d8b4ee593cf3eb9e499eb7c43fc9cd1329ae0990103c43547

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
1815ae0d146ed7eb3352e1648e4b1e9c

SHA1
0d52cf48d653326db9db93ab6ee2173d5900faaa

SHA256
8252da88b8115b9df6f9df99a1934bb703a3d5871526d6c677a4b1b6914d0f2c

SHA512
4016693ba5b37e6bd268066adbe6da1465ac09cd9aead358861d77859c367f4e82a7ecc36c7dc2bd902b7e47e07f1bd531128ff9e538dec17c22ba2da3bc3617

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
363B

MD5
fbc22d23840a5108023b8ff4346b6d85

SHA1
e6d0bafdada3474c420dc78652cfa82edeaac9a8

SHA256
fafd00192cb596ebcb1af49dd778626e23038116e3728d9756da011e3b8c2ec1

SHA512
51ff3fb8c3429b9b1d86d4d8a29878c5f057569a9a1936756346ffffc30f48bdb72c48dc7b90a4277a7be3b66905f0b8282292ddffea409d6f175e12413ebc78

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
526B

MD5
84ad3a3b0b98311b63d4145ae69b923e

SHA1
4ddb1998e7cd6fad3d8044bd01a4247a2962a263

SHA256
7dc1d255b071fc9f3c6b265da9ea628428fb055378041caccc08708d31aa4e75

SHA512
688ad618d57dbbdbd57a8bfb0099452d527b6ceb2fc342dafa6eb92239187dfee3ce0c8fb72951b8c05ad8a1568b1f10e26236303b8932a15499551fdc9f52df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity~RFf76cec4.TMP
Filesize
526B

MD5
d44e808983ccaaae52a6f4378bd68fef

SHA1
2bca9e09f3e5dae01ae54cd54308f4cdf503e9f7

SHA256
e14a1ce3e407c40e31eee434e6b4b003e2b69274923d1172e967b81be0b73b67

SHA512
42e85c3611681f9d4eaaa15a016f19e335c49e7395f212d574222bfb67379bd9fffbcf0df2f96c45abaf31f9145e1b2517ce2544df1b33d2eb1bcf464a8f8676

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
ca4e850191abec4d53a3bdc9f7944baa

SHA1
381dcefd191d7599dc85d5f7c9edd7945004b742

SHA256
f57e0e4668be499c16fcf57396daf77f6526fa3204c7ba71e5ed5abff2c0e83f

SHA512
5b43c7465451b6fbed3f664d2da68f9f4d86aee245f69b639c37110301101256ef124d17b8629377ac6ab4d355a8cc2235d6c1af0b6489d12d9e028634a87b83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
4eddf2e5d404aec1bca6ce47481765a8

SHA1
2b3cae6956ab94ac62bf93c6c6bbc4e95821b812

SHA256
ab5b32da0183e15e48ed2486ae61900b212f7a66ecc57635cc3a9b6733af43e9

SHA512
1a72b9c36f5c5c4f7474b7abbb89edd0cd224770e0a644537214655b2dc1a63f2a1068134e721a6b03783a268e823e9b58773004bc23dcee2ddabe6fbaca1c47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6dc4f60427fa9974c89248d0a562f8e5

SHA1
e553f347cc28546502992b194c4d24c71beec757

SHA256
04819db5dce60424cb8cb3047372c0803d8f96d46877e9aa09ca6b9e1caefe8a

SHA512
a9b7c69707899006423ad60006c006f29de62f6f8392ee21a52ef3a46d8b6c15fb771a4539c395823f1213c397cdfed347b24a3ffe35f54b3bf95f4cc19d8746

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
278KB

MD5
75097bbc8f873785d2e7d0744fd6e99c

SHA1
d7bf623bb3465ba049be0c14ea73af60eb544455

SHA256
c6bc0c9877559fd09323b1b3fca44953f9a0f270f5f613b34f076ddbdbe8bf15

SHA512
2df52e14a5ed4032f8d8d48fa4752db2561acf6fb739df90834822d5567a819ca526e8509eab5089219a76dd44a8cdc999c3e5228a28298b4237a5045915ddb3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
140KB

MD5
6bb7736247ec3049ecf05a0224c94a7f

SHA1
e143b46d2e9a9d1b61eeeacab3d7d7a11b908a6c

SHA256
3ebf91146736fa819d2d269008fafeb8ef86581c05ba599e86f947268a8bb13e

SHA512
50e2304c88d98e3fb2a2e417130cfd484d8ed8c2232c73a95e6b5c905c04be88b00a3fe86f2f70e24d415e53761732524c4a2684c2b1f7eb1b2fb857d8803612

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\activity-stream.discovery_stream.json.tmp
Filesize
26KB

MD5
3bc38a821064d12bba683e31ab87e68d

SHA1
bb77f855eb28ce30870ecf9867b49f48018912b7

SHA256
4f4af99d21a36806a90ac79950e96d69094ba798c0668a0f6b272aea2e14b19f

SHA512
8d2ed3485549b4e1cba29316bf1269831638b9f729cad9f2e4d990969451baa8ad705ebc71b0babfd729548f9b9a9066fe27c3c963060a5d53e259e60cec96bf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\doomed\12662
Filesize
12KB

MD5
eb154fb6865c86f7ac2cb44b45c4d9db

SHA1
654f052666e09b725896ae7c0d980413b719cc58

SHA256
c60c52b6e3972abbae149d559e22e539e0d94627ab23c1c8f23d3889a9af4380

SHA512
d9db54e465217a8e2443cf23fc06245a2cb74c291eca333f6fecc35d2b4d889faa152f2d092ea744af3eaf04587aafbb6ad9d158a4555428ec19bf0a0d4fbe78

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\doomed\24893
Filesize
21KB

MD5
d28995b0f6a720d1c79655b21bbde5fb

SHA1
b208006f8ffdc1a7eacaaeb8e4ebb5f24aaa82c4

SHA256
6b7377053e2f16fd099700330d08ebf935e57fe03b63ef3887a1dc73a9cfcfb1

SHA512
9d56faa4d8f1d46d8e3bfd3d96d10a9ab4020519b392caace877e932fc3ee90c3accfd775c7a123785e18ba2419b0bbac504a99085b09c046e60af4e5dbdef21

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\doomed\29409
Filesize
12KB

MD5
4853559856f646e2ac11b80455e61a06

SHA1
236758691b5a17e5a68362345c03f8e43f543777

SHA256
ae99d7f6c1c091b044a03f8f203f2eedb04983c5c575b0242de43604d536f008

SHA512
1a873f9c86f3c623407a924671f11136b407c3d9442f054cd265ef2058b31360c46493a9d5a8b1452eaf79622bd8c97dd9b974e5a1fd4d52cc4065464816ba52

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\doomed\32178
Filesize
12KB

MD5
76eddcae08d52c03a4553f3772dc335f

SHA1
5f0edcadf526ccd8637a5db848635826c834ddbc

SHA256
caa0657f10ced2346c9832c7da251ae1291f1ea8788562dd544c7962089ffc67

SHA512
b53c0a6ea8a53168e2b11f8f9b4feaf754506fe9afcf053033aa7d275b918a2b290984f60aeb984e1564d9933e2852d09c1430753ccfeb36721236dd79bd7057

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\doomed\6527
Filesize
60KB

MD5
3798941ce7cd8f6660c3ae902fd18808

SHA1
975626a8a0c6a95f5ab0af277b58de461aa00fcd

SHA256
b6ded84def701782fe57c4a2e8ae0c986e441279a43a7517a35a2bcd23a16f30

SHA512
47540171d984e14eafff6cbfefeb57a21a8337ef7de194e108638112b3eec9ec34a56f3e8dc13f152d8e6b9db9835bd19e1c6d735fd54ce06fc42884ae31a1b6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\0037F283B8D748CCC1EEB184774A9FF740FA2A07
Filesize
46KB

MD5
7d4749f9f6b416c46fc523623a2cdaf6

SHA1
9ba951c5d267f003f0b37b01bac4fef068202512

SHA256
98c90def4c169a3e9ce290808b418835d72db87decbc2e0254ab6321b466364f

SHA512
c7f395d64207a90a84b3a37d6530d13712024e649c8b7370e461be71ae4258f58ab23b24a6075a220565fee40b842c5c833b633677bcb255975b2e9c5454271d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\01E7348AEFD115549BF05069070ACAA006B73600
Filesize
60KB

MD5
899f49f7dc4a8c28290c4eabc46f93c0

SHA1
e05953a51c27019421d174c27e95135cb2eb3575

SHA256
ff696fc613e9ea3035b23fd3b783938ad0f9a57822a4ae2839f263e07ade4506

SHA512
4d44846426edb28b3ec86ddc46e54f3f75a5a7f03856a6a81f20a46d84d791e7013b435f0431f339df855a99f4b853711fb083e6925f6a69715de2bd76d0d8a6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\043A462E92F8DC6E26E0E2080340639DC7035F1C
Filesize
40KB

