quasar | 837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

Analysis

max time kernel
166s
max time network
212s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-05-2023 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

7df4e544bf7658d90be86b4719b32bf1
SHA1

0fe125b130f8cd829e91c4405a1c20171f7b9e6d
SHA256

837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4
SHA512

bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346
SSDEEP

49152:rvvI22SsaNYfdPBldt698dBcjHFI6OBxfRoGdzhTHHB72eh2NT:rvg22SsaNYfdPBldt6+dBcjHa64

Score

10^/10

quasar office04 bootkit persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

57.5034.214.1:4782

Mutex

7cfe7fd0-8b48-41d0-86ed-0f1f7bc93aa7

Attributes

encryption_key
8DC329A0B0D672D54EA380BA2B8C673FA58CCC1A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4132-119-0x0000000000580000-0x00000000008A4000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

MEMZ.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation MEMZ.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 22 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeClient.exeClient.exeClient.exe

pid	process
4124	Client.exe
4504	Client.exe
4752	Client.exe
4368	Client.exe
3048	Client.exe
3956	Client.exe
3088	Client.exe
5036	Client.exe
3988	Client.exe
3056	Client.exe
96	Client.exe
4964	Client.exe
4108	MEMZ.exe
2728	MEMZ.exe
868	MEMZ.exe
424	MEMZ.exe
3684	MEMZ.exe
1396	MEMZ.exe
4276	MEMZ.exe
3908	Client.exe
3540	Client.exe
3992	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

MEMZ.exeMEMZ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 MEMZ.exe
File opened for modification \??\PhysicalDrive0 MEMZ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Windows directory 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133297703979105701"	chrome.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 3df8bf635a45d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 22febf718e91d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{73075A04-193F-4745-ABEE-9F61CC1D54C7} = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "1esz96e"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 680aff738e91d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000a13f86c0e1a35d26a73235585a5185b2b1924046a6fa7b0cd63e32b970fec5e9721c27d59eae5df8f832728927f266a6aecfa360a8e3413cc8a2268beb7109b346e1ca8d16fe5d16326389bb2c00f835a8c503d805a26c941688f8b40c6262569b2f2c267db33f225a653e13729b8adc6d1429867c5552a44f8e5636d6efd1c041a7bd0500ed1945c3d729177ae37e00555c80d5c41d4f551e555dd6393aa520a8e7d13086cb34e6105b31b7b4f898490e3deeba491b1904ac7d34cca26122da2691af45bd6f21ad24900af9ecfad7ca64575039126ddcf0eaa6187b5f869b624843210b1af80fd7f9154c41d70990fa4c4a037b9c347af7ef707d3df6c787dce19e928f2086cedc638c2541ee45c57a85b52e77de906ea0387cfd3c0946b587674371d78138c9626c9428eec1cee9b1b03a74265fa22b795e68a05d652275038ed09b198d309383c0cc09b3cbc42a32a6783f4b2088e6c415d55b3cfd7a1b5c3fe76c93378d016116d61ab6c947c2f5c80f51c9d963c073fd63a43264703bf1f22645df356f170860512626c777ea61979f62890a542175c4854920db5b294f8a475acf3b92	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe

Runs ping.exe 1 TTPs 19 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
3876	PING.EXE
2984	PING.EXE
4944	PING.EXE
3592	PING.EXE
4156	PING.EXE
4268	PING.EXE
3688	PING.EXE
3548	PING.EXE
3356	PING.EXE
2784	PING.EXE
2660	PING.EXE
1536	PING.EXE
3900	PING.EXE
3968	PING.EXE
5036	PING.EXE
4892	PING.EXE
352	PING.EXE
1292	PING.EXE
4968	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exe

pid	process
4880	chrome.exe
4880	chrome.exe
4408	MEMZ.exe
4340	MEMZ.exe
4408	MEMZ.exe
4340	MEMZ.exe
4356	MEMZ.exe
4788	MEMZ.exe
4788	MEMZ.exe
4356	MEMZ.exe
3088	MEMZ.exe
3088	MEMZ.exe
4356	MEMZ.exe
4788	MEMZ.exe
4356	MEMZ.exe
4788	MEMZ.exe
3088	MEMZ.exe
3088	MEMZ.exe
4340	MEMZ.exe
4340	MEMZ.exe
4408	MEMZ.exe
4408	MEMZ.exe
3088	MEMZ.exe
3088	MEMZ.exe
4788	MEMZ.exe
4788	MEMZ.exe
4356	MEMZ.exe
4356	MEMZ.exe
4356	MEMZ.exe
4356	MEMZ.exe
4788	MEMZ.exe
4788	MEMZ.exe
3088	MEMZ.exe
3088	MEMZ.exe
4408	MEMZ.exe
4408	MEMZ.exe
4340	MEMZ.exe
4340	MEMZ.exe
4408	MEMZ.exe
4408	MEMZ.exe
4340	MEMZ.exe
4340	MEMZ.exe
3088	MEMZ.exe
3088	MEMZ.exe
4788	MEMZ.exe
4788	MEMZ.exe
4356	MEMZ.exe
4356	MEMZ.exe
4408	MEMZ.exe
4408	MEMZ.exe
4340	MEMZ.exe
4340	MEMZ.exe
3088	MEMZ.exe
3088	MEMZ.exe
4340	MEMZ.exe
4340	MEMZ.exe
4408	MEMZ.exe
4408	MEMZ.exe
4356	MEMZ.exe
4356	MEMZ.exe
4788	MEMZ.exe
4788	MEMZ.exe
3088	MEMZ.exe
3088	MEMZ.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

