amadey | 84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385

Analysis

max time kernel
96s
max time network
152s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
30/03/2023, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe
Size

990KB
MD5

2fef05cfbe31bfc894f6ab7fd531abad
SHA1

61d45a9fe7423ecb1027b8badf88e4c52014e84c
SHA256

84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385
SHA512

f43fd6b55e498c00735b30b0ffd5f60c3487c592d2a24a2bda69adb27ca01a023034cf2df91c17a3f83a5ad5d1489d737a132c0acb5efdabd34d09c38f4e760f
SSDEEP

24576:vySazrjxPtSe0tMcuAlCqHs+7i/2dx5MsB+2X1XLc:6THJe7uAlC2s4iudx5BRh

Score

10^/10

amadey aurora redline anhthe007 legi rosn adware discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

66.42.108.195:40499

Attributes

auth_value
f93019ca42e7f9440be3a7ee1ebc636d

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

legi

176.113.115.145:4125

Attributes

auth_value
a8baa360c57439b7cfeb1dc01ff2a466

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Extracted

Family

redline

Botnet

anhthe007

199.115.193.116:11300

Attributes

auth_value
99c4662d697e1c7cb2fd84190b835994

Extracted

Family

aurora

212.87.204.93:8081

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz5910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz5910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v5243eQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v5243eQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v5243eQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v5243eQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz5910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz5910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz5910.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v5243eQ.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/5028-195-0x0000000004920000-0x0000000004966000-memory.dmp	family_redline
behavioral1/memory/5028-196-0x0000000004AE0000-0x0000000004B24000-memory.dmp	family_redline
behavioral1/memory/5028-197-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-198-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-200-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-202-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-204-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-206-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-208-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-210-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-212-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-214-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-216-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-218-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-220-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-222-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-224-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-226-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-228-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline
behavioral1/memory/5028-230-0x0000000004AE0000-0x0000000004B1F000-memory.dmp	family_redline

UAC bypass 3 TTPs 10 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	LuckyWheel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinSearch330.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinSearch330.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	LuckyWheel.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LuckyWheel.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WinSearch330.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LuckyWheel.exe

Allows Chrome notifications for new domains 1 TTPs 3 IoCs

adware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Policies\Google\Chrome\NotificationsAllowedForUrls	LuckyWheel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Policies\Google\Chrome\NotificationsAllowedForUrls\1 = "https://gofindall.com/?AID=LW"	LuckyWheel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Policies\Google\Chrome\NotificationsAllowedForUrls\1 = "https://gofindall.com/?AID=LW"	LuckyWheel.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	WinSearch330.exe

Executes dropped EXE 21 IoCs

pid	Process
4272	zap9146.exe
4624	zap1401.exe
4008	zap2348.exe
1700	tz5910.exe
4840	v5243eQ.exe
5028	w98cu46.exe
3384	xYhud40.exe
3252	y83fa94.exe
3244	oneetx.exe
3364	123dsss.exe
636	Tarlatan.exe
1760	Gmeyad.exe
1956	Tarlatan.exe
4200	WinSearch330.exe
4860	2023.exe
3924	w.exe
4656	LuckyWheel.exe
5076	tmpBEB8.exe
3700	WinSearch116.exe
4620	LuckyWheel.exe
5032	Gmeyad.exe

Loads dropped DLL 22 IoCs

pid	Process
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz5910.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v5243eQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v5243eQ.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap2348.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	WinSearch330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	WinSearch330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Updater.exe"	w.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\LuckyWheel = "C:\\Program Files (x86)\\LuckyWheel\\LuckyWheel.exe"	WinSearch116.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap9146.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\LuckyWheel = "C:\\Program Files (x86)\\LuckyWheel\\LuckyWheel.exe"	WinSearch330.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run	w.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2348.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LuckyWheel = "C:\\Program Files (x86)\\LuckyWheel\\LuckyWheel.exe"	WinSearch330.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	WinSearch116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LuckyWheel = "C:\\Program Files (x86)\\LuckyWheel\\LuckyWheel.exe"	WinSearch116.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9146.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1401.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1401.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	WinSearch116.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinSearch330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinSearch116.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 1956	636	Tarlatan.exe	88
PID 1760 set thread context of 5032	1760	Gmeyad.exe	136

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\LuckyWheel\uninstaller.exe	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\Newtonsoft.Json.dll	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\uninstaller.exe	WinSearch330.exe
File created	C:\Program Files (x86)\LuckyWheel\kill.bat	WinSearch330.exe
File opened for modification	C:\Program Files (x86)\LuckyWheel\Newtonsoft.Json.dll	WinSearch116.exe
File opened for modification	C:\Program Files (x86)\LuckyWheel\WinSearch116.exe	WinSearch116.exe
File opened for modification	C:\Program Files (x86)\LuckyWheel\	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\dotNetFx40_Full_x86_x64.exe	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\kill.bat	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\WinSearch116.exe	LuckyWheel.exe
File opened for modification	C:\Program Files (x86)\LuckyWheel\dotNetFx40_Full_x86_x64.exe	WinSearch116.exe
File opened for modification	C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\uninstaller.exe	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\ADSSTrayPopup.dll	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe	WinSearch330.exe
File opened for modification	C:\Program Files (x86)\LuckyWheel\kill.bat	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\dotNetFx40_Full_x86_x64.exe	WinSearch330.exe
File opened for modification	C:\Program Files (x86)\LuckyWheel\ADSSTrayPopup.dll	WinSearch116.exe
File created	C:\Program Files (x86)\LuckyWheel\ADSSTrayPopup.dll	WinSearch330.exe
File created	C:\Program Files (x86)\LuckyWheel\Newtonsoft.Json.dll	WinSearch330.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 10 IoCs

installer

resource	yara_rule
behavioral1/files/0x000600000001aedc-1217.dat	nsis_installer_1
behavioral1/files/0x000600000001aedc-1217.dat	nsis_installer_2
behavioral1/files/0x000600000001aedc-1226.dat	nsis_installer_1
behavioral1/files/0x000600000001aedc-1226.dat	nsis_installer_2
behavioral1/files/0x000600000001aedc-1225.dat	nsis_installer_1
behavioral1/files/0x000600000001aedc-1225.dat	nsis_installer_2
behavioral1/files/0x000600000001af8a-1445.dat	nsis_installer_1
behavioral1/files/0x000600000001af8a-1445.dat	nsis_installer_2
behavioral1/files/0x000600000001af8a-1444.dat	nsis_installer_1
behavioral1/files/0x000600000001af8a-1444.dat	nsis_installer_2