MD5
68c0fbda21372d8a3523cce2c53b85df

SHA1
31c21c128cbfe7ff6e384f7d5e3613118a68ce4d

SHA256
76db1be8e4ce833b5547d5c1393bc23031c3d6b0dd285c975ef6c125837d3fdd

SHA512
9054d4fb1b1a0a493b7e23e5c4b6cb55289bc3d91ae3968ce7f673d6b6549018b2453bb169af2b2bc2a7d707e9f8a77ec4f555d0a219d9748e7960f6c4cc2a88

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\10C482AAD91C6DB224B582ACD29C62EE0DF2570E
Filesize
45KB

MD5
c2cabb8945c6e33dd652a55d1800edd6

SHA1
dda564f5d1d59734ba6e3bd2e1ed3a57e516b9f0

SHA256
4eb47644f488723239b0d09e5c282c759a6f869c67126b9e5c2852969097d614

SHA512
3e8b5c9514a780ae5857ca11686e89fa2790d02d4c3efdca648812b517388c167e43d37c87bd212d2ed3c9ae246d387063c526d8b5fe88360246df6d5f67b1a9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\1439F3B4A48120C967AE0935725FCE9CD534017E
Filesize
99KB

MD5
2b9385f21d27974ea03cdc19ee323a21

SHA1
46eec7a2b5d25549f52735d0918408248b528284

SHA256
9ad118ae2b438ae60b699fb2afd3dfbff0bf7accf3ab87e265b8a22cc3f06726

SHA512
51dd1e5560b5af3a3b2985deaaded696da83470b347c35c4046682ffdae04c45e8be3373910cad6b7f1571d723c6cc4932171145d685ee4ff299df0e867fef16

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\15B333115616C60FCF5C0CB4ACA89973ACDEA41B
Filesize
55KB

MD5
03e2b5adb11460d1347db6c94df4e2b5

SHA1
a43b3e4dbfea2fe8b5c0182e800f75e6a2372353

SHA256
cc1c974d2f586732e958587a62b57ca51bf60a465e6638d0772c86231a2a4666

SHA512
59411ce93c93a5b2ccb29056076e97c87480600ce67fecca1cd57e6e0dde1545815a833834ec801a7cf82879724618b34ef8c7c3b8e75df31e5aa758837ae33f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\175FC1F27DF5030D57F8D0FF3A5E0CD7039CB332
Filesize
35KB

MD5
47d601b127055abe45da005d9211b032

SHA1
ee4e6e070f8882dd925b6bd655b2ca621987437a

SHA256
a645d0c48bea952dbce616ddf2018c3eda02bff684c644e4cb0760cb0870d733

SHA512
5756359faf1ffc0e54b260e341c2c0fab0dfd7ea9388717660127b3f862a0b6824dfbdb062b18dacbfa67a2c60e8a53874d04798cf2d9008839c6e0e5b891f4c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\186C95AB6EF39D38E7D72D839A6896FF58908570
Filesize
82KB

MD5
ca4766f3a40358bb146ebe76ad45701e

SHA1
70d8cf97387e1fc9833dd2e7af3fe3b0870f128c

SHA256
fcec2efc2bffe83ed25e063adb030971f718aec5d72048cf2405c9858f47187c

SHA512
1914fde66289ab8ddf4ecc021c63a995f9c56552b4d6a23087a08568bad8c7a086521413497d254ab728aff1d7188586e557954fe8cef987327acd0a61eedc49

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\2167B505D934699C441A8E0A03DA105F9166E6A8
Filesize
111KB

MD5
d9b5f5e11b6da90f0b7a35af73f808ae

SHA1
75ae031139d1e6001c83c40fba5cdfabde952076

SHA256
b3fd2e5d4da094ebc3b707960ba81d49cfad1a2a69fb769384794a6697718a4a

SHA512
1aae57598b3baaeaa66d7c3d3b73d2f8f1457be8be6b4679a8e4c92dce1ff015e6fe10b022695cabe38a3356d5cc06033e15b8c3f7b3a7b4360f7bf31e87a5a8

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\2EF8F0F74F67E153D87DC6A2EBD445051461A8EA
Filesize
42KB

MD5
8af52c951e59aa1ec73156dcdd4b79df

SHA1
9beb43e892a7b6db6c9cd8fc3b353a3ca3a724cc

SHA256
ea67a963c5c5e8f96509a79df512838d22154ad8a8ca1da8554527cffe915056

SHA512
1d11f0c978ac50a4b1e8586469ca7f3c0220dfe55bb096a59c71cdb7ba5338c7f3c51a192f603aeac801063763f61f3015f453629f0442b4ce19359c32b70947

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\3019A311D38E3244E0EDD46ED1C797822D7EA013
Filesize
50KB

MD5
3cee4cf511ebfbdad721dc41304d064d

SHA1
7567bb169fe9bb653c230125c1c89f5e82da276d

SHA256
4868181f6e8075c295691da5c3e75df8d5b93a381c581b91750ba9ec9bb8d798

SHA512
cc9fdc8e87c788d94daeaffcf6054f5056a55bd5b11afd3da0f8dfe22ec7ded23bb781eadb51f17e46567d658caffc195c52af1ef6d9731776bcde94c200dc1a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\31B1BA611E045ECA2B6C443D8606300862B66BE7
Filesize
78KB

MD5
66fb89ccbaaf3469964222658d268a6a

SHA1
d183291a798fe421b91ef6e5ffafafa5b51265d8

SHA256
8e80db7d68b3b399bcfc3eb3fa95a34acfb35927db8028a85e57dbc3125cf5fb

SHA512
e6598a34a08e3ecafdb226f70dd6630b9852c741379bef22fab836a430a5e0462dc26468104d709eefa2494b7cbb779a01173c9a0f90ed6bb8778af5546cba78

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\352DA859D60EB0F14860ABE7E7DA89065A74CEFE
Filesize
52KB

MD5
b75d94780925afab8786237c15ab136f

SHA1
711f3017bc18ccac313f9509b5f7b4f429064c10

SHA256
98338195d8a620ad9f9acde087c30243c65288ea6f705c39ad7494a8ceddcf3e

SHA512
6b9d05abfb30e99006ca508912d5c4725cf20bb115c2b6b5d286d3616663a555da38ff80260c9c2f71985a5ef2e92fc3beac063a55171db97b9e38e753bcb77f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\36B0CB9C53A43863DFE67396CF33ED27DFDD5E5E
Filesize
59KB

MD5
58f08f0b0f1ad6c68f3c6562a77b3683

SHA1
58eb0ef7ba8debf77815671bd21f21a6ae0a31c7

SHA256
3821a511a34bc597c5c5f5c2317780b284ce6d9406bde9b85aa432f7dd8c564c

SHA512
c7ea43fd6bb82ba0ddf1a3d0c93d0d6838808ed290ce56f0e04ae3cb6fda8b232b8a512a7fd120967f05068d42c76f14b2ef42ab0df37811ba5381c9ff416e1f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\3EFBDFCC47F190058EC126F0F351DAFF1C3DD608
Filesize
70KB

MD5
305b88ba6cd9df0884e111c54e8c614a

SHA1
ac16b7dd26d8a5fc51fd9deeb1a017c98e9c4367

SHA256
fc11642b01ffd8aaa7c1a5022cabdf8be0dbf548295e9284fdd483a50cba0ca1

SHA512
1544bb40d57ce0c3652b39e9c48c8f49605c8b0e0a6d78bb19f363d218c228f8afa18612b7522c645722d34104d30ccd26d9f7bb6c74c02eac23441ff54cd41a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\3F67F21AFABA3604E498EA33D92B357A3D546E86
Filesize
51KB

MD5
9dbbbd375f5989640ce123bb17beb536

SHA1
6aa934cddcb8680f86962d3681148e641ec49c22

SHA256
cef71b82107989b794b2d27a9d1b31cff85c4921081fc52ef3949c6cdb41e3f0

SHA512
3e3b50587e7da9fb6f8c419ecb8898b2ca6b7ebf997cb18c5dbb321beb8ed0a258e97d17d3026c2b65b3528d02bda9ee70dc9442852ee5b3110829eacd92b241

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\3F8F389BCD0BE34982249FF47A485DE4843718FF
Filesize
63KB

MD5
5857769030a2da7538e250c7625ed9e3

SHA1
a35120e2e6d173f003b19b0ce44a3594c12a632e

SHA256
e0977e183f3919f332e794e966d43d5207fb0adcacd3f181bee7679b7a15f3d8

SHA512
705178d4e9220eb6e7f9dcc6adfb8930ed3d0ae7f950f0bc87b1eb9d32d277be6c1e36be9e448ab56103b439df52f1a29bc550c2f8332c9c4cce3f4efd20f5a1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\406EBAA17812AA0AA6AE689DB116B050DFC65014
Filesize
101KB