500 MicrosoftEdgeCP.exe
500 MicrosoftEdgeCP.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

4880 chrome.exe
4880 chrome.exe
4880 chrome.exe
4880 chrome.exe
4880 chrome.exe
4880 chrome.exe
4880 chrome.exe

pid	process
500	MicrosoftEdgeCP.exe
500	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Client-built.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exechrome.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	4132	Client-built.exe
Token: SeDebugPrivilege	4124	Client.exe
Token: SeDebugPrivilege	4504	Client.exe
Token: SeDebugPrivilege	4752	Client.exe
Token: SeDebugPrivilege	4368	Client.exe
Token: SeDebugPrivilege	3048	Client.exe
Token: SeDebugPrivilege	3956	Client.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeDebugPrivilege	3088	Client.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeDebugPrivilege	5036	Client.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe
Token: SeCreatePagefilePrivilege	4880	chrome.exe
Token: SeShutdownPrivilege	4880	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

chrome.exe

pid	process
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe
4880	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

MEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMEMZ.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

pid	process
1220	MEMZ.exe
4788	MEMZ.exe
4356	MEMZ.exe
4340	MEMZ.exe
4408	MEMZ.exe
3088	MEMZ.exe
4920	MEMZ.exe
4276	MEMZ.exe
4812	MicrosoftEdge.exe
500	MicrosoftEdgeCP.exe
500	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client-built.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exechrome.exe

description	pid	process	target process
PID 4132 wrote to memory of 4124	4132	Client-built.exe	Client.exe
PID 4132 wrote to memory of 4124	4132	Client-built.exe	Client.exe
PID 4124 wrote to memory of 1416	4124	Client.exe	cmd.exe
PID 4124 wrote to memory of 1416	4124	Client.exe	cmd.exe
PID 1416 wrote to memory of 4412	1416	cmd.exe	chcp.com
PID 1416 wrote to memory of 4412	1416	cmd.exe	chcp.com
PID 1416 wrote to memory of 3876	1416	cmd.exe	PING.EXE
PID 1416 wrote to memory of 3876	1416	cmd.exe	PING.EXE
PID 1416 wrote to memory of 4504	1416	cmd.exe	Client.exe
PID 1416 wrote to memory of 4504	1416	cmd.exe	Client.exe
PID 4504 wrote to memory of 3900	4504	Client.exe	cmd.exe
PID 4504 wrote to memory of 3900	4504	Client.exe	cmd.exe
PID 3900 wrote to memory of 2296	3900	cmd.exe	chcp.com
PID 3900 wrote to memory of 2296	3900	cmd.exe	chcp.com
PID 3900 wrote to memory of 2984	3900	cmd.exe	PING.EXE
PID 3900 wrote to memory of 2984	3900	cmd.exe	PING.EXE
PID 3900 wrote to memory of 4752	3900	cmd.exe	Client.exe
PID 3900 wrote to memory of 4752	3900	cmd.exe	Client.exe
PID 4752 wrote to memory of 3740	4752	Client.exe	cmd.exe
PID 4752 wrote to memory of 3740	4752	Client.exe	cmd.exe
PID 3740 wrote to memory of 2872	3740	cmd.exe	chcp.com
PID 3740 wrote to memory of 2872	3740	cmd.exe	chcp.com
PID 3740 wrote to memory of 3548	3740	cmd.exe	PING.EXE
PID 3740 wrote to memory of 3548	3740	cmd.exe	PING.EXE
PID 3740 wrote to memory of 4368	3740	cmd.exe	Client.exe
PID 3740 wrote to memory of 4368	3740	cmd.exe	Client.exe
PID 4368 wrote to memory of 4692	4368	Client.exe	cmd.exe
PID 4368 wrote to memory of 4692	4368	Client.exe	cmd.exe
PID 4692 wrote to memory of 3360	4692	cmd.exe	chcp.com
PID 4692 wrote to memory of 3360	4692	cmd.exe	chcp.com
PID 4692 wrote to memory of 5036	4692	cmd.exe	PING.EXE
PID 4692 wrote to memory of 5036	4692	cmd.exe	PING.EXE
PID 4692 wrote to memory of 3048	4692	cmd.exe	Client.exe
PID 4692 wrote to memory of 3048	4692	cmd.exe	Client.exe
PID 3048 wrote to memory of 5000	3048	Client.exe	cmd.exe
PID 3048 wrote to memory of 5000	3048	Client.exe	cmd.exe
PID 5000 wrote to memory of 4916	5000	cmd.exe	chcp.com
PID 5000 wrote to memory of 4916	5000	cmd.exe	chcp.com
PID 5000 wrote to memory of 4944	5000	cmd.exe	PING.EXE
PID 5000 wrote to memory of 4944	5000	cmd.exe	PING.EXE
PID 4880 wrote to memory of 656	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 656	4880	chrome.exe	chrome.exe
PID 5000 wrote to memory of 3956	5000	cmd.exe	Client.exe
PID 5000 wrote to memory of 3956	5000	cmd.exe	Client.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe
PID 4880 wrote to memory of 1504	4880	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IeXf5YegDssT.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:4412

C:\Windows\system32\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:3876

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TDtbGAIirbfp.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:3900

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:2296

C:\Windows\system32\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:2984

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0KODAqpO20DJ.bat" "
7⤵
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:2872

C:\Windows\system32\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:3548

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\waNmNPfnBMeA.bat" "
9⤵
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\system32\chcp.com
chcp 65001
10⤵
PID:3360

C:\Windows\system32\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:5036

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r3P28YoAikTG.bat" "
11⤵
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\system32\chcp.com
chcp 65001
12⤵
PID:4916

C:\Windows\system32\PING.EXE
ping -n 10 localhost
12⤵
- Runs ping.exe
PID:4944

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0oWJYiR1k25w.bat" "
13⤵
PID:1752

C:\Windows\system32\chcp.com
chcp 65001
14⤵
PID:4876

C:\Windows\system32\PING.EXE
ping -n 10 localhost
14⤵
- Runs ping.exe
PID:4892

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qftRUj9MfJ8Z.bat" "
15⤵
PID:4368