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2468	schtasks.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
360	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1696	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://gofindall.com/?AID=LW"	LuckyWheel.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://gofindall.com/?AID=LW"	LuckyWheel.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{179F3D56-1B0B-42B2-A962-59B7EF59FE1B}"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\zwoops.com\ = "1609"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = c7407ea65a45d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Male"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "58"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\zwoops.com\ = "1522"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Voices\\Tokens\\MSTTS_V110_enUS_DavidM"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.google.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "SR en-US Lookup Lexicon"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Microsoft Zira Mobile"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\zwoops.com\ = "26"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "26"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\zwoops.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "Spanish Phone Converter"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "002D 002D 0021 0021 0026 0026 002C 002C 002E 002E 003F 003F 005F 005F 002B 002B 002A 002A 02C9 02C9 02CA 02CA 02C7 02C7 02CB 02CB 02D9 02D9 3000 3000 3105 3105 3106 3106 3107 3107 3108 3108 3109 3109 310A 310A 310B 310B 310C 310C 310D 310D 310E 310E 310F 310F 3110 3110 3111 3111 3112 3112 3113 3113 3114 3114 3115 3115 3116 3116 3117 3117 3118 3118 3119 3119 3127 3127 3128 3128 3129 3129 311A 311A 311B 311B 311C 311C 311D 311D 311E 311E 311F 311F 3120 3120 3121 3121 3122 3122 3123 3123 3124 3124 3125 3125 3126 3126"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "11.0.2016.0129"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "German Phone Converter"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "{E164F996-FF93-4675-BDD8-6C47AB0B86B1}"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaV = "You have selected %1 as the default voice."	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = c7407ea65a45d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\zwoops.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{048113E2-AD29-47BE-8BF4-66F1D05042B1} = "0"	MicrosoftEdge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4660	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1700	tz5910.exe
1700	tz5910.exe
4840	v5243eQ.exe
4840	v5243eQ.exe
5028	w98cu46.exe
5028	w98cu46.exe
3384	xYhud40.exe
3384	xYhud40.exe
2144	powershell.exe
2144	powershell.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
2144	powershell.exe
3364	123dsss.exe
4200	WinSearch330.exe
4200	WinSearch330.exe
3364	Process not Found
1956	Tarlatan.exe
1956	Tarlatan.exe
1956	Tarlatan.exe
4656	LuckyWheel.exe
4656	LuckyWheel.exe
3220	powershell.exe
3220	powershell.exe
3220	powershell.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
3220	powershell.exe
3700	WinSearch116.exe
3700	WinSearch116.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
4028	powershell.exe
4028	powershell.exe
4028	powershell.exe
4028	powershell.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4824	powershell.exe
4824	powershell.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe
4824	powershell.exe
4620	LuckyWheel.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3996	MicrosoftEdgeCP.exe
3996	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	tz5910.exe
Token: SeDebugPrivilege	4840	v5243eQ.exe
Token: SeDebugPrivilege	5028	w98cu46.exe
Token: SeDebugPrivilege	3384	xYhud40.exe
Token: SeDebugPrivilege	2144	powershell.exe
Token: SeDebugPrivilege	3364	123dsss.exe
Token: SeDebugPrivilege	4656	LuckyWheel.exe
Token: SeDebugPrivilege	5076	tmpBEB8.exe
Token: SeIncreaseQuotaPrivilege	1328	WMIC.exe
Token: SeSecurityPrivilege	1328	WMIC.exe
Token: SeTakeOwnershipPrivilege	1328	WMIC.exe
Token: SeLoadDriverPrivilege	1328	WMIC.exe
Token: SeSystemProfilePrivilege	1328	WMIC.exe
Token: SeSystemtimePrivilege	1328	WMIC.exe
Token: SeProfSingleProcessPrivilege	1328	WMIC.exe
Token: SeIncBasePriorityPrivilege	1328	WMIC.exe
Token: SeCreatePagefilePrivilege	1328	WMIC.exe
Token: SeBackupPrivilege	1328	WMIC.exe
Token: SeRestorePrivilege	1328	WMIC.exe
Token: SeShutdownPrivilege	1328	WMIC.exe
Token: SeDebugPrivilege	1328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1328	WMIC.exe
Token: SeRemoteShutdownPrivilege	1328	WMIC.exe
Token: SeUndockPrivilege	1328	WMIC.exe
Token: SeManageVolumePrivilege	1328	WMIC.exe
Token: 33	1328	WMIC.exe
Token: 34	1328	WMIC.exe
Token: 35	1328	WMIC.exe
Token: 36	1328	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1328	WMIC.exe
Token: SeSecurityPrivilege	1328	WMIC.exe
Token: SeTakeOwnershipPrivilege	1328	WMIC.exe
Token: SeLoadDriverPrivilege	1328	WMIC.exe
Token: SeSystemProfilePrivilege	1328	WMIC.exe
Token: SeSystemtimePrivilege	1328	WMIC.exe
Token: SeProfSingleProcessPrivilege	1328	WMIC.exe
Token: SeIncBasePriorityPrivilege	1328	WMIC.exe
Token: SeCreatePagefilePrivilege	1328	WMIC.exe
Token: SeBackupPrivilege	1328	WMIC.exe
Token: SeRestorePrivilege	1328	WMIC.exe
Token: SeShutdownPrivilege	1328	WMIC.exe
Token: SeDebugPrivilege	1328	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1328	WMIC.exe
Token: SeRemoteShutdownPrivilege	1328	WMIC.exe
Token: SeUndockPrivilege	1328	WMIC.exe
Token: SeManageVolumePrivilege	1328	WMIC.exe
Token: 33	1328	WMIC.exe
Token: 34	1328	WMIC.exe
Token: 35	1328	WMIC.exe
Token: 36	1328	WMIC.exe
Token: SeDebugPrivilege	5108	MicrosoftEdge.exe
Token: SeDebugPrivilege	5108	MicrosoftEdge.exe
Token: SeDebugPrivilege	5108	MicrosoftEdge.exe
Token: SeDebugPrivilege	5108	MicrosoftEdge.exe
Token: SeIncreaseQuotaPrivilege	2028	wmic.exe
Token: SeSecurityPrivilege	2028	wmic.exe
Token: SeTakeOwnershipPrivilege	2028	wmic.exe
Token: SeLoadDriverPrivilege	2028	wmic.exe
Token: SeSystemProfilePrivilege	2028	wmic.exe
Token: SeSystemtimePrivilege	2028	wmic.exe
Token: SeProfSingleProcessPrivilege	2028	wmic.exe
Token: SeIncBasePriorityPrivilege	2028	wmic.exe
Token: SeCreatePagefilePrivilege	2028	wmic.exe
Token: SeBackupPrivilege	2028	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3252	y83fa94.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3924	w.exe
4656	LuckyWheel.exe
4656	LuckyWheel.exe
5108	MicrosoftEdge.exe
3996	MicrosoftEdgeCP.exe
3996	MicrosoftEdgeCP.exe
4620	LuckyWheel.exe
4620	LuckyWheel.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4272	4212	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe	66
PID 4212 wrote to memory of 4272	4212	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe	66
PID 4212 wrote to memory of 4272	4212	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe	66
PID 4272 wrote to memory of 4624	4272	zap9146.exe	67
PID 4272 wrote to memory of 4624	4272	zap9146.exe	67
PID 4272 wrote to memory of 4624	4272	zap9146.exe	67
PID 4624 wrote to memory of 4008	4624	zap1401.exe	68
PID 4624 wrote to memory of 4008	4624	zap1401.exe	68
PID 4624 wrote to memory of 4008	4624	zap1401.exe	68
PID 4008 wrote to memory of 1700	4008	zap2348.exe	69
PID 4008 wrote to memory of 1700	4008	zap2348.exe	69
PID 4008 wrote to memory of 4840	4008	zap2348.exe	70
PID 4008 wrote to memory of 4840	4008	zap2348.exe	70
PID 4008 wrote to memory of 4840	4008	zap2348.exe	70
PID 4624 wrote to memory of 5028	4624	zap1401.exe	71
PID 4624 wrote to memory of 5028	4624	zap1401.exe	71
PID 4624 wrote to memory of 5028	4624	zap1401.exe	71
PID 4272 wrote to memory of 3384	4272	zap9146.exe	73
PID 4272 wrote to memory of 3384	4272	zap9146.exe	73
PID 4272 wrote to memory of 3384	4272	zap9146.exe	73
PID 4212 wrote to memory of 3252	4212	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe	74
PID 4212 wrote to memory of 3252	4212	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe	74
PID 4212 wrote to memory of 3252	4212	84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe	74
PID 3252 wrote to memory of 3244	3252	y83fa94.exe	75
PID 3252 wrote to memory of 3244	3252	y83fa94.exe	75
PID 3252 wrote to memory of 3244	3252	y83fa94.exe	75
PID 3244 wrote to memory of 2468	3244	oneetx.exe	76
PID 3244 wrote to memory of 2468	3244	oneetx.exe	76
PID 3244 wrote to memory of 2468	3244	oneetx.exe	76
PID 3244 wrote to memory of 5104	3244	oneetx.exe	78
PID 3244 wrote to memory of 5104	3244	oneetx.exe	78
PID 3244 wrote to memory of 5104	3244	oneetx.exe	78
PID 5104 wrote to memory of 5056	5104	cmd.exe	80
PID 5104 wrote to memory of 5056	5104	cmd.exe	80
PID 5104 wrote to memory of 5056	5104	cmd.exe	80
PID 5104 wrote to memory of 656	5104	cmd.exe	81
PID 5104 wrote to memory of 656	5104	cmd.exe	81
PID 5104 wrote to memory of 656	5104	cmd.exe	81
PID 5104 wrote to memory of 928	5104	cmd.exe	82
PID 5104 wrote to memory of 928	5104	cmd.exe	82
PID 5104 wrote to memory of 928	5104	cmd.exe	82
PID 5104 wrote to memory of 828	5104	cmd.exe	83
PID 5104 wrote to memory of 828	5104	cmd.exe	83
PID 5104 wrote to memory of 828	5104	cmd.exe	83
PID 5104 wrote to memory of 764	5104	cmd.exe	84
PID 5104 wrote to memory of 764	5104	cmd.exe	84
PID 5104 wrote to memory of 764	5104	cmd.exe	84
PID 5104 wrote to memory of 528	5104	cmd.exe	85
PID 5104 wrote to memory of 528	5104	cmd.exe	85
PID 5104 wrote to memory of 528	5104	cmd.exe	85
PID 3244 wrote to memory of 3364	3244	oneetx.exe	86
PID 3244 wrote to memory of 3364	3244	oneetx.exe	86
PID 3244 wrote to memory of 3364	3244	oneetx.exe	86
PID 3244 wrote to memory of 636	3244	oneetx.exe	87
PID 3244 wrote to memory of 636	3244	oneetx.exe	87
PID 3244 wrote to memory of 636	3244	oneetx.exe	87
PID 636 wrote to memory of 1956	636	Tarlatan.exe	88
PID 636 wrote to memory of 1956	636	Tarlatan.exe	88
PID 636 wrote to memory of 1956	636	Tarlatan.exe	88
PID 3244 wrote to memory of 1760	3244	oneetx.exe	89
PID 3244 wrote to memory of 1760	3244	oneetx.exe	89
PID 3244 wrote to memory of 1760	3244	oneetx.exe	89
PID 636 wrote to memory of 1956	636	Tarlatan.exe	88
PID 636 wrote to memory of 1956	636	Tarlatan.exe	88

System policy modification 1 TTPs 20 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LuckyWheel.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	LuckyWheel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	WinSearch116.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinSearch330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{07209614-92A0-43F5-BCD7-3AAAD7F2090F} = "1"	WinSearch330.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\DisableAddonLoadTimePerformanceNotifications = "1"	WinSearch330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	WinSearch330.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LuckyWheel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{07209614-92A0-43F5-BCD7-3AAAD7F2090F} = "1"	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\DisableAddonLoadTimePerformanceNotifications = "1"	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinSearch330.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WinSearch330.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	WinSearch116.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	WinSearch116.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	LuckyWheel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WinSearch330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	WinSearch330.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WinSearch116.exe