MD5
6e60a6efc2e456cbc5a621cf12b02d1a

SHA1
a6eded86cb1a1d56811d20ebe3ccad07e4aee04b

SHA256
881a44c9a4dff2495ee30e50e5c07858e95f6e258e88079cefb6cad7949763f8

SHA512
3c1f5cd675672bfab1a2236af6864cfaa52f15a009d33c041c09f378d1ee54eec318f5012b12d1ade39c80e6e4d980f0426804afd324cc830dda048fa85c766f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\42364156B211D9E9E9453A0A1455564BA5DA146B
Filesize
60KB

MD5
f5bce710ea1e47c09a11d565af3b6e2f

SHA1
e8d3e07f5cfc1fb4fca71c9da459f4c795932228

SHA256
694f8599df40d0ae844630fbede6bc3a73e54d64533a282a5433c1f68f37c1cf

SHA512
0997c887d6e016c6a49f465451db1f54772d310dbe70ff16d5833b5f44f3fc415a994ae000b5db8a0ce0d763d06143a7d3f019160e773b246011dd94520f756a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\45722AE6FD12AFDC2A70A368BA642949293F7F4E
Filesize
54KB

MD5
f5a25cb2bf8adc0227e443357af6d835

SHA1
d8f0d5e5eaa6bc15f681fbcbf14254b4e80adf61

SHA256
e7f33dbf54d9dfe4b36f6dad986544cdf830f883922153d00f1f602388210925

SHA512
10c6871fd15c838e4e3f1bf2eea701060feb759858c3156ae056b773f1c9dfd7b17ec692ae7f98a628e9ab25f01edeb98c002e6bed3e923411a0c9e61a4f1954

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\4D22DE02B3E834E35CF4CEFC909DCF0A10C12C4A
Filesize
34KB

MD5
ec917f8f8483c98ac0b2eec8c6da4c04

SHA1
5749c314dd919c7e79705f9dac80898b8b98b385

SHA256
6820f8211990725d116e55e72485497c98e1ab835c732c89a13c66302c02bb14

SHA512
3cbe76dec2cfaa7a3216b00ab2438ddad5315e40fae84b666b0681bd342f53440db2127c787d8b4226a791b1d0fd44d509afabab827cd5a71a5f3e22acc85822

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\53991528631E2983697C84525E3DC24B7368E5E1
Filesize
140KB

MD5
a314433e213b40c23b6772159d094770

SHA1
5137edffe9a1e9807db012cf2a773ee7860d7178

SHA256
5744c53b513fb7e5900a046987fcc7e097cbfb0f5a87611a973a32ae2f920b4c

SHA512
576f41fcae5c00f7aed4171b296cd8e8c04215e511f48fdf65db853e27337a5a86a24698c253b8c887d4e5c52673356383bd0b144bfa5ac9d15cc7f6c69c7e0c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\53A1DF1FDF506E3354729DFE39DB8BBA3BC6F2C1
Filesize
121KB

MD5
bbec06376ff36496867208ee6c51a00b

SHA1
50fae9a16851ed507547a04bc7612ea4366a177d

SHA256
791247dc4d80572f687d7dab0b69ac2a6f945bfefc0388749957518380feded9

SHA512
b41455d0518592dd7d95c44cae72190472af9908b712ba9bbea534ea4c2824d56f63cb7cbdd873935f30a5205160e96a7cc40fa50402da8af2ae6aaca21d98f2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\56EB411D36FDEFCA5558BD52B6B84BEA6D8398F8
Filesize
275KB

MD5
27a09a07c1c44ec0852eebf038eed217

SHA1
5e117b72a67f5d0566bd0f00919772678f07bcd1

SHA256
4455ba9ff874faea22aac7d04db6c58057fef080576579e68efe206428d8e8f1

SHA512
3da8ae82e62ed938fd3123a5d31f05a1edfb92a6ec198a65f769a676e1d1210458ef74a5ec6cfc14112abcdf89d89fe633c6ca4bf101bcc634ff147bcfe1ef76

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\59F4B6204E09E46795F9A6C6C879D5A92BC4A994
Filesize
54KB

MD5
7e9a2d02aa3eaf3de13e473e2b07bb22

SHA1
e3ea27263bf9e949d9708a395c2dcefa40de9617

SHA256
42bf28ccdcaf4bdde18c18fece517769771df06a5ac8e117802c2bcbff581da7

SHA512
7e86c6fc9d8e1c6db83d40f9187454b5c6badf055f4b5bc76dd51c3aa0e4928b68280f200186956cabf4393f7b1988426bd2529b15e37167d046331ea097df59

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\5CBCFB2125A553DC57BAB970B1D95FC79C48EF9E
Filesize
35KB

MD5
4912c69e1688afc0b7a52cd7684ba82c

SHA1
bb8c0b3d2a0ec678a43ea8800c409bee4ad6d4d3

SHA256
12a9af69224b73bbdb62bd514d0d4de76b0624e928ae62eafa1c27ee469c2d06

SHA512
8497c805151e7ab8f4df0ea919abbcf8dfeda672d1f6864b513e8fec698c90dc5d9841dcbbe5f1d7403d3d67b9a2cc740da16c2e1c08264005b46aeb2211623a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\5DA90209A0E977CC1619187C88C5417F603D28B0
Filesize
60KB

MD5
dfa34a16e52a62f2950da67c2939a3f4

SHA1
afaa8dcbaf943a0c839109fc9d0024ba48758c58

SHA256
8491da6c8108d47d6eae9b92ec735e8760758e13942482a52cad75322a9a0cc6

SHA512
becd033b1104a78916d9062f8bdad02412d265780f5bf57b4d4d9f8173c469dcac2d94f0bfb84fe42fed7e5bd52c829848ca5ea1932e3435a3717a59dca6068a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\608F88FA72564FB522BCD4C3BCA563B88D89E4BD
Filesize
86KB

MD5
e8cd56485bc4946dc39c881a078704c1

SHA1
deabd9976f216ed9631cf443741d84b2a358fd49

SHA256
9322c6031bf33ec927abbb0c8e12284238960e635b91be408c681e84d3229f7c

SHA512
02358b39efe0de4ad754b51b17c0bb061a054c20ee009ccbf7982decc87569c659b607fe4488337ba7b5fa4a38ee5b13c3cfc3a6c08a691106fd355da1394380

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\6188E2403B4FECBCB27EDE289031E512291E3228
Filesize
53KB

MD5
bca3d21629ee940c789d8613665e5d94

SHA1
5be9688479b5fed3445e739744f8df076a734590

SHA256
d10c3d503c5344cf8cadd8ed653cae34c5b47254b0d202397ea642ccfc7f1055

SHA512
31fca9ffb329f328382269a8d85c1f257704e6c9be4af65954ec0794f0803af60a23dbe40d8ad867cfe4279e01f8eb80d97053a1808eb55ea49f152f392622ad

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\6515C143860D8F68D7979997F815B3325530C740
Filesize
54KB

MD5
cb17df3be7a48afc9f52e62e66e7dcf3

SHA1
4a612960cf1f03f74bc054c5183f5f57579a473f

SHA256
8f9ed7d24b622eee6618a24a03f025ba55ca951437c28bf903e2a5e70c67cb1f

SHA512
971ce8ebfb0f14dbb52054baebc2fccbb0205e4a1d6882f2a3572b79ee113be1ad2c32f40b2a558d694a79c5ba4672dfd988f0a7a571101031175778345a7a3e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\6AA37A0F51195218A134D2DCE0A7F76191B5AA52
Filesize
37KB

MD5
7c6e4ae9ef3e37856b5699fbb3236bde

SHA1
53141f4c2668cb00d8a78aa743ef2a0761bff141

SHA256
81c5201568c82a871db1f2f59a03bc9392df74b3561adac3a1fe411e41903b08

SHA512
0def39837a6f533ce662b7f825584254cfe690521c3b7e3ac173978fb5cfa835da9660d176680b65f01bc5bd674012ec178998eff64c8cd03e7b0dcc660de4e7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\745DC2DFC8A5380C11B1CBE9A146254B0B278810
Filesize
537KB

MD5
f87a58a3d879ca66d28487785b589027

SHA1
a8f5a6a1162c599cfdc082f1f3603416e1b8b355

SHA256
36aee6f800379504e106fc212c295afe3a50dcbc2058bd443bbfd1e1bc418cad

SHA512
ec32474539fb55ea92609544c6bfe9b56e03dd79f11979e6b69f0d46ea90ef8ef2e6adc16df6ab86ddb710ae953aacf091a45ee92add36e98c2d8e93cbae6533

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\792C5CE331FD6F707465BB74F3B8FFDEA265ACF1
Filesize
17KB