C:\Windows\system32\chcp.com
chcp 65001
16⤵
PID:3404

C:\Windows\system32\PING.EXE
ping -n 10 localhost
16⤵
- Runs ping.exe
PID:3356

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mRsTfPVH6gKT.bat" "
17⤵
PID:3552

C:\Windows\system32\chcp.com
chcp 65001
18⤵
PID:3096

C:\Windows\system32\PING.EXE
ping -n 10 localhost
18⤵
- Runs ping.exe
PID:2784

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
18⤵
- Executes dropped EXE
PID:3988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TWc4Wyr0F7h9.bat" "
19⤵
PID:1464

C:\Windows\system32\chcp.com
chcp 65001
20⤵
PID:3536

C:\Windows\system32\PING.EXE
ping -n 10 localhost
20⤵
- Runs ping.exe
PID:3592

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
20⤵
- Executes dropped EXE
PID:3056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OsXaRq1B165L.bat" "
21⤵
PID:3508

C:\Windows\system32\chcp.com
chcp 65001
22⤵
PID:4892

C:\Windows\system32\PING.EXE
ping -n 10 localhost
22⤵
- Runs ping.exe
PID:4156

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
22⤵
- Executes dropped EXE
PID:96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mVQNLpF5tfVx.bat" "
23⤵
PID:316

C:\Windows\system32\chcp.com
chcp 65001
24⤵
PID:2728

C:\Windows\system32\PING.EXE
ping -n 10 localhost
24⤵
- Runs ping.exe
PID:3968

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
24⤵
- Executes dropped EXE
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jDV7E3g4V9j0.bat" "
25⤵
PID:2784

C:\Windows\system32\chcp.com
chcp 65001
26⤵
PID:3652

C:\Windows\system32\PING.EXE
ping -n 10 localhost
26⤵
- Runs ping.exe
PID:2660

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
26⤵
- Executes dropped EXE
PID:3908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lr8lUF4wNuau.bat" "
27⤵
PID:4896

C:\Windows\system32\chcp.com
chcp 65001
28⤵
PID:500

C:\Windows\system32\PING.EXE
ping -n 10 localhost
28⤵
- Runs ping.exe
PID:352

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
28⤵
- Executes dropped EXE
PID:3540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f1ej8c4XLJdD.bat" "
29⤵
PID:2736

C:\Windows\system32\chcp.com
chcp 65001
30⤵
PID:4088

C:\Windows\system32\PING.EXE
ping -n 10 localhost
30⤵
- Runs ping.exe
PID:1536

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
30⤵
- Executes dropped EXE
PID:3992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bDGkCjr9Hr0X.bat" "
31⤵
PID:3032

C:\Windows\system32\chcp.com
chcp 65001
32⤵
PID:4156

C:\Windows\system32\PING.EXE
ping -n 10 localhost
32⤵
- Runs ping.exe
PID:3900

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
32⤵
PID:4148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2QOjT4laqgva.bat" "
33⤵
PID:3656

C:\Windows\system32\chcp.com
chcp 65001
34⤵
PID:3528

C:\Windows\system32\PING.EXE
ping -n 10 localhost
34⤵
- Runs ping.exe
PID:4268

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
34⤵
PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4edLsBWVCAz1.bat" "
35⤵
PID:768

C:\Windows\system32\chcp.com
chcp 65001
36⤵
PID:4944

C:\Windows\system32\PING.EXE
ping -n 10 localhost
36⤵
- Runs ping.exe
PID:3688

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
36⤵
PID:6084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tGBlGGMsz0yo.bat" "
37⤵
PID:5256

C:\Windows\system32\chcp.com
chcp 65001
38⤵
PID:5332

C:\Windows\system32\PING.EXE
ping -n 10 localhost
38⤵
- Runs ping.exe
PID:1292

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
38⤵
PID:6108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xMeDohQK1W1m.bat" "
39⤵
PID:220

C:\Windows\system32\chcp.com
chcp 65001
40⤵
PID:3696

C:\Windows\system32\PING.EXE
ping -n 10 localhost
40⤵
- Runs ping.exe
PID:4968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdb7b19758,0x7ffdb7b19768,0x7ffdb7b19778
2⤵
PID:656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:2
2⤵
PID:1504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:1808

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:1980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:3456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:3452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4304 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:4100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4524 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:4152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4668 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4756 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:4512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:2176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5108 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:3900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:3736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5272 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:3112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3120 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:2900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5240 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:1952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:5072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1116 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:2680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3692 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4732 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2468 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:1856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4764 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:3404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:2
2⤵
PID:3508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2468 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:4932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=3808 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:3536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5904 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:1
2⤵
PID:5112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1724,i,18346065079763166636,6016768419680596409,131072 /prefetch:8
2⤵
PID:4036

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2836

C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1220

C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4788

C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3088

C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /main
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:4176

C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\MEMZ.bat"
1⤵
PID:4312

C:\Windows\system32\cscript.exe
cscript x.js
2⤵
PID:4992

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe"
2⤵
- Executes dropped EXE
PID:4108

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
PID:2728

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
PID:1396

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
4⤵
PID:1840

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
PID:424

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
PID:3684

C:\Users\Admin\AppData\Roaming\MEMZ.exe
"C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
3⤵
- Executes dropped EXE
PID:868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4812

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1728

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:4104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:2144

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4916

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5124

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5660

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\12c7666a-8ee2-4ba6-8200-d841211a6275.tmp
Filesize
12KB

MD5
144bbc535fb178b287c1160750359f69

SHA1
a51652dc2e4bc55c819138f8c49ff3a45534f3bd

SHA256
9f115930a47821985d99624e52c695a238ed905fe24aa026792794ffc3a3c35f

SHA512
fe1d7cf9224a7348ef950a0031ddfd329111e8fc2702d2d7b962f78d0cebe46599d9121d3b72033c3685e9a286760276d6b6a8a0e7d49126891aff4d92db505d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Filesize
65KB