C:\Users\Admin\AppData\Local\Temp\84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe
"C:\Users\Admin\AppData\Local\Temp\84a2338835f1f6fbe146ea92eaa6831d663e661166e95d66160d9e290e704385.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9146.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9146.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2348.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2348.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5910.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5910.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5243eQ.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5243eQ.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98cu46.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98cu46.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5028
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYhud40.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYhud40.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83fa94.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83fa94.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:5056
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:656
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:828
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c5d2db5804" /P "Admin:N"
        5⤵
        
        PID:764
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c5d2db5804" /P "Admin:R" /E
        5⤵
        
        PID:528
  - - C:\Users\Admin\AppData\Local\Temp\1000003001\123dsss.exe
      "C:\Users\Admin\AppData\Local\Temp\1000003001\123dsss.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3364
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\1000007001\Gmeyad.exe
      "C:\Users\Admin\AppData\Local\Temp\1000007001\Gmeyad.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:1760
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\1000007001\Gmeyad.exe
        
        C:\Users\Admin\AppData\Local\Temp\1000007001\Gmeyad.exe
        5⤵
        Executes dropped EXE
        
        PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\1000009001\WinSearch330.exe
      "C:\Users\Admin\AppData\Local\Temp\1000009001\WinSearch330.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      System policy modification
      PID:4200
    - - C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe
        
        "C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe"
        5⤵
        UAC bypass
        Allows Chrome notifications for new domains
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies Internet Explorer start page
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:4656
      - C:\Program Files (x86)\LuckyWheel\WinSearch116.exe
        
        "C:\Program Files (x86)\LuckyWheel\WinSearch116.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        System policy modification
        
        PID:3700
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\LuckyWheel\kill.bat""
        7⤵
        
        PID:828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im LuckyWheel.exe
        8⤵
        Kills process with taskkill
        
        PID:1696
        
        C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe
        
        "C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe"
        7⤵
        UAC bypass
        Allows Chrome notifications for new domains
        Executes dropped EXE
        Modifies Internet Explorer start page
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\1000011001\2023.exe
      "C:\Users\Admin\AppData\Local\Temp\1000011001\2023.exe"
      4⤵
      Executes dropped EXE
      PID:4860
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c "wmic csproduct get uuid"
        5⤵
        
        PID:1180
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic path win32_VideoController get name"
        5⤵
        
        PID:4160
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        
        PID:5032
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic cpu get name"
        5⤵
        
        PID:4796
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic cpu get name
        6⤵
        
        PID:792
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd "/c " systeminfo
        5⤵
        
        PID:704
      - C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        6⤵
        Gathers system information
        
        PID:360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiC\""
        5⤵
        
        PID:3220
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHctcuAx\""
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1864
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\hxKQFDaFpL\""
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4028
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfRsWxP\""
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4824
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\LDnJObCsNV\""
        5⤵
        
        PID:2124
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQleQYh\""
        5⤵
        
        PID:4064
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\YzRyWJjPjz\""
        5⤵
        
        PID:5052
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\pfRFEgmotaFetHs\""
        5⤵
        
        PID:2948
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\bZRjxAwnwe\""
        5⤵
        
        PID:1560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcEkXBA\""
        5⤵
        
        PID:3948
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\" \"C:\Users\Admin\AppData\Local\Temp\kjQZLCtTMt\""
        5⤵
        
        PID:4852
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\TCoaNatyyi\""
        5⤵
        
        PID:3908
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\History\" \"C:\Users\Admin\AppData\Local\Temp\NKAReKJyiX\""
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3220
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\JrscctNswY\""
        5⤵
        
        PID:4224
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3948
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell "" "copy \"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\History\" \"C:\Users\Admin\AppData\Local\Temp\NsGRussVma\""
        5⤵
        
        PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\1000012001\w.exe
      "C:\Users\Admin\AppData\Local\Temp\1000012001\w.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\1000017001\tmpBEB8.exe
      "C:\Users\Admin\AppData\Local\Temp\1000017001\tmpBEB8.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5076
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000017001\tmpBEB8.exe"
        5⤵
        
        PID:3544
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4512
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:4660
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      PID:3680

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5108

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:928

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3996

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:2848

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
PID:1300

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LuckyWheel\ADSSTrayPopup.dll

Filesize
55KB

MD5
c2dbf757b8ef1089b85bb590b2f2b8b5

SHA1
d6ade7b6887a573a432afee7ae17491ab8a2dc02

SHA256
5d6b7052747b918e5480013cecd6c97ba5cc5a895caefa1bbff0e35113f8f911

SHA512
d3a06721e416119324aa2d4da481027806a00739b0d9cd2ec318d1a50c0621a4a43db9822cf6089ec983ed57f8f30f75897184bcc3d9bc9a221d5f07b22c6f3c

Download Submit
C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe

Filesize
67KB

MD5
7d3fcee3e23ab6a32a53f50a15b32991

SHA1
4d4b1180638df91a89e19eae594b9cc70acfbee5

SHA256
b978267773a40ffd7cd7bea8955f1a3f498f4480e285e95544e8a51324998b04

SHA512
2390c1061d112e236a6a852d0bb5ec144b5dc183b48c20ef4a9cd5e43872f79470960bf846e3fa8811c0bfb8637b712a1a67645a3c2394d39189a16b9d465b41

Download Submit
C:\Program Files (x86)\LuckyWheel\LuckyWheel.exe

Filesize
67KB

MD5
7d3fcee3e23ab6a32a53f50a15b32991

SHA1
4d4b1180638df91a89e19eae594b9cc70acfbee5

SHA256
b978267773a40ffd7cd7bea8955f1a3f498f4480e285e95544e8a51324998b04

SHA512
2390c1061d112e236a6a852d0bb5ec144b5dc183b48c20ef4a9cd5e43872f79470960bf846e3fa8811c0bfb8637b712a1a67645a3c2394d39189a16b9d465b41

Download Submit
C:\Program Files (x86)\LuckyWheel\Newtonsoft.Json.dll

Filesize
690KB

MD5
83e3313df014651adfb8fc9494975270

SHA1
6aed239bd75573f3a7f3ab90743f732ac33729af

SHA256
fcc1838f46585bdb44ea2595a7e4fba1a6e120486967949e2f073a806d2d7e97

SHA512
646c13b450b2fa226312f76d041c402f6989d365dc6bcd9b71a76394e99f33efb28460adf576401ab8823e198e4d72ce47faebe3953fe4121d43fa8bf3640c46

Download Submit
C:\Program Files (x86)\LuckyWheel\WinSearch116.exe

Filesize
1.3MB

MD5
f87cbc52e8908b2a3e397f141198d8ef

SHA1
6b03aeb3ece617e463e879f78e04f4d8ff3fa9bb

SHA256
4e09de29dce4b1fcbf2f83678bbebeda2d74cf95a3347ceea4d75c533135762a

SHA512
30a4b1798808ad7ea1ea09a174d70f0929541953a7f8ab8c5722d7da6185c90a3e869e9e8866d770eac1ae06ae2b017bd307be347c7a811bf5b427be30de4853

Download Submit
C:\Program Files (x86)\LuckyWheel\WinSearch116.exe

Filesize
1.3MB

MD5
f87cbc52e8908b2a3e397f141198d8ef

SHA1
6b03aeb3ece617e463e879f78e04f4d8ff3fa9bb

SHA256
4e09de29dce4b1fcbf2f83678bbebeda2d74cf95a3347ceea4d75c533135762a

SHA512
30a4b1798808ad7ea1ea09a174d70f0929541953a7f8ab8c5722d7da6185c90a3e869e9e8866d770eac1ae06ae2b017bd307be347c7a811bf5b427be30de4853

Download Submit
C:\Program Files (x86)\LuckyWheel\kill.bat

Filesize
30B

MD5
15e2ed3ab4c99d3cab04532e923c85da

SHA1
147ff9bdd2a93759c29ce24bab481f0492e6f541

SHA256
76ec73a707730af163da250eee9dfc02038ee1f3f915f03193af562eced3762c

SHA512
38c727f52d324dc047da4c0a59cff98076c6c7f7f2db4c12b74f98cd4e41c08f34b9e3396a562aff77d610589e2a667724e7d242e82cf99d5a2fd3ad8392318b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA

Filesize
2KB

MD5
b57a0017eb747d34a7c9938dfc1d222e

SHA1
92722ad5e47b32f5dfb4a5f007e359df7a5aa01d

SHA256
b3b47edcf84138941a66ad4a2ca976e2289887b3e8b7de1e86cbc2f3eef45e80

SHA512
f4379b9599f4e075a20d8fd47ee523c0eab77eba8dfa80a90f1c598c877dced5b5eabb7f7d74cdb3a1c0c6fadbe4f2ebf9195507707e16c8764dfe1f48a63840

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
1KB

MD5
c9b544e2052cd98b6aafd9d729aa61ba

SHA1
c12311f7a380583af93ba7f0d9054a76e5cd3b70

SHA256
3584cdcef0dc28d4bde6a5d5961af97da9bd7e4755b5d2bf424bdb28dfbe66c9

SHA512
9d94cbc2d04f9bc875b716d7338756d77bbb17d3d94f0c2f42e12736f8970ba51f5740619b728a9aff48cd3012d49783dc23a19b429196f67687ef0cb7f0fe2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDA

Filesize
482B

MD5
4d4db152c065f770df662774f7e4acf0

SHA1
9384558ef99d3dbc3509fa614576a7a0a0827c38

SHA256
6211158efff3b6167d276446a54b16fee1af2f865278fc8d183a4bf8632cc0b4

SHA512
8e70cc9ae76f073f664ad29bf3f63eb649d42bf6333d353f63cdf01c220b5a834a46bcab8c37fee9821d0d7de72995b2bf891cf36ec0c7570d23cfde9324b3e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691

Filesize
486B

MD5
407fc362c597802edf0423bb81234d07

SHA1
172ec44db95eb94dda91099a6fba121efe58d62a

SHA256
dd73bf123b05dd00df95c1001e94a4cb977c3727066696bf3f8b36b6be66ad07

SHA512
ac26ea4bfed9f144722d02ea86752f7a83c89f11412f5659feceab7ffa9429d086dcba023dd470ff06ecc1552b628f6e0ded8e94e9c55dc37b5134232ba32950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Tarlatan.exe.log

Filesize
1KB

MD5
be1788135df70eb012f684bc8237162a

SHA1
b2e0403661c14563fd48d8bb0d41ae2bcfbf3d36

SHA256
88138ab6e758402a1a8c6c0249d7b8df1c1c47c5f9363b870cd4c23a45806506

SHA512
1a7c633e2492066b1dae1bd90402e1345397dba876e955400c84eda6dfde0894b098487235ee5d096aae6cfc66cdefcf649c6484b669bcdbc85059ed9e8ca2a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FLQISSZ5\common[1].js

Filesize
1KB

MD5
d71b75b2327258b1d01d50590c1f67ca

SHA1
b7820e4ffb6becc133c48f66d9f683545530b959

SHA256
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

SHA512
1a1930881b4d4d4f092999d6449248aea68bf1756f6dc32a4efce5e7bf240a14633e76988321e5aa3e11144fe5e8c9a443adf0fbf09a9b57a98c4d2d3a9347a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FLQISSZ5\css[1].css

Filesize
249B

MD5
681bda9528017271792bb3998092c4ca

SHA1
fd66cc58da05fcc31b83505ce32867e8b0cb655b

SHA256
1a6fa2af545ed462d498c05fc14e1e33eae06b2ecbe649b4de0f35e3332ac75f

SHA512
cb2207eb5d5bc24b9f9b08e419268724337f9f64ba3d64d13bfb2542f4a8065f5384d1c3bb7e3dd4cfe4cae4ecdeba24fe71571953066b77a417b7e490cff1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FLQISSZ5\custom_front_js[1].js

Filesize
627B

MD5
d319a9e8821b373ed2a7c5f1f62fa1e8

SHA1
4e5acae56faa11c4d4520d01a2fc98a3cbf27f32

SHA256
3ec2b6a2a8ecb48edcb2ff4566cb30c1f783204ef104eb992e80476f53a4ebfb

SHA512
1bc480627d263c1e2f363292c7a84ed63cacaa97a870992a73cdcd9329a8a5067dd5838b899db4a58d25e06c8526fad5a26160daf102a7d8f9e104a87ac5dbce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FLQISSZ5\memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4uaVY[1].eot

Filesize
23KB

MD5
76c4b4ee05970e8dc317db8e73c41814

SHA1
28d3ef9aa6695aefb636e29d180188c4a68d513f

SHA256
426af60a49729de9da02ada71b2f0f652ea8fd0a21e78b0aea227753986faac3

SHA512
ca0f79d7e3c0af9bf0a6e2d2eeca86393aa285b61932cebf292461a9eb518caf276e7802aa1b6c7ef6d2ebb02b1f43f3d0580691fd85b7e071cb553caad76c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FLQISSZ5\scripts.min[1].js

Filesize
267KB

MD5
8e84adf3d9e5509fa623deaf84bd03e1

SHA1
a9c6471179438788f477737ab4e60848e17a7a8b

SHA256
97490bd354a26885acf09c0ba5b4c3c76d12bb55193f13456d3aa2ded6eda6fd

SHA512
42d2ef4b314485098b3eaae334f4b0fd8791e90a0d45b127b082be54db6ca11933b12c95d70844fa74005265e618e229c8727fd562bec3eeb09dfaf4078b579a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\advanced-page-visit-counter-public[1].js

Filesize
1KB

MD5
af89230225ec9bdf1e9910eaaafbb8da

SHA1
4182c41d9f965b8713a18a3f7b3ceebcd78b6979

SHA256
7c350e47d7879cde514d71f336da5ea75e994e108315f16f048607a33243575b

SHA512
e8aaea6a1258bf829e21f3ecd1c78d21fd55751a8a680e2fc9eb25aa6e5ea7db4851d31381608d2b81a64ed24aa0f6283489f0a2e28b0add9e64c3603159c051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\ckeditor[1].js

Filesize
679KB

MD5
79140d05a10f72f4d5b222c87868005e

SHA1
1cfe7556746b0f6009923b3bde4f4411893d4d80

SHA256
932c19b0592bb2a9aabc924ecf5fcb02dfea087d21b8bc3d09dfffdd0b62305d

SHA512
a2797eeddd60bb5931110ff5b2b09109bb9fd7829e9579e6ec559a53e0b5ad65ca38a46bb46204552db6df45b94475b3a1ce38b6e52ed866e5a5b67105c764e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\jquery-migrate.min[1].js

Filesize
13KB

MD5
5cfa2b481de6e87c2190a0e3538515d8

SHA1
0fccf3c8ab2c10b4dcc7970e64ce997ab1622f68

SHA256
9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3

SHA512
51c4c1dbaf330ea0f6852659cb0fe53434f6ed64460d6039921dd8e82f7a0663eebfb7377dc7e12827d77ff31a5afee964eea91da8c75fa942acf6d596ef430f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\jquery.min[1].js

Filesize
87KB

MD5
0e850a69bc7fd0acc2e92ce6eee87959

SHA1
8be6d9e7f7a61ccf0b8eac8a8144d770b608a19c

SHA256
afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a

SHA512
0f8a4fb2ea15a93290778a55c701208c9245193d8c910f47f26bb245b0a3f6d6d91427a1857f98c3632bc3feec5c0b83517b46c1fa1817bc3bb33b5ccb9a11e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\smoothscroll[2].js

Filesize
5KB

MD5
b6a40b8c22e5dd0e51404ac7aa45710a

SHA1
823e4b015387a2714f826a7f386a0f6698c4b6e2

SHA256
75079f39fe739015589a0f995f41b4c1c29d4ebac85c93a792926af09f61cc83

SHA512
0efaf2570d7284e021ee0e37d3f25ec594d6dba246cc7912bfd30c796e667bfa84f10c7f2ceb2fecb45499b0ad3b29e90e3aff8cbddcc72e31da83449bc3fac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\styles.0c7644074bcd8432[1].htm

Filesize
9KB

MD5
c8fd57543d00cda82ee160a5e1f6bb74

SHA1
5d5bcde25dc57b9e8fbde640f57fdb22d44f3d65

SHA256
4cc41264be979d3566aade1c6dda81c0ee714f0cd3f951c44819cddd3ed2e1df

SHA512
f2278e3ffee0c972167d69e9f2563902e5ef109050e01ade36d9230c87ba971bc15d4cdcc2acd9a77edff0ccd09b1ff5ade14d50eb83bdf3b96544b35e24cb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RIZDY293\js[3].js

Filesize
241KB

MD5
fa9fdedb694b9f7e5ec2a4c59b7b5936

SHA1
2d446c4c872cab22b0cdffc1f2e36496df0a4262

SHA256
ecbe1ff18b8007befdea4bbb7b60175174003ef33eb8bc9dcacc07ffb393bffb

SHA512
3e8ea932f33da488148c3cf139f90938ba89d521ebf6140a95a1b0b018546133b689dfffb76118b70f11d9627cd07de25cd34c1a9a0e3d8b6792daf47f1b1c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RIZDY293\style[1].css

Filesize
10KB

MD5
94fb21b6f10fee49c6a92c96fd4bbf0d

SHA1
53db8486ea8569b6f6891ac0c6af64b0395fa483

SHA256
f682ae3eee3fd039b0916ecf6239f92ecc89c65d2cdc2389e3fec3743dc67f6c

SHA512
069177dc43e30c1e9f97fb4faf3970ec5c3b6015c093106be8f7d05df0d960ebe87182227cf077b108ddc68f7d49999dc70d3ad38fcdd9e1891fffa47787911e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZJB0AHXO\777-2[1].htm

Filesize
186KB

MD5
5da21191c1db0a4c8617a0a93cddef4d

SHA1
e47e3d250b4327141de8f2077c91a4c02c552a55

SHA256
43467cc7879819d589856b78f36bd7b6cfa05578ba8b1618cf419ee986e59fe3

SHA512
ab83c2d37ce57a81884340b750fe5974634d078956c85838cd62764c5365ec1aa36093f3cea6690e31e651736ff83ac1415327e4517030bbb629293257defa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZJB0AHXO\advanced-page-visit-counter-public[1].css

Filesize
476B

MD5
309cba72a6381e21bd44223e5f7eeb73

SHA1
d68433d3cc20602a7f8f1de89da48987acd89dae

SHA256
2a3ed0a7668b482b21834f8faa200587b778a44a03650846517a7b3ab30b214a

SHA512
8e424a6a9609258f59980b1d8a075371825597513b2878a12f84457f5da86135f2507a7fe4e0b6a8de9a19af7d68fc36afafddec022e680d85a9898c2317dec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZJB0AHXO\wsm_new[1].js