MD5
67549a5643591b2847747ff9469495aa

SHA1
41e533517e2e8ff3a1e2c94acc10395f5aba49a4

SHA256
ce1f5144d4615823aabeefe537e004f3cf067ecbd357f088ff7cc62550e350ea

SHA512
ab4eda7751b7becb5894015d34bba494770267d172128be595cb8caa50abd3f7846675ac976c402dd61d664d72d64fb275916032f7cf22bc70f23b727d03720a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\7CFBD4857A71AFB16B02CC3BD4D3534FD96B1E07
Filesize
213KB

MD5
fab02731f1aa9d45a40e7c13d5c619ff

SHA1
9144f3d5ade21b0e94c428d8fc5cc48180ea525c

SHA256
7924ddb48b5ca8d652c273b91426bee4dcc11629cf1d329161c7b865349ac9e5

SHA512
0deb005d3ad5ebc48a4598dd86766d55ed070e2a9b9658f9545bfbde13207d6ae1261824f61bcf5c68f3c07ca238c6023fa27e8acb719c18964477f4396344a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\82A62E2507E5D0DD42BF01DDB42F451BB5C2AFD8
Filesize
61KB

MD5
81d0e05bbe0195b38cd8d49ee897bb6e

SHA1
395d3f053fd7e0efe5f738017e2a7b01b9301324

SHA256
78770860184582f658c783b4106bfe16bfe3ca6efd0e5de6d66589f066052205

SHA512
a07ec48f5b998fca57dd35dbd4a2c5f87c89f05dc65b8a229dccb93dff2d1a81f7e443ebfdc101e3d301775e68f3e3d50ea6a1788db69c172664d49e497d8009

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\918BDF0DC8EBDBD6BEF063990C085D4A58BD4F89
Filesize
78KB

MD5
53bdbd2ebb13181dda603810b7ae64e6

SHA1
3102d20559c80582adf79fa7d728ed3d8c61e882

SHA256
5bf816079fba1e5f86357088f7a303f5aac02fbb73e889e71cc3fa7e9349513f

SHA512
1af23481e8c82ddce7a88e65411a0c4b4bed38778d8a02357fefc6452a0253febc93c689cdd7e403b5918b5abf4b5023f0fffe7b6480e4befa0d71d6985fc6c2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\95954C0C466EDBF2DDB96A5D523C7D73A885C5B8
Filesize
17KB

MD5
a45ba6f89421f2d0b33825fc9fed4a4e

SHA1
926df94efbcc9041706aa0b9901d140132a2e7bb

SHA256
fa3908521c2f25cc80e0d05e187cd9c27b810b99df77f47757b62eb41791cf77

SHA512
caded8c7814907bf58cce8071e4fa9a88c23b3d230e7bf125982e501b82eb394c5c64131c2e9ad9bc06ed5f838de714f3fe9a6782c1eaa0003aa715525cd1a06

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\96F296B05719BD7B3D4F88892805D24AA9439BFD
Filesize
58KB

MD5
301fcddf83b835551f5e12f38bbdaae3

SHA1
72ee36ff9ba84d96c32cd9015d53d43f56012b59

SHA256
c0a695589d671837bc2ceeffe0ed1f69d237bd0c24c8935b8ceb9a4fadb7bdeb

SHA512
9070822cad0346e2d2a2c5b70a0eb2980a4a1f7b2e98a32c14f664078454ce70fa66094ea34f5ab5f3f3c5edcfa8b04683fab364d96e51c0cb227cfbfa9516d1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\9C2BBC7137762B4CA02A130A09A82F71C29112CE
Filesize
327KB

MD5
3b42b245f41133a6c93093c1ce05f8be

SHA1
216828f138ce18c2302cae7c204108e3ec62fbad

SHA256
a479c284b1e5be11ef5b69bc0eb3c1270ba8490d11bfa24c0b86b313e2f7b85b

SHA512
d84c0895c09acdb73d0bf947b646daf48fe3f10e2753c605cb44ffd0817df1c1868eb429e690138358da9029fc909211884549540854d934af932453b8bbbd5a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\9F861CA64E07DA329D5E01EADD29C9F13E7EFC71
Filesize
243KB

MD5
7b948344735d7252993395a76b29c490

SHA1
24e4e39452ae88ecb971a7562431d2c8e4ce9aa2

SHA256
6827e1ca1e5dcd6c2eedb0b14e9807346c842707432900ffe5c02560c9a91b86

SHA512
897c3cdcfee728722c23eb6f14647578174264a90db78fa9858da3c8f5c3ccbaeb665a299233270faaaa41a9148fc13b4705738ff754d8c49f8baa8a3eb987d6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\A4A26A10596BE7DC53B276682BB52E61221037DC
Filesize
243KB

MD5
067afddcaa631cdccc9def7a6f1d4124

SHA1
74ce523eeeee5adeaf21aaa661ac3c2d8aa0890b

SHA256
24bc1a2f5d17b1f065d23999077f8fe346e01a4b02edc1c70725b579dbeaa322

SHA512
032f890151e3ff9d236a1b1103964c5ef18424309f2077ed674410ad010c5205807abc09f9704cfffa1d2f9e879031ee3a42461b8397493cda1e6b448f2ffdc3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\A9A09781D39A6058CEB37BEABB37C39D8650F57C
Filesize
40KB

MD5
77d52784a018be4b898cfca0469f3d43

SHA1
a73a8689f0c4589bb30182c7fda695447c9ba475

SHA256
cca0c585e949b1d282bf5f46311db94892649caf784b30e5f901c86757534d04

SHA512
41ec623a5dbcae394551b618dcd192e89e0b55c1fac2d045f74fbe4ddeea8a0fda220587ad6db68ba67db97e2110937f337276546267aa22bfd65deb388aa18d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\AC89153B3BBC863316BF97ADBA9A93CB62F0A987
Filesize
39KB

MD5
868324dfbd7209ce12577629117959bf

SHA1
6a9267a9bd7fceea2921f1fb908efd95874d0a13

SHA256
821e83044281f5fe7f016bbe46dd901eb988cc54ab8d9e64c7459b850519c6f1

SHA512
ba6c0d4a480339056db9822107d499fb6e2c6837fcdd5412c5680f61247c114379b4e95756d80c88b577cd1a398d99c341670a504e53e08019a8438f003ce50e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\B45FBB4DCE796BF38EE002C0EFCF9922A99F749A
Filesize
156KB

MD5
baa4ca0deef9ed42728e5eae8aefc501

SHA1
5ab58f85eb95cf5a8718f349db6b203152de6d52

SHA256
8d2f1f096c63e9551eea2f6461c53610ef3fc14350f87ca69a36b9d460d56e93

SHA512
036bc4cceca9586d78e45ecfcce0640a734c2a3d9323ed471ba9f3cdbdd890fac0993a629dbef0626bf5a31daf23bafd61ae442ef4e31796ad199de2a5b67fea

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\BAD275B70AACC193961BF40067DEA4CAA76F58AA
Filesize
94KB

MD5
e564fa44fa8121bdf0b3f968da671a6e

SHA1
05d3627cb3787eba6653ad10e015583fecfd80bf

SHA256
25e0094eb7b4e2676c4f0c43ffdb212cf030c5b9c32f99840c7d6e524f30c60e

SHA512
5ac076b063a096425a39b071e1f75ea586f9f2bb15aac8e193b83bb8afb534581c2a599372e19e0487e3e1fc359131f64fe1c31f568f381fadc83a96b3ba66b7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\C797BD36F550D8507F2B89785CBDEC44E5F9C725
Filesize
41KB

MD5
e8f2f4c4a79b87d43f9b6940c9041a6e

SHA1
26c68117ac6ce194b0e5c13d711caf5160e47d5e

SHA256
96f10408258588392671df7de7dbbef01a66263f9d39907230c270553ff641e9

SHA512
0b82aede928e7481ab7d9fa1a8fe02e05579fb91cc2f89b52664113b7802eac0fb8aa6d4391e0e227f6a18924019a47f9361ac8540433aa9ceb440359c766a79

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\C7C148D011F2452AD675D8391067195D1B5D4250
Filesize
44KB

MD5
a6546c8c26971ff41451f03d5f4ebadf

SHA1
d55fa700167a07eb8880b67677ae43d6929065b3

SHA256
e47e20e2747c703c1387abcef808ec972d8470ae13849615ce2827dd19040ada

SHA512
a860f2dd92020ee683bd52c65c65dfad56df16877029bf862fb57d2edf2dbc767b8b9fc85b04f31535d60451b83e3185ab3f76b78f8d74310c5e48562e108cdb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\D3F3FA52341E4B5E93A45FB5B1198DE2F0FB5DA6
Filesize
74KB