MD5
b073d577d7e4df41dfac73ee1d0270fa

SHA1
6204b9242f8df0124de9ae7b31cbebfc85201fca

SHA256
66fe4c2a21e0f0cc46184a7b679e1562f3a7cda9cd8a16a9a446b9fbfe18000f

SHA512
c397bc9f8f0c3dec9b38d07ca35473fa103c96e58c414fde3352dcb47db262a887443865bdf1ef36e6b8aee461775feb34ac1eb3deed736673cf13c5dc828a0b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Filesize
37KB

MD5
519005befdbc6eedc73862996b59a9f7

SHA1
e9bad4dc75c55f583747dbc4abd80a95d5796528

SHA256
603abe3532b1cc1eb1c3da44f3679804dd463d07d4430d55c630aba986b17c44

SHA512
b210b12a78c6134d66b14f46f924ebc95328c10f92bfed22a361b2554eca21ee7892f7d9718ae7415074d753026682903beba2bd40b35a4eeb60bf186dcdf589

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
4d7f38a70477d5c1b2e620977ebf9f63

SHA1
c3ef56d7f4ea66fa6ebbeb9d06819410a98f04e8

SHA256
bd4aef3e1522cb8707d3f33034672ef20b98735af913d26d02b23187ba6a8013

SHA512
dcce36f449dd7b7b9f9f0056f2d92b98ad216f006b1d5b8a53deb157dfc63509aeec3e85b3adb570908ed4722fd79a1048bb44dcd4a00878b55f3bbeee5fd781

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
57ea617c8c2a405c54612c6b9223e786

SHA1
c7f4a781489885a70b912a724bdc9808bc03f214

SHA256
79c4183d6d1d51bf0928ca53b35b95ec4766a9da67dbd19f2bae4e17e3f3353e

SHA512
9a64746e9a28c6d775f723d9f4000c9ec7ef4f1604a168591730d11841c8df3b4632d7865559f46f45f0ec020e633f9fb1bf3667e354196a5c2cfe6b920211fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
539B

MD5
8b9e9a114f3773450ef722ec6586339c

SHA1
8647199665da5338af1231f82df7ec9adb12d67b

SHA256
51a8300184c0975f3ee000c9465127886adfeb7b96c032f0bc6b82c5046a87a1

SHA512
5cae3d0c5427dcec810736ad17b2e36e96ab403ccb0c424b5dc70c58073a015a876fa0adbfb11d9353a14344de4cdbab753cbb29df87b4fa040edc50346e1e6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
e8021997ea03097a8c01f4683799d3eb

SHA1
35efd4a6a74d82862f3d6fa4aa0261cd02c1f23b

SHA256
2b23e6d69dc38fc7a71eac67fdf135e0ef7bdbc7bf876f021b5b12f947cdaf22

SHA512
b1ae6da2eb361a9f84fae0ae26fb831dc29794f985bf6b14fcce806c9b03a678f8f8c7f6d15efe59d50d06c80e8de48fd4b8bac2893be92503c124168f5de845

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
82b590682a8872f0c6217b9dd8e70483

SHA1
34141a47e69f8de7008a6a35eeab1ecf529df1a0

SHA256
54ba05a90d6069dcc17faef9b075eee0aec62cafab9150764b220d734ef7c7f6

SHA512
e1bf08959604a7d18f191a9601bb3eaa92d5f7204b5fc68feea7f7937d5aa4a153696ec9bd48bb19ff81b70c588db56f6e44740dc23a1bb400cdcdd4731e9115

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
9980a2fad4e4078d256255ce35cfa185

SHA1
3569244b12ff59c9e9beb7e09c4ee4945038f826

SHA256
e1921856808068aa4100065810db8b41f9c2429cf1ccdcdec2d37b7412123e77

SHA512
239f1686487167fc5c1105a98d01d59d7eaeffe68b3781d406478a647599c6955399a1e490568bec452fbc5bd9efd51a33d14d56c66708fed5dc42d177f6559f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
6149fbc08d0fe51078b96732c2059ec5

SHA1
25510aaf38387b1e4be956679b86d2bc4cad2466

SHA256
b0ea417adf84dcf39f0f6d3ff3e9ac73a404a9a82ccbe4f5e7bbac81ac9afebe

SHA512
9e1823c6e4c94fda0b3a4c42b78f9dead977319f3bddfcd1782af94e1b2db01e0995220e07220c2a4f39083a5e661cf42a2edca449ef28fb991a8cb398afc617

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
4b87df5b8e00c2f008b94851997966de

SHA1
b0ce30b9d8512dc33d1107c2b9faa6a08b671511

SHA256
c73380d7853c98caaa5874e648a3ab77fe1d1b790f438e2e70785f99bd392f6f

SHA512
977a0ccb1a92e0fcc2d5aa055c9ed963452379cb751417896e21b195310fd3922295a78c40fd32f457c6c8230e98b86bfcc2717035ba9fa22cb8c73d684396d2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
5471a895ef9ea701e4b035f3396b16a4

SHA1
440b5f25e79ebc7a8b139f84dffd1899fd3f0ab8

SHA256
e31bda3bc94f349e776172ba0ca3c514eec1c2882b026167aa3c517398e0ce7f

SHA512
4f3d4f37909c7c8f57f8bdc9a62283ca96648cf95703a4532aa7739d017f895862a2293b8a7b104bd6c549efbad851f8db4a318209eaae9c823bbc36072b5828

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
3fe26925281518be34f701c12ef7226f

SHA1
a4850ac0b63c2461d75184e1403479384cc0e708

SHA256
a700163fd80017646611828363acdfd18be9fe2784b61a77cd1893aa4dce39b9

SHA512
a921cd0b75b8a36013c72e131ed4c77af8bf808e9e97776ac3615c3eecf09b34f3013e5a78842e3da412023c29d5d23ab719a6445b406477e8c73637532e8bfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
3ce066d5d4186222494ec41c64e1f890