Filesize
23KB

MD5
c787799b2620cb166db9fbc859f19182

SHA1
68880f237d0ea1625c5ddd4e5247498af1552bd0

SHA256
7883c3cfb3f71df2ec3c0574dd83d0b6849a12248b6b9142ea99752636310a47

SHA512
434cdcbeda1eb8d9f121ed468ef01843c6de605b13dc97ea05d906014e5ed048413e39fa288cb53712fa76e10b91801569f98fe395ca1469d271b1077079f60a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5TA7J3YQ\f[6].txt

Filesize
404KB

MD5
c0c7fa2ac282532848cfe62319ce365b

SHA1
d51b7a88139cc57b5315baf418ca1432263d15a9

SHA256
a68816f155e444eaf37147285db65f4cad64c01ef786d173a11630a96af7003b

SHA512
9754f957decf52e79489bfb9d6cae94652d9f0edcea6928e23dc68d930339fa408aa1f260a18197b447636f5463c2ed60a94568ca255c0ad10775f8fe9d2805a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5TA7J3YQ\f[8].txt

Filesize
107B

MD5
d9c47f48660b656705d0ff86fc850de8

SHA1
bceb9478f69cdfc2eb87ae6b80e95dbaac8b6769

SHA256
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

SHA512
0cde289ead00bd9b3bdd614fec5b5eb132fdd0d9eef5136f7e6ea0081f7d8dbf8144ee90067c8c25c4547fac4adc8fea1b028930c9edcf023151758bf6671d6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TDAYCYOG\YzZmA7a08v9f087fwqUDZorL-7TBHmPOgPW1cUS8ffQ[1].js

Filesize
36KB

MD5
dbb710f6c9ba626ac75dfd4f119688a9

SHA1
aa46b7eb8e4f71b210ad2c30c6a5417656c0ee70

SHA256
63366603b6b4f2ff5fd3cedfc2a503668acbfbb4c11e63ce80f5b57144bc7df4

SHA512
55484d1d6a66e2aac474a58dc5c0d94ad91e7f4da5bfa25d8438da0714d19cb819576cffe27c2d6bb79a6c06fe388188d2a776c44522638cde4d2c96775448b8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TDAYCYOG\js[1].js

Filesize
228KB

MD5
d5b8552166f64eebcf402fd0dd4ae3d1

SHA1
67664e93b1db9fb729161ecc3d14e5b45d71b2c6

SHA256
fe5904e44c7e473a365b5866f31307004702a1f46f483055597349b1729e72aa

SHA512
b8c1beb8f894d284b8ed052fb8ca616fdf84fb89392090d4ddbc4a3255ab0c18621ab497faeeca7208d6d993516cb9ef14d96b418faa5edafb9396e8327d6370

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U7Z86JF5\et-divi-dynamic-2036[1].css

Filesize
81KB

MD5
c71f8105e8845d6a66af89ed6c7e6dd1

SHA1
45251024ab0d3512d2de6e7e22a8d9f2dbafee70

SHA256
4bd705411d095dd9943d00d17aa63d873fef2e6aabf94786d58bb05633915fb7

SHA512
a991cc86418004e66d74808fc8035ab1a768d10ce6b41a9b3e3575b8ba5826ae012f7ccef9c4609b35d9d5bcb76498b8701a5e0adbcd30f173b516d22158f5c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WXWQK2LX\f[2].txt

Filesize
161KB

MD5
152c699827580fbf2dc5655ab54f25b0

SHA1
3e67cb6e633fcc54dfefc52b4502663f036285ed

SHA256
0e530c0bc0d43f7997af502fedb073cc2968777441abe63bb405a4a5313b4f87

SHA512
93db91d66dff3f8684bbd1de177b65d47db62009f055c3b66036fdbb2cca898cb4812955a9d523caf62602b2b95cbf295d87f219da56c197e1949e091de40f93

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\WXWQK2LX\js[1].js

Filesize
115KB

MD5
1eddb500400cb002271e7f76c26ee0b2

SHA1
6b92ea4961901f9e5e00441e1d8df74a593dc64a

SHA256
660b216ade299a29ba5a13eba24ef814c3ad0923d4f1b4834988e74bc010c8a2

SHA512
9e10318ee4d28d8738f97ae2b6fb5fcd6ea0e7109a463f622ca6256467c874222af8a40a672f65d5310293926ae298cbb20904fbdc711944d850fa87bde34957

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\XA5QM3I8\zwoops[1].xml

Filesize
100B

MD5
d0049980def736645b381aec8d997827

SHA1
6e923a67333e513362af26ee4b971ae01987223e

SHA256
1ab00f99be4c1cafe74aca872db71b8e9a4b922211bd7240cc349aa17ea8c4d7

SHA512
039d0e705f22035e75944980f82ed84002d88b0e8c35e8f529b58889da13b97ef7ed55363fb253a067e7196a6e9801f8aaa2d18b360e6b466688f79dede97de3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\2UF6FR4B\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\ZGYCGPI2\cropped-zwoops-transparent-2-32x32[1].png

Filesize
2KB

MD5
3ec0a1b329173434242062d31dc6636e

SHA1
6cc73580dd131b532fd7ce56b284bf79e8804dd4

SHA256
819db17f88ce7a568b56dc5f06199bff502274d87e4c20969b3c7ad5a920e2f7

SHA512
1609a5f712f795ac1c33fd827bc461edef04ec9c1dca484ccb978fbe6dbf639b61d4e24a1a28a6419947efbf87d429111c0db74df3f53f4148393ae520728a39

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\Windows\3720402701\2219095117.pri

Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\123dsss.exe

Filesize
175KB

MD5
20b01b94fec9143a2adf624945aa41c3

SHA1
3e3690bb58b1a42cea254a0eb039019c7ebbbf3f

SHA256
97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9

SHA512
52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\123dsss.exe

Filesize
175KB

MD5
20b01b94fec9143a2adf624945aa41c3

SHA1
3e3690bb58b1a42cea254a0eb039019c7ebbbf3f

SHA256
97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9

SHA512
52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000003001\123dsss.exe

Filesize
175KB

MD5
20b01b94fec9143a2adf624945aa41c3

SHA1
3e3690bb58b1a42cea254a0eb039019c7ebbbf3f

SHA256
97a489a4b544ec0c4cd80ec7fba849e66e1f14a89733e23e2f56e29eb77ad2f9

SHA512
52b85eefceaf3589b34d831521f27517e6496cc9f26b6a05016b6df348211369a69c3c794af7ba245f2b161fdd2f7d28e1056185ffbf72384991680fd8e15a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe

Filesize
897KB

MD5
b26480dce772642635204619f30c35d6

SHA1
7693a39461090bde35919ea4f6652955f5159a47

SHA256
20f9eb4bd36001f8c3c80ad01078221bb823b2846a00c12549f77f07ef5498ec

SHA512
f03b9ef6e79234e53ce5933525003d0c1380f5452cc676d04de8a4092c32f69cec0dff58c0bf47739faeebadfed021963326bdbff4de05f27d4cb23831563641

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe

Filesize
897KB

MD5
b26480dce772642635204619f30c35d6

SHA1
7693a39461090bde35919ea4f6652955f5159a47

SHA256
20f9eb4bd36001f8c3c80ad01078221bb823b2846a00c12549f77f07ef5498ec

SHA512
f03b9ef6e79234e53ce5933525003d0c1380f5452cc676d04de8a4092c32f69cec0dff58c0bf47739faeebadfed021963326bdbff4de05f27d4cb23831563641

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe

Filesize
897KB

MD5
b26480dce772642635204619f30c35d6

SHA1
7693a39461090bde35919ea4f6652955f5159a47

SHA256
20f9eb4bd36001f8c3c80ad01078221bb823b2846a00c12549f77f07ef5498ec

SHA512
f03b9ef6e79234e53ce5933525003d0c1380f5452cc676d04de8a4092c32f69cec0dff58c0bf47739faeebadfed021963326bdbff4de05f27d4cb23831563641

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\Tarlatan.exe

Filesize
897KB

MD5
b26480dce772642635204619f30c35d6

SHA1
7693a39461090bde35919ea4f6652955f5159a47

SHA256
20f9eb4bd36001f8c3c80ad01078221bb823b2846a00c12549f77f07ef5498ec

SHA512
f03b9ef6e79234e53ce5933525003d0c1380f5452cc676d04de8a4092c32f69cec0dff58c0bf47739faeebadfed021963326bdbff4de05f27d4cb23831563641

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\Gmeyad.exe

Filesize
3.9MB

MD5
a8001f151c1ce13aac56097a2bf1f789

SHA1
414d9f4219570bc75eb6e6cf2932c4fb407afa56

SHA256
7fb411ee3e34e4b79b372b7d2321bf69b46de30c3286edccb7621562caefb60b

SHA512
9c20f91c378d9559f6e5115857401def02145bb665a4c64f7842175b077bb6406544caa8197c9713f9b22943ffd87405beb809cf0e684c53b934acfe8d421060

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\Gmeyad.exe

Filesize
3.9MB

MD5
a8001f151c1ce13aac56097a2bf1f789

SHA1
414d9f4219570bc75eb6e6cf2932c4fb407afa56

SHA256
7fb411ee3e34e4b79b372b7d2321bf69b46de30c3286edccb7621562caefb60b

SHA512
9c20f91c378d9559f6e5115857401def02145bb665a4c64f7842175b077bb6406544caa8197c9713f9b22943ffd87405beb809cf0e684c53b934acfe8d421060