MD5
87bc4a5e995be98c4068e3c67c151780

SHA1
1d2d8681cf71a671060330bd28adca78c80fc57c

SHA256
662154833d8210671a1050f216918ef1bd3f40bec778c0cf1d9765bf4297fa10

SHA512
e669179db9cb9a03b72d4c596a860203d8033be09756c043410b382f7a4897d83859658b037ab9f8bd3a97ab232d5f3fc6a2f388786185ede3b11706759d79d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\D679750A9509E0F7C2A53099B6736FF5878577CC
Filesize
66KB

MD5
11003a66a56cf1074e78a5b10dc92869

SHA1
36d440d9d7a1e369467b33242de280e196c03f43

SHA256
7a610fbcd4eb9f60e2ba0bc6850aecdae18615d1813cde11791e5279a19f02a0

SHA512
5c911915a2fdc9f21dfab0bdc18f4a70d1d82ca52c902ab1ca34bfcd39b392cd7423900c1df8e7d41d7b832c02789c471bc353b928226e878c182844ce4107c1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\DE46EE04856B06593A3188BEC9AD0D09C978916B
Filesize
44KB

MD5
24b0e8165c318ad3a6da273b558b9bd7

SHA1
c2e8ac6947125af3dd569c718cff4cce5687b641

SHA256
67ac77c6240ea08870715fe87a295b37ce4c1f7e481f03b8c4efc624fdbfef20

SHA512
c87937e7a4340e0a06831fc08a016aa833d5dc8bd135bfef723fa5b482b665de99197308a1f0f62a1d87cb13466507b7a6e80565ad7c4dec83f893bbc4ace2d3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\E0B46A203FF7FE1ABB3989B015ADF65BE03664A9
Filesize
33KB

MD5
795ffc12bbb62a3a734176f9b62b183a

SHA1
99c8fc3c67ea0e1259f16805173e450b2eb26c0f

SHA256
5e0e4341ad8058052b4f1078d0bb7eae13cd36296d9e24c2c14345a2ce7ebb3f

SHA512
54d27d7f7aa07db85cd1be8660c946b411c7ac5d96ac695bd05c2cab575e418052fcd616f8d50ed608f54dee25e060b40dc0147a548bad5cd87f9bde127dcd45

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\E0C48D645537104FC6B78D3D8515F9348171EE3E
Filesize
45KB

MD5
46aac781c494d64ba204061a745efb88

SHA1
f6f3681891947100a752ac783b75a3b3ca0c9a97

SHA256
6b720d50d4be5a80061a593affcb5e8a64e16db522862a14e66521167498d51c

SHA512
4ced54cd5f5dc316c0d83b285528679df9a9935576e03d10d912364f4becd11d969d5d6b67bacb25cc47032e169415bb6366815eb18fc5bd1ca80e7e1fb682f1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\E37F0C9F306DC48775447C1CB63D24537A2B4D38
Filesize
33KB

MD5
0decd2cb80a283efe73cbc4d38352004

SHA1
ba4e64e17086bfe88b516b5a8d580cc8f0a62c30

SHA256
f07b738d622a20abe2b8a8026ea819ffc8064725c3174dfd1403295a306903ca

SHA512
60d05b1417a3844de62a732c5f57889eadcb46a8bec268af244aa7071d09f21a0138b338fc7e61af094ebcfd636333416804b22453596b1cdf8f86b6e477208c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\E8E40E9BCE957E3AD9AB5161FC4532CFBF8866B9
Filesize
88KB

MD5
79f0ac12a265c8e1f4a0665cf0c36f87

SHA1
56eb4379fdef3b76a7efed8b19d8d1b7f9ac2441

SHA256
e3b333f5c91df0adc92845e8df7988faa125b129f76e221142519eecfe5ae7af

SHA512
7f64ab3bafdc3f39aa53702018702fdc75f74120b1576a574cfdd55bcab61f47b2b05ed125880a158b5406e2126e06861786c390c0c496e8f605f6af936028d0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\F5A408B220C7D7DA2503D149E37CBA85D3759D48
Filesize
54KB

MD5
f694a9b0bffd56e245a2e33d0860216b

SHA1
71aeaa58df21491d0f353e3476f6e4d467a0d2d9

SHA256
bf610dae3599c7687407ef6e7fca6706dbea24e9854d9e497e8d01a0902c2bce

SHA512
7094fecddc3ca6a4df7426eb0dea2f7908610889a133e3f601606a2d5b4f05ce00dc1bd9537a128962fb80f21206f849036e2a149eee1877131e5ca746b29891

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\FC9749B77259334A9A50CFBAE32BC3D6CAC10DAC
Filesize
41KB

MD5
5ef5dad2188da04aa79635b196185946

SHA1
09135de4e6416c2832e107bcea9102b2effdfd6c

SHA256
b1c9bb461477c61841b576bf2b1d407bee6339bd73304abb8fd1c5ee4484938d

SHA512
82cf0b5a2e6c4e61c67fb7ea287e7fa816fd357d35b9529b46b79dbb067089247632839d011c1d0d46e1a49ab379b01aedaacee3d010e7294618b9b174271b6a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\cache2\entries\FFAFBFA30B8A5B3743B2995F9FAB3E2954703B29
Filesize
951KB

MD5
0b9e29d53d76bb35f8037f88f53abeed

SHA1
20de1cfe1e2b8141a5cb6508166e68d43044ace6

SHA256
228fe80f1f0ea58df456dfb8bb61b2d4f3eafdc88a42e47b2157960ff40de7ca

SHA512
0f3ab3a3fdfbd54789f93a78cf6e1872ed1dc50d3fa7a0abe4df3ab73234945b1d7130b858a1a04ba213ab224b78723dd022de220b5ca1846b553d3b14d27668

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ty9peokp.default-release\jumpListCache\LdMbJnCA1+y4DuCJ9S4Izg==.ico
Filesize
25KB

MD5
6b120367fa9e50d6f91f30601ee58bb3

SHA1
9a32726e2496f78ef54f91954836b31b9a0faa50

SHA256
92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0

SHA512
c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AV2.EXE
Filesize
368KB

MD5
014578edb7da99e5ba8dd84f5d26dfd5

SHA1
df56d701165a480e925a153856cbc3ab799c5a04

SHA256
4ce5e8b510895abb204f97e883d8cbaacc29ccef0844d9ae81f8666f234b0529

SHA512
bd5159af96d83fc7528956c5b1bd6f93847db18faa0680c6041f87bbebef5e3ba2de1f185d77ff28b8d7d78ec4f7bd54f48b37a16da39f43314ef022b4a36068

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49EE.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB.EXE
Filesize
243KB

MD5
c6746a62feafcb4fca301f606f7101fa

SHA1
e09cd1382f9ceec027083b40e35f5f3d184e485f

SHA256
b5a255d0454853c8afc0b321e1d86dca22c3dbefb88e5d385d2d72f9bc0109e6

SHA512
ee5dfa08c86bf1524666f0851c729970dbf0b397db9595a2bae01516299344edb68123e976592a83e492f2982fafe8d350ba2d41368eb4ecf4e6fe12af8f5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\EN.EXE
Filesize
6KB

MD5
621f2279f69686e8547e476b642b6c46

SHA1
66f486cd566f86ab16015fe74f50d4515decce88

SHA256
c17a18cf2c243303b8a6688aad83b3e6e9b727fcd89f69065785ef7f1a2a3e38

SHA512
068402b02f1056b722f21b0a354b038f094d02e4a066b332553cd6b36e3640e8f35aa0499a2b057c566718c3593d3cea6bbabd961e04f0a001fd45d8be8e1c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\SB.EXE
Filesize
224KB

MD5
9252e1be9776af202d6ad5c093637022

SHA1
6cc686d837cd633d9c2e8bc1eaba5fc364bf71d8

SHA256
ce822ff86e584f15b6abd14c61453bd3b481d4ec3fdeb961787fceb52acd8bd6

SHA512
98b1b3ce4d16d36f738478c6cf41e8f4a57d3a5ecfa8999d45592f79a469d8af8554bf4d5db34cb79cec71ce103f4fde1b41bd3cce30714f803e432e53da71ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A1F.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-18467
Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41
Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-6334
Filesize
2.1MB

MD5
f571faca510bffe809c76c1828d44523

SHA1
7a3ca1660f0a513316b8cd5496ac7dbe82f0e0c2

SHA256
117d7af0deb40b3fe532bb6cbe374884fa55ed7cfe053fe698720cdccb5a59cb

SHA512
a08bca2fb1387cc70b737520d566c7117aa3fdb9a52f5dbb0bb7be44630da7977882d8c808cbee843c8a180777b4ac5819e8bafda6b2c883e380dc7fb5358a51

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc6D92.tmp
Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
120B

MD5
7fa64457dab410a36e8e63d79a901241

SHA1
05916bab28077f0d3e149845ee7b9c804c034108

SHA256
094acbf16ade25da43c597a39edaab67f4f27055c23c07f3441a000459648c5b

SHA512
a687be60b641f84e17d8bacf868e0ef823e14f47f3b08bc9502c3825dc8d69d74e8cdf79ba2db9e5691864a0d56b637782c5f7f3cc627cff371106d530833b49