SHA1
75eb26210864082b84038c49e1c1b993f9cd2c7d

SHA256
099efa5b5034416a41a7100cc02b8dfec946acc653f64b749784514fb1c7981f

SHA512
e04a2061ec5898df08850e9274db5cc67c93c5e8b6c40c513c108a5b8bd86e3a6e416417ea03fd449a2752c669f5311d14f1d5b869c7455d2b0e75b45728180b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
0350bd238fb8d8313766f8cdd5834234

SHA1
3baf16798629036d952a240ba07c2c64629ff216

SHA256
af67718e141898b630048e35c9c4f6bd245a6bf014668ae8f4c045bb0bafec3a

SHA512
046cc1d40b8fda871ad30984428078017f480e807c1e84fc0c51002f71449a5ad57ba96ac7364a811ef57874baf8681902feebe4b716493c426a9b32f00242dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe577abe.TMP
Filesize
120B

MD5
a6bb6b65b7817d2fd9a21b79ed4107ab

SHA1
d1b78786132768dfbb79758bc3e97f5a31106f32

SHA256
225e690a39d42bd203f07972dc17d34d3101d9b025e3b30f911f46c0231eea67

SHA512
dcbb1a58ac35b188860dbdb7f19fe4f5d2e3dffd37f7e478ff3e1b0aad028cda0aee354d6bcdd473de44812748b7f921a2dc33704fd6665fc605dac24e3df5fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
153KB

MD5
ee2aa9356eace45d87cc2326f83cf59f

SHA1
7c7f406a8817f044aa467715e6ede02ff26a6f95

SHA256
39f3b55343b6aa58cd619a85c0631c319799d00c0f6b2c327ee20bef17be0e61

SHA512
01130ae8a18136d915cf53f5e4513de9bbc057b149ebf80cc793e22c5718bf3c0983d2fa5afc17438a5e91b672a24409c4b1ffd74850799ba653046bc1e702aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
153KB

MD5
5a439b9013e649c8a3008c35edb1b9cf

SHA1
4604e50a4f6c43f89484de4a3e4437a2ce15c4f9

SHA256
3af4859f84e4560d2f7467063bed73f9dcf79b8cc51ee4019d5c6a68c281e171

SHA512
debfb04e715636ecede069f9d3ef2b90a461998c2da3b0f5c0ad9a579da49a210f969c0684d4f8c493a375f57be28bf19a056c3352af28d611171b0b074d35ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
103KB

MD5
0e61b0ea1be9eb52c452ac7d55439531

SHA1
376611d7e1c26f487b8f8e522b904f9737c3b1b1

SHA256
806092e3d85b9e00d16e5d7f3faf2fb9a123953016854c96082184b25950e55d

SHA512
6a867fbe734e92907298eb33ad5cd67b6b44117b85b96f4ae984c0a8237922f8be5cb43244e4a347ebd70e29465b870cbb4166aa3516a96112a4a26070eed9e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
111KB

MD5
756ce26b1fea0b9b07b5f050de0969ca

SHA1
c6e57c8b69d292653523324b662630a8b6d7080e

SHA256
46029955399ba17f388f290667bec72f46ba892c7d24599926b070eae327125b

SHA512
8f00ed82f6cdff00ba2865e2a81ae177b4e1661c60e7d3fea15eb1f48ea639faddddceee05711497ee07cc9d3e648c847ec8491bfb96ade0b9b87bff1447a5a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57dbf8.TMP
Filesize
93KB

MD5
14a0b59ceb81824ed1ff9c585e4034be

SHA1
dd363a9d3d21dee58b59aecc275aa05e39a6f21d

SHA256
e00e91ee4eadc0b62c939249540fe37e522e0b9d21ba1af4730c90996953de9c

SHA512
c4973bcf73c0804ff98a7947ab58f7eb4894b25ab08b29ff6289e63bd710ca26e38ec9b273990af27dfa76fb4d8c18bfe0871596cce69854d5b1c056da67c614

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Filesize
2KB

MD5
1dcda70572487b230bb9e47148a0946d

SHA1
06f9b414b54eb9a816d9b37a2b54c82a94197a05

SHA256
9e6e954e3f620c078e96da9f741090719a3b6b282704a1e54942b683223de4ed

SHA512
7de9c424f82129e049ca6830c6ae1f23489738d487999e773f1593494f1caddc9dd9c77f85c3a01e05ee37653de3ab17da8c3fdf75adc0c0c2fb38a938246179

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\LTLJWELN\favicon[1].ico
Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\Windows\3720402701\2219095117.pri
Filesize
207KB

MD5
e2b88765ee31470114e866d939a8f2c6

SHA1
e0a53b8511186ff308a0507b6304fb16cabd4e1f

SHA256
523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

SHA512
462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

Download Submit
C:\Users\Admin\AppData\Local\Temp\0KODAqpO20DJ.bat
Filesize
207B

MD5
ad9798b4a38a594959f1001f77626065

SHA1
47f6029a4130e8163dfdf7503900a282a2c0d0fe

SHA256
26aa2a1b9e27141cafb54276459579d46d3fc1bd2e2ae4f894b42fad0a3f7972

SHA512
15c1467aef3d975ea8d23c235305f29032c27522f4c0bd404c948a3ffd06088da2f80342b573aecb9d42059e93abf605c55a33868665699a0814df3ee4be7f26