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000007001\Gmeyad.exe

Filesize
3.9MB

MD5
a8001f151c1ce13aac56097a2bf1f789

SHA1
414d9f4219570bc75eb6e6cf2932c4fb407afa56

SHA256
7fb411ee3e34e4b79b372b7d2321bf69b46de30c3286edccb7621562caefb60b

SHA512
9c20f91c378d9559f6e5115857401def02145bb665a4c64f7842175b077bb6406544caa8197c9713f9b22943ffd87405beb809cf0e684c53b934acfe8d421060

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\WinSearch330.exe

Filesize
1.3MB

MD5
f700265edb6c2500e9524567708311ff

SHA1
a41d5791eb1337a1eb7cb5e7f4d19e58527491bd

SHA256
9dffd674f59f033d47fa79136a2d4dafe4973345f8f669d5a98fc23f5bf267f7

SHA512
367059d7399d088d7a21056e95401047f090cf6c3aee99392e8d4f466a78c8ff1db4ba3a9e9c2e73ed4429e60c9f47450cf802919ecd1178410ba9990e2f2da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\WinSearch330.exe

Filesize
1.3MB

MD5
f700265edb6c2500e9524567708311ff

SHA1
a41d5791eb1337a1eb7cb5e7f4d19e58527491bd

SHA256
9dffd674f59f033d47fa79136a2d4dafe4973345f8f669d5a98fc23f5bf267f7

SHA512
367059d7399d088d7a21056e95401047f090cf6c3aee99392e8d4f466a78c8ff1db4ba3a9e9c2e73ed4429e60c9f47450cf802919ecd1178410ba9990e2f2da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\WinSearch330.exe

Filesize
1.3MB

MD5
f700265edb6c2500e9524567708311ff

SHA1
a41d5791eb1337a1eb7cb5e7f4d19e58527491bd

SHA256
9dffd674f59f033d47fa79136a2d4dafe4973345f8f669d5a98fc23f5bf267f7

SHA512
367059d7399d088d7a21056e95401047f090cf6c3aee99392e8d4f466a78c8ff1db4ba3a9e9c2e73ed4429e60c9f47450cf802919ecd1178410ba9990e2f2da5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000011001\2023.exe

Filesize
3.1MB

MD5
027a60b4337dd0847d0414aa8719ffec

SHA1
80f78f880e891adfa8f71fb1447ed19734077062

SHA256
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168

SHA512
009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000011001\2023.exe

Filesize
3.1MB

MD5
027a60b4337dd0847d0414aa8719ffec

SHA1
80f78f880e891adfa8f71fb1447ed19734077062

SHA256
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168

SHA512
009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000011001\2023.exe

Filesize
3.1MB

MD5
027a60b4337dd0847d0414aa8719ffec

SHA1
80f78f880e891adfa8f71fb1447ed19734077062

SHA256
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168

SHA512
009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000012001\w.exe

Filesize
16KB

MD5
c200ea136a598e37eb83c8c6031b3f29

SHA1
51ff8101eea8d51a6178635ed26c19678a3d8aa3

SHA256
3b04548e24bcb504a04734a24d47d7f880ca12c5575478d823d27020aea721f8

SHA512
14cc2786c2cb7f7ab87dcb180be9e6962d833c9622aa8facf73b65fd2cf0ccd6ce8bde894cd9dcfef225f9290203fe429007f9e722a2602ecc5ee9bc6e869fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000012001\w.exe

Filesize
16KB

MD5
c200ea136a598e37eb83c8c6031b3f29

SHA1
51ff8101eea8d51a6178635ed26c19678a3d8aa3

SHA256
3b04548e24bcb504a04734a24d47d7f880ca12c5575478d823d27020aea721f8

SHA512
14cc2786c2cb7f7ab87dcb180be9e6962d833c9622aa8facf73b65fd2cf0ccd6ce8bde894cd9dcfef225f9290203fe429007f9e722a2602ecc5ee9bc6e869fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000012001\w.exe

Filesize
16KB

MD5
c200ea136a598e37eb83c8c6031b3f29

SHA1
51ff8101eea8d51a6178635ed26c19678a3d8aa3

SHA256
3b04548e24bcb504a04734a24d47d7f880ca12c5575478d823d27020aea721f8

SHA512
14cc2786c2cb7f7ab87dcb180be9e6962d833c9622aa8facf73b65fd2cf0ccd6ce8bde894cd9dcfef225f9290203fe429007f9e722a2602ecc5ee9bc6e869fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\tmpBEB8.exe

Filesize
36KB

MD5
5aa405d35131a36ce1647c6937d3e529

SHA1
aaa19a9fa3652a1d39509aac28d3db7b95d276a2

SHA256
b47f96ba63f6861ef3d07ef0bc62d99ce4bd809c79a3121cc3ed18bee2a51358

SHA512
58e9615b9ca6bb0cb41b2f14201972ddb00b2f0be25d92460cd8a92128d4861df1a18cf3f8cf578fba3c8873c11e6a6b15c17968fc6beb58ce8812885d2c412b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\tmpBEB8.exe

Filesize
36KB

MD5
5aa405d35131a36ce1647c6937d3e529

SHA1
aaa19a9fa3652a1d39509aac28d3db7b95d276a2

SHA256
b47f96ba63f6861ef3d07ef0bc62d99ce4bd809c79a3121cc3ed18bee2a51358

SHA512
58e9615b9ca6bb0cb41b2f14201972ddb00b2f0be25d92460cd8a92128d4861df1a18cf3f8cf578fba3c8873c11e6a6b15c17968fc6beb58ce8812885d2c412b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\tmpBEB8.exe

Filesize
36KB

MD5
5aa405d35131a36ce1647c6937d3e529

SHA1
aaa19a9fa3652a1d39509aac28d3db7b95d276a2

SHA256
b47f96ba63f6861ef3d07ef0bc62d99ce4bd809c79a3121cc3ed18bee2a51358

SHA512
58e9615b9ca6bb0cb41b2f14201972ddb00b2f0be25d92460cd8a92128d4861df1a18cf3f8cf578fba3c8873c11e6a6b15c17968fc6beb58ce8812885d2c412b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83fa94.exe

Filesize
236KB

MD5
d3c2fc16b8c03725ad4e76a8a7bd49fe

SHA1
899bf59c4ecee4b306eb383493e96fa27fac8939

SHA256
065f537399534d8f62168e6633b843632fa8bedb9871f47f6224d0be9e55160c

SHA512
36117a42c9a5fbace5d0fea4271c8346ab0738e2bdb055fb0ae25423aa81b64ffeaca38fa6a3378d3d0bb1060081dcac4a09baca5952b5263a1748781879d2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y83fa94.exe

Filesize
236KB

MD5
d3c2fc16b8c03725ad4e76a8a7bd49fe

SHA1
899bf59c4ecee4b306eb383493e96fa27fac8939

SHA256
065f537399534d8f62168e6633b843632fa8bedb9871f47f6224d0be9e55160c

SHA512
36117a42c9a5fbace5d0fea4271c8346ab0738e2bdb055fb0ae25423aa81b64ffeaca38fa6a3378d3d0bb1060081dcac4a09baca5952b5263a1748781879d2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9146.exe

Filesize
806KB

MD5
a996c8624d43a0ac218ccc8824914496

SHA1
0baa9f85bddf6aca9645c94b2350ff700af72631

SHA256
8dc1e92dfaeb44700b51bdad6f4f4b62b3e58aff0c46dbed6de02a2476f58320

SHA512
59f96111e5fa03f3acc6c3cad48c73598cf7545d1d62be6ec13cbbf6ff7b266ec48b25ead886568b2091d6512a74cd99814387b1b1de5d261ca30533099ce964

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9146.exe

Filesize
806KB

MD5
a996c8624d43a0ac218ccc8824914496

SHA1
0baa9f85bddf6aca9645c94b2350ff700af72631

SHA256
8dc1e92dfaeb44700b51bdad6f4f4b62b3e58aff0c46dbed6de02a2476f58320

SHA512
59f96111e5fa03f3acc6c3cad48c73598cf7545d1d62be6ec13cbbf6ff7b266ec48b25ead886568b2091d6512a74cd99814387b1b1de5d261ca30533099ce964

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYhud40.exe

Filesize
175KB

MD5
f56aaf413add45814f78b3e59b45409b

SHA1
3a864fe72495b0e2fc0a58b2c9cc96176722aea6

SHA256
ea5b796585319f3e79688441a07fe653e23cb909c2924c7742b0684daedfc0b3

SHA512
c494b944751c18889325bf03c80ad794385836c4ea61713119c6b7b243874c709fe3bd1808c135376049b2968be87133119989aaa3881fa46d47abc140eb19d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYhud40.exe

Filesize
175KB

MD5
f56aaf413add45814f78b3e59b45409b

SHA1
3a864fe72495b0e2fc0a58b2c9cc96176722aea6

SHA256
ea5b796585319f3e79688441a07fe653e23cb909c2924c7742b0684daedfc0b3

SHA512
c494b944751c18889325bf03c80ad794385836c4ea61713119c6b7b243874c709fe3bd1808c135376049b2968be87133119989aaa3881fa46d47abc140eb19d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe