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Filesize
145B

MD5
48e1b5f5ccca12e0631ad24eba0af00c

SHA1
82b67c1c3dba68b8531e82096c9fe92fe2eb2833

SHA256
2ea0e7404f76c8dd0163b0ddef11957842993b839f9a5400edaf922e094ba417

SHA512
e2fa57ca7240496cc055141cde7735c35cb7134f44ea2f2ccb72d47eb46e03ee582b0c132d7631d0463b192398229fed999d31d80b7112e4f0baa7160595b8d9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
cbf539402825382abe169d39518278ed

SHA1
7ec291743864e5768b4cbef330b50635f52f6f36

SHA256
157636bfb974fafc3737942eab67ded924e0b741afeb46a4a2c2496185c720b2

SHA512
c68347cd243fdd89061d7d1eb1d632dd989c1c12c966da14f0227672a75ccc227b57fdbfc855accba9e28596b05df1c0035203b5cc03dfeabf75c640eb0c4c5a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize
20KB

MD5
6fbe1259cebcc42ca754b0e9e40082bb

SHA1
b0787fa59e636f63b432a5675b252806c1abef96

SHA256
745e1bdaac36060b621ba1eeee9f470b2dedab9e4f65eb9de5d47d99b437a42a

SHA512
64c8fe0c1df57f975d9fd341d8fb225c6f74198fb02084500e2d49548c6ff4cbda163aa5b6dcb583d3e6e0722c5689e48448c7e7fe95c8768be75f19301a7f8b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\db\data.safe.bin
Filesize
15KB

MD5
18075b95e3efe8ae60d53ce481364da2

SHA1
d9acfe52151a25d612a6ec596c96ff7bbcdd093e

SHA256
1cf5a3bb3593ddbb5b21d69303a847e43bb04e0f13744241df07a8134f268d62

SHA512
f1f90a2b3394a9754d77fa6be32e5184d10d55a53875e16164c8ba0fc5d3fa7d0510a220a768a8223ea8f5af5c43bb20cde658385c298e76e2bf735eb278a013

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
70dae46d7c52d00f17690c57875de864

SHA1
147029cb3f15ba707c5d4ca672c04bafa376a154

SHA256
35feea3db66a64c3dddb250d35a84b617f20a43b81e7a3424ad02fe2b8e62268

SHA512
ae57514010d30fdbd3bd3945ac05074990a8e58972fc575b12226e44888b556cef32dfc10a667c136bfb038c1da53fe298580e49c7a72ed89b95d2f78b94c3fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\pending_pings\3d3df6b4-9b79-42a2-bcec-01a8369d4c24
Filesize
745B

MD5
c35c144d420c4b613bc2f99256727f21

SHA1
1249a0764b7b8257ada48a5ce8c067e9fd365b45

SHA256
7be6a7af3c143007924f04a3ceb7de61a59034dac321c141fd6119671e9ec336

SHA512
9ccdfc1e5c2964aa8f2dd1092e912ff41952190ea8c41f9504ec4a770afec07cc90474380a6141a0b0c45fcb74b996798e5c14c5936c1689cb02f0a2e1faa22d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\pending_pings\57c238a2-0b8e-45c4-9b74-bcf884f0b012
Filesize
679B

MD5
ff571beb570e13f2fbadf0c7f35a5299

SHA1
dc293ba98e631b90796a07e57f2b1f63f0fb5970

SHA256
6adeada7f570f79eb0436c4e1229d4d7049b19e063e47a90fba1d972b204ccbc

SHA512
8d7823a33cd0825faeacaaa13045fe4443cf3f219548649575896ba230f39bff19d43ef8835d719d4e1c657fcff5adf5a59d289dc5554b0c139754059e22e19b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\pending_pings\5b151daa-2b10-46ae-bdaa-d2d725378737
Filesize
10KB

MD5
0a7faa7511f1ba9f7be86c2310e69da9

SHA1
e1e4c94f0479bc9c965cecc3e0db7bcb422ab80f

SHA256
1166bc8eb12864ee21c93a2bbb573866ce1eb110a04e245715bb3829175ca4fe

SHA512
19fa1b298e972bc58fefc64b830821d7ff8944c611cf041ed2a54e07e1e975379b41e86b8b1cf54bed5c365c43f339149e2ae8897a5f1cd9dd5c6ba2994ac951

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\pending_pings\87833774-ab68-4c8c-8037-50df4d84d5ce
Filesize
1KB

MD5
e70e45efb217df3572332be4ed977749

SHA1
9b159d9af96710cdac060d89bf9fd326aaaeac7b

SHA256
b67408852800c5b9a65c23929b654630fc7b6e3245c1b67ac00886ca644acdc4

SHA512
91162b8c32c4a589de107bc6b50b444d9bff1e1106db717bbc46c46aa1bed0284b152ecf49ba690b61c83ada73b2f8d412ddd06c47db5f76190122988b38e9d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\pending_pings\cbba45f9-f63c-4cbd-a326-89d6aef606c2
Filesize
773B

MD5
87685d7ebfdf3b44b1aa744274bb23a2

SHA1
570c85ad531111c3b92dc93960fd1a782bcaeacd

SHA256
ca7bcce3b5188d4b6d7fde6e96533476bff377bcae9085696703c467b14211d4

SHA512
af901599d8cb9def6629ba4388aded19f29f5478d3b5e7a78c9264a3b01c96ea3464ee6c7d130414f5aaf3c2cee590c3576b5b3951581eb32b38ca8394a6f6f5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\datareporting\glean\pending_pings\fed48af0-5605-44b0-845f-43f9a7bc18f4
Filesize
855B

MD5
64be9ce3f6d75060821f64f3b01a4511

SHA1
e1e8c85f3ce99ed698e9e47640320f1e00e3ba28

SHA256
6d4d8b24e9caf01276421a5c08381f16a7a92f732306f379ad5e534772c8bd99

SHA512
7792138a67e91f435c8e68df13dafc20107cd2a09bb38dd14c1c75871a8ffbe031a342ded9128263bd0f7837683676d59f97bfdc372dc78654065f384c2da20b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs-1.js
Filesize
6KB

MD5
bd0c642a62be6d714a8d51a3d8f04842

SHA1
dffe3c47ca96b4f932332f41974996fadc7390a3

SHA256
77987a9babea6f584670be417331480642ed5c795ff4f13c8d7e61208cb46eeb

SHA512
70aabca695c6a5c59e88e822abda8466a92d757b850d385e845e8b921c7ed55215d9ec99bb3af3eef8128dbe944519dfc99b94c35619406a452a86c8ca4896bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs-1.js
Filesize
6KB

MD5
3480f7abfe558ef402f269250c501ce0

SHA1
38e79f9770d8fec5ee2439e131726d66373e4c8b

SHA256
fcca6948cc54643ff2a6be50c38c23dd8481e40eb1cb0b284d821b28d2a9a087

SHA512
bf0bd0fe1cf90017fb1cdb8339bfbaabd303ada8dc58253893451b718166d041e9b01de4380092eafce4267a6b8e67b2f86bba343558b70867c33826b8bcb343

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs-1.js
Filesize
6KB

MD5
5fa780e02439043ffba6f75580850f55

SHA1
12ca05be9a10809470fa5fba4de4ed603ee795a2

SHA256
7774d277adef3aa748ca36364c2f8788ed2ca57ded095a9976f7d3e1b58d4312

SHA512
b93adb0415b8d809721f3741ba941aa1f70f602a053d20875374071f0398a4b9391215b52fe4e2ab1d93fc112413572d56b3cde0988142b754c451b49d0088fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs-1.js
Filesize
6KB

MD5
eef712c6f380148e959b70a9bd5060f9

SHA1
7f6184cfbc7dabb6f1a3b1ec864adec81f46345a

SHA256
aa15c2396b25bc691ff6481839334feb01ddfd0b6ed26739e1a1accebed2ad8d

SHA512
44f9c2639b15a82155ffa0ec9c96457b7c38e5b0379e1b5cf28d368583879cdbb9962f4f17a0a236e3ea295c93cf4bc73471ed6cff3247c42aed4d0749c13a5f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\prefs.js
Filesize
6KB

MD5
8d297dd1e173336b30083eb7358e277f

SHA1
1477d1a700669c3bfb4ffbf729a951383971c782

SHA256
2dbd51ecb195207b778e3b5d8aba088a63b4b5fb5186c867f68b68c96c387d87

SHA512
0c17c7e8806718150dcefc7d50f73ffca19ba75a8a9886a95a3d26d4b7d42b240d5b15384f9f51dd68b901f6fd5556feb96112f5f5e443e80e05fb5c738a16ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
12KB