Download Submit
C:\Users\Admin\AppData\Local\Temp\0oWJYiR1k25w.bat
Filesize
207B

MD5
46fcace7115adc4e45b57769b2fca06d

SHA1
9fa99e74cd513975b57fd843924bebe8d4e45286

SHA256
9ab33d33d8609386d8cb2f6f27e3a0805f0e1ee6f0c53e6a6a364498b67f1ce0

SHA512
973220e69911eee76543a250acf0170589a52100bb96ced16ffa90b0d318d3c18c0315d02d9b76b610c68f5588b121588989412a704d86675fa4efbd37877823

Download Submit
C:\Users\Admin\AppData\Local\Temp\2QOjT4laqgva.bat
Filesize
207B

MD5
d2b6043088b4d15a64ec70a96ff877e8

SHA1
23a5ec028a1353d4387e234519edb2ff792fb439

SHA256
3cdbb47d038f7dc5437aa4b9361729cfb74118d8c4d73d6fd84daf2904e05aee

SHA512
c10e482b634bad63d59ed3fb834993888c0c09a23d1fb93315e2678acd73764dd2ab85a6a5171be66c5e3ee7b2ed611101f0a4d1808dd43f573d6300151bfe9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IeXf5YegDssT.bat
Filesize
207B

MD5
4c419bce2dd1dbbb5c19cb8c5fe26dcf

SHA1
a78c38f2c56d3ab79056ee6dd4f2902cc95eb5ff

SHA256
83d247f3b3fcb95358296fcd7e68a31549472be25f8491236ebbff815478f034

SHA512
32a37fbed0084957b65239a117d521fcfeb1ebbedd376c185ab22da765760ddc23a9eb210f0be9a2b38999c13126018eb540c3cdb48777f78a40bd1fcc798f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\OsXaRq1B165L.bat
Filesize
207B

MD5
456d5353912e21812b6966e7ba56874a

SHA1
8a0396810e91d4e2aaa06cfef5220db3d958752e

SHA256
c907eb61b772509917be40a365da0a9c07c61d988c319ee91c9b0a47b9c35f62

SHA512
9e1ea069647ebdba0c027718fd2c8851792993e5d97bae314b732ded608461aaa8e69bc2df434fa80a3ef5d675eb4c0ce98265e379860e32c197e0e606f5c624

Download Submit
C:\Users\Admin\AppData\Local\Temp\TDtbGAIirbfp.bat
Filesize
207B

MD5
d781342cf53c96c47f9706884afb1d94

SHA1
08d0a37ea19f79e1aba985a49847e59431df4965

SHA256
beb8a0739b60dec11917b46db319fd88d5abbce7bf1a33f62e327c431ad0b104

SHA512
3e3a86b1f404e4c76644e63a5494c33d449b12f13cc6ad0a209bdd2d6a1a7c5b4fe7b5919f07e196fe7f84a14e4da224e30b03e80559291771d88a2c502d3c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TWc4Wyr0F7h9.bat
Filesize
207B

MD5
242176e56067db4096d6a3bba4a7b998

SHA1
6dffedb8b0f1682c790960783cc8220a6608cf56

SHA256
881004925a023eeb6c791acf39b18899b259d71d4a94561621d6b6de143c9e4e

SHA512
32fdf1dddd5b4df0b4b530a5d444c8591f98a0c1afa690ad8ebd40cc8630431074dbbb6e8aec79bc159005ef3848e5b3861c1c2950fdda6319279a8d7d7a31ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\bDGkCjr9Hr0X.bat
Filesize
207B

MD5
781983427701f2b0f9090422e0e6f583

SHA1
b5ee8c38563cbc1b7adf8b4472cb585d1723dbf7

SHA256
418420da7d0fbf23cd0dbff41dbfe275012b2927df877a8a38ed8a598e6e2a43

SHA512
48ccb24e813240df76805c5f99dc5046c8f081f40065e39e281d6b948b376a7bf888613bcd33197573beb656505bdb1ce2bb8287fd50e177c5751f8bf9e4588f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1ej8c4XLJdD.bat
Filesize
207B

MD5
c5912882a565b8a5ed46d37a7775ceff

SHA1
e35269f99dc0f60e737e27a0bd4a4d7ebd26f7e1

SHA256
c710e8c47cc1ac9073a9f4c0226fdb1a9846f595bdacba6ff6d3eaad50f25b7e

SHA512
360bed86042ae67967ac3d5da2fea5b95979131faf6179f0e6d80ffc21779232276523f92f7a65437414abfcfb42209747d6c47ce4993e08ef4b42468c2e42ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\jDV7E3g4V9j0.bat
Filesize
207B

MD5
3c6e93755c42b53e7032a8c6896776ca

SHA1
836d8061cb4d513b5031012b5c2ee3b196673967

SHA256
21fb6a79de09b61e3ddad80dcac74d175eb99759845b7218c18204bce4332281

SHA512
dbf7f785cfb49ffbf96a67fe31665d27179bace4428518d015dee45315e7731d4ae240a34462d99bbe46cd1044d151a6c84d57e463f413980d35f115a73ccc20

Download Submit
C:\Users\Admin\AppData\Local\Temp\lr8lUF4wNuau.bat
Filesize
207B

MD5
176bbb553d5b0026b308092e7582946c

SHA1
ddfec1c700f8b5edee077eeb6e11456533a3808b

SHA256
bfd0f99f74ecdec8e1596a39fd6e28df4fb435198931ca840c1f90f45a70d6c9

SHA512
e19d4d0f6cdee0d9332f4b4cd1744dbe5a0587aeb6db7352682c4d8bbc8080bfe6a04e85cf43994de69ccdf040926752121465422fe5e614dab656f25959c7bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\mRsTfPVH6gKT.bat
Filesize
207B

MD5
4ad5e985dbe821f8eaff793fb5938287

SHA1
f8a5647737aa2226ac6ed6a56a2774eef5d8f88d

SHA256
4bc87e5b33981c5009b379c696d5521e24d9fe21230fadf0ae79114569336b07

SHA512
70939be227cc0af151ddd02c6f603df0036494edfdfa3541bc19d63ed6065a94e7c4eed28486dda2535ea80c41d64aa0476544baefb2b6d42202f18aa16c027a

