fabookie | 87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d

Analysis

max time kernel
150s
max time network
154s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
17/09/2023, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe
Size

261KB
MD5

48fe1fe5da9d6176b0ab4fefbfdb527e
SHA1

762b974a77563fecf0dce068e49c0959fa699411
SHA256

87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d
SHA512

9709fbf603924e568e39c710a6e86e8d0176d88173e19733a5043c769cdf177781fbec12016773396cb4eb106de48775f2503bcf81f72d92a4e9d6aa1bd8d535
SSDEEP

3072:+2yG6IBtVVzkEmJth+9p1ORs+NJ2uvHJ5TMi473cceipyEAeAg0FujDhGfQByGu6:+evJm09zORs+z/TMify9DAOJqQBU8/

Score

10^/10

fabookie redline smokeloader 0305 backdoor google discovery infostealer phishing spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

0305

185.215.113.25:10195

Attributes

auth_value
c86205ff1cc37b2da12f0190adfda52c

Signatures

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral1/memory/4956-182-0x0000000002F20000-0x0000000003051000-memory.dmp	family_fabookie
behavioral1/memory/4956-505-0x0000000002F20000-0x0000000003051000-memory.dmp	family_fabookie

Detected google phishing page
phishing google
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
4188	872C.exe
2696	8AE7.exe
4652	91BE.exe
4956	9401.exe
3552	biwrfus

Loads dropped DLL 2 IoCs

pid	Process
3008	rundll32.exe
2764	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4020 set thread context of 3140	4020	87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe	70

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 109217bc2cebd901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "4cgonuh"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b8206d547ae9d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6237e0667ae9d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "401777517"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 746cf7547ae9d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings	91BE.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e0ca56b9ace9d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\MrtCache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 4081295d7ae9d901	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	AppLaunch.exe
3140	AppLaunch.exe
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found
3176	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3176	Process not Found

Suspicious behavior: MapViewOfSection 11 IoCs

pid	Process
3140	AppLaunch.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeDebugPrivilege	4188	872C.exe
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeDebugPrivilege	3132	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3132	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3132	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3132	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeDebugPrivilege	4248	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4248	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found
Token: SeCreatePagefilePrivilege	3176	Process not Found
Token: SeShutdownPrivilege	3176	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4484	MicrosoftEdge.exe
168	MicrosoftEdgeCP.exe
3132	MicrosoftEdgeCP.exe
168	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 3140	4020	87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe	70
PID 4020 wrote to memory of 3140	4020	87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe	70
PID 4020 wrote to memory of 3140	4020	87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe	70
PID 4020 wrote to memory of 3140	4020	87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe	70
PID 4020 wrote to memory of 3140	4020	87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe	70
PID 4020 wrote to memory of 3140	4020	87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe	70
PID 3176 wrote to memory of 4188	3176	Process not Found	71
PID 3176 wrote to memory of 4188	3176	Process not Found	71
PID 3176 wrote to memory of 4188	3176	Process not Found	71
PID 3176 wrote to memory of 2696	3176	Process not Found	72
PID 3176 wrote to memory of 2696	3176	Process not Found	72
PID 3176 wrote to memory of 2696	3176	Process not Found	72
PID 3176 wrote to memory of 4652	3176	Process not Found	74
PID 3176 wrote to memory of 4652	3176	Process not Found	74
PID 3176 wrote to memory of 4652	3176	Process not Found	74
PID 3176 wrote to memory of 4956	3176	Process not Found	75
PID 3176 wrote to memory of 4956	3176	Process not Found	75
PID 4652 wrote to memory of 4424	4652	91BE.exe	76
PID 4652 wrote to memory of 4424	4652	91BE.exe	76
PID 4652 wrote to memory of 4424	4652	91BE.exe	76
PID 3176 wrote to memory of 4580	3176	Process not Found	79
PID 3176 wrote to memory of 4580	3176	Process not Found	79
PID 4424 wrote to memory of 3008	4424	control.exe	78
PID 4424 wrote to memory of 3008	4424	control.exe	78
PID 4424 wrote to memory of 3008	4424	control.exe	78
PID 3008 wrote to memory of 4176	3008	rundll32.exe	84
PID 3008 wrote to memory of 4176	3008	rundll32.exe	84
PID 4176 wrote to memory of 2764	4176	RunDll32.exe	85
PID 4176 wrote to memory of 2764	4176	RunDll32.exe	85
PID 4176 wrote to memory of 2764	4176	RunDll32.exe	85
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 4960	168	MicrosoftEdgeCP.exe	88
PID 168 wrote to memory of 356	168	MicrosoftEdgeCP.exe	96
PID 168 wrote to memory of 356	168	MicrosoftEdgeCP.exe	96
PID 168 wrote to memory of 356	168	MicrosoftEdgeCP.exe	96
PID 168 wrote to memory of 356	168	MicrosoftEdgeCP.exe	96
PID 168 wrote to memory of 356	168	MicrosoftEdgeCP.exe	96
PID 168 wrote to memory of 356	168	MicrosoftEdgeCP.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe
"C:\Users\Admin\AppData\Local\Temp\87340660059264253c82b226d5224841e31d6ea96aab02b0535b2d6f02280e8d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3140