Filesize
664KB

MD5
6616a4cfea85b36f6efdae61acfdb79e

SHA1
a2bb05bd1ce68548e090e54789573f3c5e1a7510

SHA256
d65c85f9ab2306575ff3d5fcdd84d17eb802efb32c4bac40085e565edfb79afc

SHA512
4598ce249119615c0f548cc6aa90ad365ed31853a3ad9d901fa503edfa8b7c830dd3402924d560d0100302c6915d547a8d7da7c50bc0d84f85bbe4861ee8f2dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1401.exe

Filesize
664KB

MD5
6616a4cfea85b36f6efdae61acfdb79e

SHA1
a2bb05bd1ce68548e090e54789573f3c5e1a7510

SHA256
d65c85f9ab2306575ff3d5fcdd84d17eb802efb32c4bac40085e565edfb79afc

SHA512
4598ce249119615c0f548cc6aa90ad365ed31853a3ad9d901fa503edfa8b7c830dd3402924d560d0100302c6915d547a8d7da7c50bc0d84f85bbe4861ee8f2dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98cu46.exe

Filesize
335KB

MD5
d25fbc6a7e3a5b7fb649d7afc3ea7569

SHA1
7c10da727ce2323bc3fe499343d957184c96c7db

SHA256
230ce2bf57d840a1fdbc2dc27de72ffd0f6650da2f14d3b57674ae2c6edcdd38

SHA512
ab8d2e547024bd546ece637e5f76de5c076c732bd73d5ce4c24613d8a0726c0822df898d3e7219ce540775eb808dd070d22170c674e1eb893dc89adc84ede184

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w98cu46.exe

Filesize
335KB

MD5
d25fbc6a7e3a5b7fb649d7afc3ea7569

SHA1
7c10da727ce2323bc3fe499343d957184c96c7db

SHA256
230ce2bf57d840a1fdbc2dc27de72ffd0f6650da2f14d3b57674ae2c6edcdd38

SHA512
ab8d2e547024bd546ece637e5f76de5c076c732bd73d5ce4c24613d8a0726c0822df898d3e7219ce540775eb808dd070d22170c674e1eb893dc89adc84ede184

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2348.exe

Filesize
329KB

MD5
68b5bc810e39b60167fb54ff06a1e09a

SHA1
bf12121ceeb55437d8699a045708dfd45e8d7dca

SHA256
f5086286ae7e56996cf2f5304f9b57dff226029057d5da9c7c10242f5cb5ebdd

SHA512
45cbbf76e62606c6a64212f63379c420369754c15ee94b217fe28292eea12efb0a250d21519a20b9a53e21a7381418159b95b7749149432e73efb59083c955b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2348.exe

Filesize
329KB

MD5
68b5bc810e39b60167fb54ff06a1e09a

SHA1
bf12121ceeb55437d8699a045708dfd45e8d7dca

SHA256
f5086286ae7e56996cf2f5304f9b57dff226029057d5da9c7c10242f5cb5ebdd

SHA512
45cbbf76e62606c6a64212f63379c420369754c15ee94b217fe28292eea12efb0a250d21519a20b9a53e21a7381418159b95b7749149432e73efb59083c955b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5910.exe

Filesize
11KB

MD5
38468f20077497f19917c25c240f2bfe

SHA1
94e25aa44db30743698cb2bcf35630dfb66fcac7

SHA256
81fb14242cff642dd494c50ebb5b6b327e6c6c8c5e019d7c8dc688c94642cd1f

SHA512
763b942272071f1c31358dbbff9578a50429b702b12cdf40cc5bda8a041913f468706c4f9944666583693e649d47f83222aa0352ca03852327339c172face571

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz5910.exe

Filesize
11KB

MD5
38468f20077497f19917c25c240f2bfe

SHA1
94e25aa44db30743698cb2bcf35630dfb66fcac7

SHA256
81fb14242cff642dd494c50ebb5b6b327e6c6c8c5e019d7c8dc688c94642cd1f

SHA512
763b942272071f1c31358dbbff9578a50429b702b12cdf40cc5bda8a041913f468706c4f9944666583693e649d47f83222aa0352ca03852327339c172face571

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5243eQ.exe

Filesize
277KB

MD5
722b283eca25a9dd62e9a7093d1dc687

SHA1
0a34cb69010fee0c5572d2fdde0447a7bf4bf348

SHA256
7f0d56ede7ff295a9fad9daeda3449338b967958873300121d129b0eda2b9151

SHA512
664746de8ac1c612071183fd9391c11cb4c9620ff230dfb35c181f70e3b2a781bb248687c8ad523d85bf996f9ef41b5152c94d592bdf0a4f0d8bf9aea7f15375

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5243eQ.exe

Filesize
277KB

MD5
722b283eca25a9dd62e9a7093d1dc687

SHA1
0a34cb69010fee0c5572d2fdde0447a7bf4bf348

SHA256
7f0d56ede7ff295a9fad9daeda3449338b967958873300121d129b0eda2b9151

SHA512
664746de8ac1c612071183fd9391c11cb4c9620ff230dfb35c181f70e3b2a781bb248687c8ad523d85bf996f9ef41b5152c94d592bdf0a4f0d8bf9aea7f15375

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_othsrs5a.gcp.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bZRjxAwnwe

Filesize
72KB

MD5
2b8e1b75b4d4fdf0c640838191ac3946

SHA1
dfac012ccaa015f6a9ec5bd1c55ffa7b8074fb7f

SHA256
17a69481ffd684f025b0fe6b0f22529bd8454c49915e580da43fcb08a0c56e4e

SHA512
3c4de03250813dc78b772cc7e3246ac2726c37fae00844bfceda683e05506b53ba7ea95a06e2929e8ec736ccd50a9138e9f6e3c80980ebde5ed7ac66f06cc038

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

Filesize
236KB

MD5
d3c2fc16b8c03725ad4e76a8a7bd49fe

SHA1
899bf59c4ecee4b306eb383493e96fa27fac8939

SHA256
065f537399534d8f62168e6633b843632fa8bedb9871f47f6224d0be9e55160c

SHA512
36117a42c9a5fbace5d0fea4271c8346ab0738e2bdb055fb0ae25423aa81b64ffeaca38fa6a3378d3d0bb1060081dcac4a09baca5952b5263a1748781879d2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

Filesize
236KB

MD5
d3c2fc16b8c03725ad4e76a8a7bd49fe

SHA1
899bf59c4ecee4b306eb383493e96fa27fac8939

SHA256
065f537399534d8f62168e6633b843632fa8bedb9871f47f6224d0be9e55160c

SHA512
36117a42c9a5fbace5d0fea4271c8346ab0738e2bdb055fb0ae25423aa81b64ffeaca38fa6a3378d3d0bb1060081dcac4a09baca5952b5263a1748781879d2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

Filesize
236KB

MD5
d3c2fc16b8c03725ad4e76a8a7bd49fe

SHA1
899bf59c4ecee4b306eb383493e96fa27fac8939

SHA256
065f537399534d8f62168e6633b843632fa8bedb9871f47f6224d0be9e55160c

SHA512
36117a42c9a5fbace5d0fea4271c8346ab0738e2bdb055fb0ae25423aa81b64ffeaca38fa6a3378d3d0bb1060081dcac4a09baca5952b5263a1748781879d2a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb496E.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb496E.tmp\Math.dll

Filesize
66KB

MD5
32f26ffa5c4d87c2074f95114bafe34b

SHA1
250d984cd9042d558b3e7a9f6835840cfe88de2e

SHA256
851ce1013420608baa53301de5302fbc1b772c5ac4be30df684d2ed9306ba7e7

SHA512
1c608c0c41cb467bc738957900cfe95466041849b64d94b6ae5865ff47cc4c592d258fe3610ed38122f842264097acba420abe805dcfb32d6ec2fa1ddc5bcfcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb496E.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsb496E.tmp\UserInfo.dll

Filesize
4KB

MD5
d41cf0e4d88c60408f3d5b97f49d40c0

SHA1
1aa117b1ef998993f495833a08dd8cb12356be0f

SHA256
2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9

SHA512
35bf8f92d502a007838576c25aa25d1d7cc01a639df624cfb166085b51f1ba9cd4791c854f879e7b138492a3492365d88c0c5d7accfe5ac1e0e73685117f9209

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\Math.dll

Filesize
66KB

MD5
32f26ffa5c4d87c2074f95114bafe34b

SHA1
250d984cd9042d558b3e7a9f6835840cfe88de2e

SHA256
851ce1013420608baa53301de5302fbc1b772c5ac4be30df684d2ed9306ba7e7

SHA512
1c608c0c41cb467bc738957900cfe95466041849b64d94b6ae5865ff47cc4c592d258fe3610ed38122f842264097acba420abe805dcfb32d6ec2fa1ddc5bcfcc

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\Math.dll

Filesize
66KB

MD5
32f26ffa5c4d87c2074f95114bafe34b

SHA1
250d984cd9042d558b3e7a9f6835840cfe88de2e

SHA256
851ce1013420608baa53301de5302fbc1b772c5ac4be30df684d2ed9306ba7e7

SHA512
1c608c0c41cb467bc738957900cfe95466041849b64d94b6ae5865ff47cc4c592d258fe3610ed38122f842264097acba420abe805dcfb32d6ec2fa1ddc5bcfcc