Download Submit
C:\Users\Admin\AppData\Local\Temp\mVQNLpF5tfVx.bat
Filesize
207B

MD5
c1875c8a1cee5cceec07c6466ab66eab

SHA1
4ae17ac5b4835d69df6db1ce13247145c2c567e9

SHA256
bbbb7a752c5de5de0ec965fded6991f431e024dfb2c03c7b7651601cf445fd1c

SHA512
324ecab49eb77d05aaf0fc0affc95604c01f7c1db8d8ce4b4737d7002c463ada301053403fe23e815e830caddd876e54eaf717118190712593b58f73306b230e

Download Submit
C:\Users\Admin\AppData\Local\Temp\qftRUj9MfJ8Z.bat
Filesize
207B

MD5
f4b2026e84e723707d23a915b8ca0158

SHA1
aa5b2e2b78ab2c3ced0c9dfd4d4a176535a192c6

SHA256
a0bc67f5d9252544a113a17bc707ba6c0d21132f098786066f6674844a081065

SHA512
dc78290948bfa6514d0d00c40b30ac8fbaa65873eb88d2c7cd43fa822aa4044eb9b48a45c2482c2d936d3300799d4cd9e1cec4de3cc65b27e32c54bc659b7e97

Download Submit
C:\Users\Admin\AppData\Local\Temp\r3P28YoAikTG.bat
Filesize
207B

MD5
5006351df3d08e3ba517f8266f7eacdd

SHA1
d6d69416cf74229bdc17988e5ef6acc0acb7fb00

SHA256
dafafc85cb67e91d5e0432d45d64002c8931bea5efbd834a7f3a89aacc409498

SHA512
3d63d02e6b887610a27d2d2c551599476d19870de3bd548b68c9a068854e4e16feb43f561a16e1a002c1fbab94d91ae82d2a14805ca87177faebd04b60d796da

Download Submit
C:\Users\Admin\AppData\Local\Temp\waNmNPfnBMeA.bat
Filesize
207B

MD5
1f7a0589639ca058ae20b9d5e57db806

SHA1
e592075f57a2bce9d2283bc9a9d804cf99178174

SHA256
b4a9dd896352ff2a93aa4a562bc8284c34cca7b6aa4b2f6e6997d2687cf16b9f

SHA512
ee61f604ec3bb7ff1887dff71293f7987a958e3e0788278f514a72e404c15e9242420a3cb0d68d4e01de2a46b51eb9af57f2082e49e3ec64c68a2848d9253f85

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe
Filesize
12KB

MD5
a7bcf7ea8e9f3f36ebfb85b823e39d91

SHA1
761168201520c199dba68add3a607922d8d4a86e

SHA256
3ff64f10603f0330fa2386ff99471ca789391ace969bd0ec1c1b8ce1b4a6db42

SHA512
89923b669d31e590189fd06619bf27e47c5a47e82be6ae71fdb1b9b3b30b06fb7ca8ffed6d5c41ac410a367f2eb07589291e95a2644877d6bffd52775a5b1523

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
3.1MB

MD5
7df4e544bf7658d90be86b4719b32bf1

SHA1
0fe125b130f8cd829e91c4405a1c20171f7b9e6d

SHA256
837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

SHA512
bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1).zip
Filesize
15KB

MD5
230d7dcb83b67deff379a563abbbd536

SHA1
dc032d6a626f57b542613fde876715765e0b1a42

SHA256
a9cd3d966d453afd424d9ac54df414b80073bb51d249f4089185976fb316e254

SHA512
7dff68e3f9be9320872ccb105b2e87f15b23807af96ca195a38a249d868468632c3d5811d9a51295ec89fe702d821c9466f93994993951d1238f07f096fb7d77

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\x
Filesize
780B

MD5
73648def0c63131e4ef4fd67b04c42e9

SHA1
9404e11726a34e8548e4a5408128a025119f46a4

SHA256
4aea6b9bb62f0c8f0ee3ef9adba8d7a61bcb6c9aad4127dda58df6d3488d063e

SHA512
95a65b0d787ed6bf80f75ce2b1f79210acda41bed5fd8c1c398d172546000313a6e6aa39238173b204635ed80d04b5c2081c7edad632330a979ce24e6213ad5c

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\x
Filesize
4KB

MD5
c6e68ff1dc039af122429c3c5418630f

SHA1
771938ab02aaf6714782ea1c70420794848b1d9c

SHA256
b18e0bb23b9b78ca561b9499853ec5be84f67fcb7db5c7e207c6da1b89c17dbb

SHA512
837b8b31d381030b79a1b85449238b8770999dde21dd705aec81a0205cfc40cb2f65fb7877de479bae9ca96c1233a62078332c93db764389bd6f26985b61c9b7

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\x
Filesize
10KB

MD5
fc59b7d2eb1edbb9c8cb9eb08115a98e

SHA1
90a6479ce14f8548df54c434c0a524e25efd9d17

SHA256
a05b9be9dd87492f265094146e18d628744c6b09c0e7efaabf228a9f1091a279

SHA512
3392cfc0dbddb37932e76da5a49f4e010a49aaa863c882b85cccab676cd458cfc8f880d8a0e0dc7581175f447e6b0a002da1591ecd14756650bb74996eacd2b1

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\x.js
Filesize
448B

MD5
8eec8704d2a7bc80b95b7460c06f4854

SHA1
1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

SHA256
aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

SHA512
e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\x.js
Filesize
448B

MD5
8eec8704d2a7bc80b95b7460c06f4854

SHA1
1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

SHA256
aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

SHA512
e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\z.zip
Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\Users\Admin\Downloads\MEMZ 3.0 (1)\MEMZ 3.0\z.zip
Filesize
7KB