MD5
8baca39a61bd8d5e2a69ba9afcf82b10

SHA1
d7d82bb609fe951c97c77c51ce16bb08541f6670

SHA256
7526a96ed4f7e2063ef642b86ba20394ff619965692b0719c8c4349d0f9ce5f7

SHA512
9d091e6e93c499c73392946ba4d8d813b6da214b52378246a4c226027597dd5b4d2fefe8f23dd1ffba1b55a6365fb99ca6619fac5ae9f32c414aabed7ca64f70

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
12KB

MD5
8bfa2039a85ff65bb69d9775fa4f0297

SHA1
97236ed95849a405d30bc60fce92757d46ebbb7b

SHA256
a714fa2a156420bc9b7629fa85cdb919e39825936629481876754516288c3af9

SHA512
523feefa77a8c776cf776b77ee0cc728c2cb38674a1355aaa9e64ccde89b050dcd622198fb3d1b8834722e946c5bd0a3cb9997778964eb3dfdb4ae6322c07eb1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
12KB

MD5
e1f7e368203a79aef4932ed1365228bc

SHA1
9b1a291a908940c5442dcf7727c523fc8e42c1f9

SHA256
63b231375b7e2236f1ec6a164266872bcca941bc64c56adb3266780389049f33

SHA512
fa5995e416bddce0d1d21cda9b39ca6c37692263e07679a0c7c9fea8cf87624f2b80a4369a148de56f5ddd9538e533109dd638f392e689988e546301cb38b305

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
3KB

MD5
b3bb33c76d7a561c30d4c6e07194288a

SHA1
97769c215626389860d7e15a084c86a29e9bf2ea

SHA256
1f7b99e645ee84d0a240b025241b2f8f22e41c648aaaa4fbb6885d1dd4a0b368

SHA512
b0868db7a6c05b6abbb67003c166037954b079dd8142b16ec63c24c38b6e66feeac846410d6ed00f07e232da392973c7656d9dbab8648fc7e99d048377ddda9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
ca8d89d2650774b9ce6c1216ab1a1d9d

SHA1
ac81fc3031429bae1b10c373458b98439871f162

SHA256
0f618899fce3963186d6117ff33ff9809c4a0e34c3003565156754765442cd65

SHA512
d1df57ecb6d2f1d9ba791d3ababf9051d5703e740cd602dbf8e0b73cb3ac86e6941bf839aaefc1eddc25b8f208b43cab0014fd6a68f14353b6528242b2ed9340

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
6KB

MD5
4a790c1900891370aeec662ad00ba848

SHA1
517dbf1628f46d130283f641f59e6a6a55c3ff52

SHA256
47dd6aff95935753596c715ae2ad30e78347e4af03a8f8de48d8b376a6f9f9e6

SHA512
ef10995c3f7985b5508607c3a397ca1c96dd9345f2107af57691feb0d093e574f6e6a8b9900531317856d3d894e5d77b60862b2267b49787c3db3f66b6b94d79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
9KB

MD5
9cc2d4c24d82c246c507d6bf41af1e3d

SHA1
00d8e304ce91ed69c6984edcc97f5d649318ab46

SHA256
b2fe293fccda6c041a09e3f0b7396da21b8cb674048459c9a0c1c54569e96145

SHA512
8ed6e5bf35e7a12a48d3cc7eb1d2bafa40b154f9235be137d8297f5b74d6cfdf60649b07fba54f10d3fdc9ec569dbb6005afb788d2b1d1a569671291ae537e27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
10KB

MD5
984b9a0cd135774578f7fa506d856f0d

SHA1
63b3f0863036d5a5797680bcfad30a79e75f0960

SHA256
ac37c544d8a0cf62f1ab0fca6d68a4df801612456ce9cb076eccf05062ece7be

SHA512
d1c6fe05f286d405bf3a43aea7668e350bc111ab6fdc6548bf47d85ede795082d1ed418f746856d4b943da774f4f868d0df6275ccbaf62148e98ed4c05dff551

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
10KB

MD5
9830294b25370f7a72f027761f396ea1

SHA1
4ad524df980a3054066a65a1fd71b6415130e256

SHA256
709443673ee6287f3dc344a9801142e4dbc0421c8f9d9ed65c9d444702c07a33

SHA512
aeeafce2d0f30517546cbe6351e6d8b0a825025ad40f8c4bf9ef164f7ca19df085e476a929cb7ee3d9d3e1f49353147e6709943583b2a7be71ab991b9f2d67eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
10KB

MD5
c90a0d6c790cfa827740c92782238029

SHA1
7b38386c44771f0585adf1a242892806d4dee40d

SHA256
b5fb34d41035f86b81f5b14b87c822b3cc3e5a137d442d201f26e2a94c26d3f9

SHA512
8f6f3515712e585be5b3073f6166a9d62d5f44b82c347deeb4cacec193acb86e31bb87d9c0b322d891eaa13e8d77dc0cb90a2ce180b29c2134fb2d463f238daa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
13KB

MD5
46278e45956a679f7de48804ee22a76a

SHA1
efeba88be1690259693fa633872ce2b794906a18

SHA256
87f5435803560b2276eb7fa7ae556010bbd26e03c5ed7b21c029b5d9e4c10b66

SHA512
83d18f3de3e1e30656021da6fc3e1d0a07251f86e463e05a596c54ae651bad9271c5d5537ead44884de8b09ba34eff8c06c843623e3428c4f7344a321ebb3266

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
4KB

MD5
966f94b86003b9b87b32222c80e854dd

SHA1
33856fc681691fe7b4cffa0cadc5069bcdf846fa

SHA256
9841dc9dcd1dd8f7a73663e91be608d8e19faf2133609eb0c0645fed20ef7419

SHA512
aa7ae75e722b3f30e44383a52ed842b64664a3cdc5a36992e2fb0220096782366594d7f8ee3917ed17b6856f83eb6dcefefb70311619991d72ba73ffb8b3f45f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
11KB

MD5
c7f1b08b8cc8098b45b0d649d94f1f31

SHA1
aa682e90a50f29cf98b1d6e5fd24b18c9c956594

SHA256
2673d0d9d90be3b25e2f0f5ebdb916f4b5a05c2e2eb895d17d13087b34a805a9

SHA512
0a4dbdb7d95e937f105d3d52f9f0b3f891321a0a968be0cc3c2a60e1dc647e26a175c9a16cfe08f9e5a77d92699fab0eb9733d413f3f21c67e3ab3d71daf62ab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
11KB

MD5
26f40124bb454e00a76ee34b5cab66fd

SHA1
f32bdb0e0d3112c91b44a624fadb3eaf42c4192f

SHA256
23e7bc2b7a5f916e2250fff212e1a33ed95c95bf5380094cf186a6d094f7ff99

SHA512
da66b98e7839bff48d67e45a9da11e9a0621a4328c9aa62152c0b1a1f36601472d4fc39fe9008f371dba4f0f4432a89a0e933ef82fdefa1a378b05bdfcc9ffea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
5KB

MD5
bd87e9e6db26ced69f8afb630d11fb65

SHA1
c75cbdb46b034786855bf4ec8f3e639355cac107

SHA256
ad4ede0271a8bad84edb15865a3aefc9a438cfbfa153a2f66ea9c1dfa3a111fb

SHA512
fd5deded7843231f67174fa8c6d6a87fe04d408fbaee220fb78b734959b796808e0ee2ff25df45a88739aa52d2fad3e0580331c59cfd676429f0408e50e2394e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
11KB

MD5
1d0c9f34cd4e7dc52ec42aa1ed7e4aed

SHA1
381a84ee4612bf1026fe6cc12dee38c688edba54

SHA256
f0081caf750f31aed91799e7e4443c146a801b6c829928f5cceed1e2f4717a03

SHA512
037e2fd6da31753a6e167cf881d9166265aa91283fea39c318980f0439ceff90921315fe739fffc1aa30ad443727504ecd61c6b925d2b21d9085f5697824e6ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
11KB

MD5
472d5087819f9d5ec79f768db3b21c0b

SHA1
484b2566038d65c35f33117c45f958350b36bb98

SHA256
40b153b58e59089596ec63fcb679f6c01bec230a7db6fe67886ca133c554cc99

SHA512
36f393aeebd384c22539437872488c7db9e546fe117c08ad9dea42c191f127f4bc6c5069012e4f97a24e1d72cc683a496b55be14ff51b043dbaa7b1c9509b3f0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
8KB

MD5
d8b8ff5aa79f58b2ee58b9c41231f0f3

SHA1
1f21fbbb1da67e7e76d08d66362a60cccc1c7a39

SHA256
212ab24469b376c580b4ea00c6b5c30c8a07249fd380074a599bad8eaf1a0f21

SHA512
cf4947f5d70e5e2613008fddc5e7c537a7871aa79d8af9593fd047de0649da42e63ba925f4d39d264d37c13c58c70443b73a7177f1c5485fa871f93fff01ee64