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\UserInfo.dll

Filesize
4KB

MD5
d41cf0e4d88c60408f3d5b97f49d40c0

SHA1
1aa117b1ef998993f495833a08dd8cb12356be0f

SHA256
2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9

SHA512
35bf8f92d502a007838576c25aa25d1d7cc01a639df624cfb166085b51f1ba9cd4791c854f879e7b138492a3492365d88c0c5d7accfe5ac1e0e73685117f9209

Download Submit
\Users\Admin\AppData\Local\Temp\nsb496E.tmp\UserInfo.dll

Filesize
4KB

MD5
d41cf0e4d88c60408f3d5b97f49d40c0

SHA1
1aa117b1ef998993f495833a08dd8cb12356be0f

SHA256
2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9

SHA512
35bf8f92d502a007838576c25aa25d1d7cc01a639df624cfb166085b51f1ba9cd4791c854f879e7b138492a3492365d88c0c5d7accfe5ac1e0e73685117f9209

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\System.dll

Filesize
11KB

MD5
cf85183b87314359488b850f9e97a698

SHA1
6b6c790037eec7ebea4d05590359cb4473f19aea

SHA256
3b6a5cb2a3c091814fce297c04fb677f72732fb21615102c62a195fdc2e7dfac

SHA512
fe484b3fc89aeed3a6b71b90b90ea11a787697e56be3077154b6ddc2646850f6c38589ed422ff792e391638a80a778d33f22e891e76b5d65896c6fb4696a2c3b

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\UserInfo.dll

Filesize
4KB

MD5
d41cf0e4d88c60408f3d5b97f49d40c0

SHA1
1aa117b1ef998993f495833a08dd8cb12356be0f

SHA256
2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9

SHA512
35bf8f92d502a007838576c25aa25d1d7cc01a639df624cfb166085b51f1ba9cd4791c854f879e7b138492a3492365d88c0c5d7accfe5ac1e0e73685117f9209

Download Submit
\Users\Admin\AppData\Local\Temp\nsn7540.tmp\UserInfo.dll

Filesize
4KB

MD5
d41cf0e4d88c60408f3d5b97f49d40c0

SHA1
1aa117b1ef998993f495833a08dd8cb12356be0f

SHA256
2dbdb3abd5652302254466aefa0f40048832f2a39fbb8a63c97fda8116021ff9

SHA512
35bf8f92d502a007838576c25aa25d1d7cc01a639df624cfb166085b51f1ba9cd4791c854f879e7b138492a3492365d88c0c5d7accfe5ac1e0e73685117f9209

Download Submit
memory/636-1172-0x0000000005900000-0x0000000005C50000-memory.dmp

Filesize
3.3MB

Download
memory/636-1171-0x0000000000EF0000-0x0000000000FD6000-memory.dmp

Filesize
920KB

Download
memory/636-1173-0x00000000058F0000-0x0000000005900000-memory.dmp

Filesize
64KB

Download
memory/1700-148-0x0000000000210000-0x000000000021A000-memory.dmp

Filesize
40KB

Download
memory/1760-1191-0x0000000006AD0000-0x0000000006C7C000-memory.dmp

Filesize
1.7MB

Download
memory/1760-1199-0x0000000007020000-0x00000000070B2000-memory.dmp

Filesize
584KB

Download
memory/1760-1188-0x00000000053F0000-0x00000000053FA000-memory.dmp

Filesize
40KB

Download
memory/1760-1200-0x00000000070F0000-0x0000000007112000-memory.dmp

Filesize
136KB

Download
memory/1760-1198-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/1760-1187-0x00000000007A0000-0x0000000000B84000-memory.dmp

Filesize
3.9MB

Download
memory/1956-1205-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1956-1210-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/2144-1325-0x0000000009740000-0x0000000009DB8000-memory.dmp

Filesize
6.5MB

Download
memory/2144-1209-0x0000000006FF0000-0x0000000007618000-memory.dmp

Filesize
6.2MB

Download
memory/2144-1208-0x0000000000F60000-0x0000000000F96000-memory.dmp

Filesize
216KB

Download
memory/2144-1212-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/2144-1328-0x0000000008CE0000-0x0000000008CFA000-memory.dmp

Filesize
104KB

Download
memory/2144-1248-0x0000000006FD0000-0x0000000006FEC000-memory.dmp

Filesize
112KB

Download
memory/2144-1211-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/2144-1223-0x0000000006F40000-0x0000000006FA6000-memory.dmp

Filesize
408KB

Download
memory/3364-1170-0x0000000005490000-0x00000000054A0000-memory.dmp

Filesize
64KB

Download
memory/3364-1156-0x0000000000860000-0x0000000000892000-memory.dmp

Filesize
200KB

Download
memory/3384-1130-0x0000000005A30000-0x0000000005A7B000-memory.dmp

Filesize
300KB

Download
memory/3384-1131-0x0000000005850000-0x0000000005860000-memory.dmp

Filesize
64KB

Download
memory/3384-1129-0x0000000000FF0000-0x0000000001022000-memory.dmp

Filesize
200KB

Download
memory/4200-1246-0x00000000005D0000-0x00000000005D3000-memory.dmp

Filesize
12KB

Download
memory/4200-1264-0x00000000005D0000-0x00000000005D3000-memory.dmp

Filesize
12KB

Download
memory/4200-1263-0x00000000005D0000-0x00000000005D3000-memory.dmp

Filesize
12KB

Download
memory/4200-1247-0x00000000005D0000-0x00000000005D3000-memory.dmp

Filesize
12KB

Download
memory/4200-1289-0x00000000005D0000-0x00000000005D3000-memory.dmp

Filesize
12KB

Download
memory/4200-1288-0x00000000005D0000-0x00000000005D3000-memory.dmp

Filesize
12KB

Download
memory/4656-1330-0x0000028DDF240000-0x0000028DDF2F2000-memory.dmp

Filesize
712KB

Download
memory/4656-1324-0x0000028DC4E90000-0x0000028DC4EA2000-memory.dmp

Filesize
72KB

Download
memory/4656-1342-0x0000028DC69E0000-0x0000028DC69F0000-memory.dmp

Filesize
64KB

Download
memory/4656-1332-0x0000028DC69A0000-0x0000028DC69AE000-memory.dmp

Filesize
56KB

Download
memory/4840-168-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-155-0x00000000071E0000-0x00000000076DE000-memory.dmp

Filesize
5.0MB

Download
memory/4840-158-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/4840-159-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-160-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-156-0x00000000049A0000-0x00000000049B8000-memory.dmp

Filesize
96KB

Download
memory/4840-162-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-164-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-166-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-190-0x0000000000400000-0x0000000002B73000-memory.dmp

Filesize
39.4MB

Download
memory/4840-170-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-157-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/4840-172-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-154-0x0000000002EC0000-0x0000000002EDA000-memory.dmp

Filesize
104KB

Download
memory/4840-174-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-176-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-178-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-180-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-182-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-184-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-186-0x00000000049A0000-0x00000000049B2000-memory.dmp

Filesize
72KB

Download
memory/4840-187-0x0000000000400000-0x0000000002B73000-memory.dmp

Filesize
39.4MB

Download
memory/4840-188-0x0000000002E90000-0x0000000002EA0000-memory.dmp

Filesize
64KB

Download
memory/5028-1109-0x0000000007280000-0x0000000007292000-memory.dmp

Filesize
72KB

Download
memory/5028-588-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5028-222-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-220-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-218-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-216-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-214-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-212-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-210-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-208-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-206-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-204-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-202-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-200-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-198-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-197-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-196-0x0000000004AE0000-0x0000000004B24000-memory.dmp

Filesize
272KB

Download
memory/5028-195-0x0000000004920000-0x0000000004966000-memory.dmp

Filesize
280KB

Download
memory/5028-226-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-228-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-230-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-224-0x0000000004AE0000-0x0000000004B1F000-memory.dmp

Filesize
252KB

Download
memory/5028-590-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5028-586-0x0000000002B90000-0x0000000002BDB000-memory.dmp

Filesize
300KB

Download
memory/5028-592-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5028-1122-0x00000000094E0000-0x0000000009556000-memory.dmp

Filesize
472KB

Download
memory/5028-1107-0x0000000007EE0000-0x00000000084E6000-memory.dmp

Filesize
6.0MB

Download
memory/5028-1108-0x00000000078D0000-0x00000000079DA000-memory.dmp

Filesize
1.0MB

Download
memory/5028-1123-0x0000000009570000-0x00000000095C0000-memory.dmp

Filesize
320KB

Download
memory/5028-1110-0x00000000079E0000-0x0000000007A1E000-memory.dmp

Filesize
248KB

Download
memory/5028-1111-0x0000000007B20000-0x0000000007B6B000-memory.dmp

Filesize
300KB

Download
memory/5028-1112-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5028-1114-0x0000000007CA0000-0x0000000007D32000-memory.dmp

Filesize
584KB

Download
memory/5028-1115-0x0000000007D40000-0x0000000007DA6000-memory.dmp

Filesize
408KB

Download
memory/5028-1116-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5028-1117-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5028-1118-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5028-1119-0x0000000008B60000-0x0000000008D22000-memory.dmp

Filesize
1.8MB

Download
memory/5028-1120-0x0000000008D40000-0x000000000926C000-memory.dmp

Filesize
5.2MB

Download
memory/5028-1121-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/5076-1353-0x00000209D0A50000-0x00000209D0A60000-memory.dmp

Filesize
64KB

Download