MD5
cf0c19ef6909e5c1f10c8460ba9299d8

SHA1
875b575c124acfc1a4a21c1e05acb9690e50b880

SHA256
abb834ebd4b7d7f8ddf545976818f41b3cb51d2b895038a56457616d3a2c6776

SHA512
d930a022a373c283f35d103e277487c2034a0b0814913b8f6ec695b45e20528667aa830eeab58e4483d523bd6a755a16a5379095cb137db6c91909a545a19a2f

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\crashpad_4880_XIICKKQOTYEOQOXE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/96-499-0x00000000013E0000-0x00000000013F0000-memory.dmp

Filesize
64KB

Download
memory/2820-992-0x0000000001610000-0x0000000001620000-memory.dmp

Filesize
64KB

Download
memory/3048-154-0x0000000000EA0000-0x0000000000EB0000-memory.dmp

Filesize
64KB

Download
memory/3056-489-0x0000000001180000-0x0000000001190000-memory.dmp

Filesize
64KB

Download
memory/3088-217-0x000000001B3F0000-0x000000001B400000-memory.dmp

Filesize
64KB

Download
memory/3540-707-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/3908-701-0x000000001B260000-0x000000001B270000-memory.dmp

Filesize
64KB

Download
memory/3956-162-0x000000001B2F0000-0x000000001B300000-memory.dmp

Filesize
64KB

Download
memory/3988-449-0x000000001BEF0000-0x000000001BF00000-memory.dmp

Filesize
64KB

Download
memory/3992-713-0x000000001BBA0000-0x000000001BBB0000-memory.dmp

Filesize
64KB

Download
memory/4104-795-0x000001D1CC880000-0x000001D1CC980000-memory.dmp

Filesize
1024KB

Download
memory/4104-832-0x000001D1CC990000-0x000001D1CC992000-memory.dmp

Filesize
8KB

Download
memory/4104-783-0x000001D1CCD80000-0x000001D1CCD82000-memory.dmp

Filesize
8KB

Download
memory/4104-785-0x000001D1CCDA0000-0x000001D1CCDA2000-memory.dmp

Filesize
8KB

Download
memory/4104-787-0x000001D1CCDC0000-0x000001D1CCDC2000-memory.dmp

Filesize
8KB

Download
memory/4104-789-0x000001D1CCDE0000-0x000001D1CCDE2000-memory.dmp

Filesize
8KB

Download
memory/4104-791-0x000001D1CCFA0000-0x000001D1CCFA2000-memory.dmp

Filesize
8KB

Download
memory/4104-793-0x000001D1CCFC0000-0x000001D1CCFC2000-memory.dmp

Filesize
8KB

Download
memory/4104-834-0x000001D1CC9A0000-0x000001D1CC9A2000-memory.dmp

Filesize
8KB

Download
memory/4104-800-0x000001D1CDA00000-0x000001D1CDA02000-memory.dmp

Filesize
8KB

Download
memory/4104-798-0x000001D1CD360000-0x000001D1CD380000-memory.dmp

Filesize
128KB

Download
memory/4104-803-0x000001D1CDA20000-0x000001D1CDA22000-memory.dmp

Filesize
8KB

Download
memory/4104-806-0x000001D1CDDE0000-0x000001D1CDDE2000-memory.dmp

Filesize
8KB

Download
memory/4124-126-0x000000001B610000-0x000000001B620000-memory.dmp

Filesize
64KB

Download
memory/4124-127-0x000000001B920000-0x000000001B970000-memory.dmp

Filesize
320KB

Download
memory/4124-128-0x000000001BA30000-0x000000001BAE2000-memory.dmp

Filesize
712KB

Download
memory/4132-120-0x000000001B2E0000-0x000000001B2F0000-memory.dmp

Filesize
64KB

Download
memory/4132-119-0x0000000000580000-0x00000000008A4000-memory.dmp

Filesize
3.1MB

Download
memory/4148-867-0x00000000014E0000-0x00000000014F0000-memory.dmp

Filesize
64KB

Download
memory/4368-148-0x000000001B330000-0x000000001B340000-memory.dmp

Filesize
64KB

Download
memory/4504-136-0x000000001B0B0000-0x000000001B0C0000-memory.dmp

Filesize
64KB

Download
memory/4752-142-0x00000000017C0000-0x00000000017D0000-memory.dmp

Filesize
64KB

Download
memory/4812-759-0x000002597BF70000-0x000002597BF72000-memory.dmp

Filesize
8KB

Download
memory/4812-898-0x0000025976790000-0x0000025976791000-memory.dmp

Filesize
4KB

Download
memory/4812-736-0x0000025977D00000-0x0000025977D10000-memory.dmp

Filesize
64KB

Download
memory/4812-894-0x00000259767B0000-0x00000259767B1000-memory.dmp

Filesize
4KB

Download
memory/4812-891-0x0000025977900000-0x0000025977902000-memory.dmp

Filesize
8KB

Download
memory/4812-755-0x00000259767B0000-0x00000259767B1000-memory.dmp

Filesize
4KB

Download
memory/4812-821-0x000002597DC40000-0x000002597DC41000-memory.dmp

Filesize
4KB

Download
memory/4812-760-0x000002597C110000-0x000002597C112000-memory.dmp

Filesize
8KB

Download
memory/4812-757-0x00000259767F0000-0x00000259767F2000-memory.dmp

Filesize
8KB

Download
memory/4812-822-0x000002597DC50000-0x000002597DC51000-memory.dmp

Filesize
4KB

Download
memory/4964-507-0x000000001BC30000-0x000000001BC40000-memory.dmp

Filesize
64KB

Download
memory/5036-413-0x000000001BC30000-0x000000001BC40000-memory.dmp

Filesize
64KB

Download
memory/6084-1336-0x000000001B380000-0x000000001B390000-memory.dmp

Filesize
64KB

Download