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
12KB

MD5
bf2e01c10bd0d579f7f94f01023c9c55

SHA1
6b706a8373f977de23d8535e6b04cdd80ad84f02

SHA256
ec0f936740d91bdbd52d5ccc8dbb62ef5b688e9e6db469907eba31e3bfb4f4e1

SHA512
609a5ac1c464bce1299574aaed07099d8c75793e85ec205e5b025ce9a9e6418d912282873047a35bc8f1147ec9d187817db1c6e06ce14764e3120c4e0d040ed5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
10KB

MD5
1459a5d6929285872c8c6d592ad66cbf

SHA1
820b15fe60f8244630ef05c628447474b25a9451

SHA256
bd9518ba2e3848a32fac4daa64fd42701fd254340b782b7fce2139925a9e01b3

SHA512
fa8c2874f588984c4ea593a7e3bd58fcb6a637192f0811a63882933285f7ad138b0527540e48b921a35862a719fabda47e42c3cef0a6da7f386c9d512fdb9a09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ty9peokp.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
12KB

MD5
e69c8f0b7d40c8f860c63c40ec64682b

SHA1
2380f35db1ba980ef135c01e9ee1da3ebfb9ee4a

SHA256
c4bfe164933fba1a701305bc97ea48457b25fece14f9cf6b45d5b5932ce274ae

SHA512
0f1ed03399badcee786dda2e83c445ba8e8a3e3f5b44591e28052068dc392c3201a4c2c013c3c8f296eb00699e4940e73461639935c7ce5a37a83bcbae3aaf90

Download Submit
C:\Users\Admin\AppData\Roaming\mrset.bat
Filesize
106B

MD5
583ea25b69feded9f65cfbff169147a9

SHA1
56e6487b283f2718483fe8823f70e36ffbce6fb7

SHA256
51eaf3b30c1ea932843cb9f5b6fb41804976d94a53a507ccb292b8392276cfd6

SHA512
adeb0df1f5edf3d1348f048da8760c2f8a9b3b0a8fd87a92ec62fbf0fc83681b928c2bee064a0b731bc4842c5d34f9e00e00303c4de4a56c9027e127d30260f5

Download Submit
C:\Users\Admin\AppData\Roaming\user.dat
Filesize
69KB

MD5
b1d1a2c64474d2f6e7a5db71ccbafa31

SHA1
91d8e6f993e8b294924811df052e96cbec0545ad

SHA256
58b223f74992f371cab8f1df7c03b9b66f2ea9e3c9e22122898a9be62a05c0b4

SHA512
7f3a458083159e51e505074c46fa18a744bed43a21efca957a0bd60a8c8347597025dedf500b73c4cb5f5a107fb8975cb52b453deddf9fc69e46f8d417004b44

Download Submit
C:\Users\Admin\DOWNLO~1\DanaBot.dll
Filesize
2.4MB

MD5
9cb7b0d8e817636deed7b195e69f6156

SHA1
3a68463ef2313fa9580ff8048900ffcafb604114

SHA256
9e9c58dec15cf26e295f6d4dc1587468e6f1483e78ff2b8a2f47034b9731f5b1

SHA512
c8cb93a387cbfe13d1cfd131cffdce95656543cbb8838983015c981aad5cb9e7a6c1bbf94f248a83017420d7d51eea2ab44449333dd1557e2ec2a7017fc8a793

Download Submit
C:\Users\Admin\Downloads\APT28DecoyDocument.doc:Zone.Identifier
Filesize
50B

MD5
dce5191790621b5e424478ca69c47f55

SHA1
ae356a67d337afa5933e3e679e84854deeace048

SHA256
86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8

SHA512
a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641

Download Submit
C:\Users\Admin\Downloads\Alerta.exe
Filesize
111KB

MD5
e8ed8aaf35e6059ba28504c19ff50bab

SHA1
01412235baf64c5b928252639369eea4e2ba5192

SHA256
2d2a22db20a44474afbd7b0e6488690bad584dcae9789a5db776cc1a00b98728

SHA512
d007c96b2fad26763d27be8447ca65e0ab890deb6388b90cf83c0b3431e09b225f7424098927b54f15fe34eae953b61b45371b0df4b2d89c60be9c006ffe9034

Download Submit
C:\Users\Admin\Downloads\Blackkomet.exe
Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
C:\Users\Admin\Downloads\WarzoneRAT.exe
Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\aZ3-Dd9K.exe.part
Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
C:\Users\Admin\Downloads\iTYnKgiK.doc.part
Filesize
333KB

MD5
085be1b8b8f3e90be00f6a3bcea2879f

SHA1
cc7607015cd7a1a4452acd3d87adabdd7e005bd7

SHA256
c4be15f9ccfecf7a463f3b1d4a17e7b4f95de939e057662c3f97b52f7fa3c52f

SHA512
9d61f7fcf4543ca2e9d282df93fa604a1736a5a50da47e7c66ecaa635465fef61b26c94af5f6204601668e646b6a140f0e248e01ad79fce056b671a3f6d8c6af

Download Submit
C:\Users\Admin\Downloads\sqQQuTEp.doc.part
Filesize
76KB

MD5
9b10685b774a783eabfecdb6119a8aa3

SHA1
f293a2bfb728060c54efeeb03c5323893b5c80df

SHA256
a4a455db9f297e2b9fe99d63c9d31e827efb2cda65be445625fa64f4fce7f797

SHA512
26a0f0dd37439da543526704b5a689ed9f9317baf357d9a7a4d885855d80b5745a07972da3a1c5b06f39fcbbbff9e94f0729edbdba8963b0dcb8c650addbdc48

Download Submit
C:\Users\Admin\Downloads\tsa.crt
Filesize
1010B

MD5
6e630504be525e953debd0ce831b9aa0

SHA1
edfa47b3edf98af94954b5b0850286a324608503

SHA256
2563fe2f793f119a1bae5cca6eab9d8c20409aa1f1e0db341c623e1251244ef5

SHA512
bbcf285309a4d5605e19513c77ef077a4c451cbef04e3cbdfec6d15cc157a9800a7ff6f70964b0452ddb939ff50766e887904eda06a9999fdedf5b2e8776ebd2

Download Submit
\??\pipe\crashpad_3040_DHXLLYPSBKXPFIRR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\mvtband.dat
Filesize
29KB

MD5
1421419d1be31f1f9ea60e8ed87277db

SHA1
f9fd3f1d8da4ffd6a494228b934549d09e3c59d1

SHA256
8c47961181d9929333628af20bdd750021e925f40065374e6b876e3b8afbba57

SHA512
a6825107c5e60231dcf631e702c3b75422bad8644ac69df21aa9e9437758850f31d84fe95a4e0386235b3b7103bbcc8945365f4d804cbb16e161c5577680a072

Download Submit
memory/1236-2482-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1716-2354-0x0000000002070000-0x00000000022DB000-memory.dmp

Filesize
2.4MB

Download
memory/1716-2402-0x0000000002070000-0x00000000022DB000-memory.dmp

Filesize
2.4MB

Download
memory/1716-2454-0x0000000002070000-0x00000000022DB000-memory.dmp

Filesize
2.4MB

Download
memory/2340-1877-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1873-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1856-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2340-1891-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1879-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1892-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1875-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1878-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1876-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1874-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1871-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1893-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2340-1872-0x0000000000390000-0x0000000000490000-memory.dmp

Filesize
1024KB

Download
memory/2476-2346-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/2476-2344-0x00000000023D0000-0x0000000002648000-memory.dmp

Filesize
2.5MB

Download
memory/2504-2375-0x0000000002380000-0x00000000025F8000-memory.dmp

Filesize
2.5MB

Download
memory/2504-2376-0x0000000000400000-0x0000000000AAD000-memory.dmp

Filesize
6.7MB

Download
memory/2700-1757-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2700-1821-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2772-2349-0x00000000021A0000-0x000000000240B000-memory.dmp

Filesize
2.4MB

Download
memory/8540-19193-0x0000000000FD0000-0x0000000001026000-memory.dmp

Filesize
344KB

Download
memory/8664-18342-0x0000000004650000-0x0000000004678000-memory.dmp

Filesize
160KB

Download
memory/8664-18235-0x00000000001B0000-0x0000000000206000-memory.dmp

Filesize
344KB

Download
memory/8664-18307-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/9140-23293-0x00000000008A0000-0x00000000008F6000-memory.dmp

Filesize
344KB

Download
memory/17448-43853-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/18604-43855-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/19132-43856-0x0000000000D80000-0x0000000000DC5000-memory.dmp

Filesize
276KB

Download
memory/19132-43854-0x00000000008E0000-0x00000000008EA000-memory.dmp

Filesize
40KB

Download
memory/19132-43852-0x0000000000D80000-0x0000000000DC5000-memory.dmp

Filesize
276KB

Download