C:\Users\Admin\AppData\Local\Temp\872C.exe
C:\Users\Admin\AppData\Local\Temp\872C.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Users\Admin\AppData\Local\Temp\8AE7.exe
C:\Users\Admin\AppData\Local\Temp\8AE7.exe
1⤵
- Executes dropped EXE
PID:2696

C:\Users\Admin\AppData\Local\Temp\91BE.exe
C:\Users\Admin\AppData\Local\Temp\91BE.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\BOFwH.CpL",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\BOFwH.CpL",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\BOFwH.CpL",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\BOFwH.CpL",
        5⤵
        Loads dropped DLL
        
        PID:2764

C:\Users\Admin\AppData\Local\Temp\9401.exe
C:\Users\Admin\AppData\Local\Temp\9401.exe
1⤵
- Executes dropped EXE
PID:4956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9615.bat" "
1⤵
- Checks computer location settings
PID:4580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4484

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3600

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:356

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5036

C:\Users\Admin\AppData\Roaming\biwrfus
C:\Users\Admin\AppData\Roaming\biwrfus
1⤵
- Executes dropped EXE
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DZDMTHDJ\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\RUMK9LMH\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\T3LC7A42\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\6B34BDLY.cookie

Filesize
132B

MD5
b08900bbaf335b6d4e8e0fea98f1d81d

SHA1
911312aa4945a0ec693a0dc9cb734d496b6d1d00

SHA256
35d71af66e6c0664b32d791d51a746493bce7fb686c5fdaea071b30000f14c31

SHA512
237f0b2278571f58c1ce6ec2e5ed62d1440e863100580a28b2651472dba2f0ddf055f14eae5ed7e346a681066c99914154fab1a75a8c04292afa7f74656fd384

Download Submit
C:\Users\Admin\AppData\Local\Temp\872C.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\872C.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\8AE7.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\8AE7.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\91BE.exe

Filesize
3.0MB

MD5
e879c1a0565918edfa779112b9fc60c8

SHA1
25724afc100370e42e5942d2da9cfb30dfcc5d94

SHA256
f3d7d911a04592d23fdf4a8995dbc28eab7d7a73c44dc2c9df359369166ef83a

SHA512
e85051466a310331ab769aa187eeefad0aebc0746bbaa48d956c1bb00f573ba634b3eee1a749b956b4c2572c24e95e6c6c3ebacf577880470626f5f33e8c8238

Download Submit
C:\Users\Admin\AppData\Local\Temp\91BE.exe

Filesize
3.0MB

MD5
e879c1a0565918edfa779112b9fc60c8

SHA1
25724afc100370e42e5942d2da9cfb30dfcc5d94

SHA256
f3d7d911a04592d23fdf4a8995dbc28eab7d7a73c44dc2c9df359369166ef83a

SHA512
e85051466a310331ab769aa187eeefad0aebc0746bbaa48d956c1bb00f573ba634b3eee1a749b956b4c2572c24e95e6c6c3ebacf577880470626f5f33e8c8238

Download Submit
C:\Users\Admin\AppData\Local\Temp\9401.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9401.exe

Filesize
298KB

MD5
8bd874c0500c7112d04cfad6fda75524

SHA1
d04a20e3bb7ffe5663f69c870457ad4edeb00192

SHA256
22aa36bd2f8ace8d959f22cf0e99bfe1d3fd655c075aa14a3232fb9e0f35adc2

SHA512
d6c43d5a5d1bfca1dddfb6283eafcd1f274e52812ccfee877298dfc74930fe6a8ec7035f95107600742ef19a630bee3ca3fab1fc7ab3ff717bea8f8c05e384d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\9615.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\BOFwH.CpL

Filesize
2.6MB

MD5
ec759e82a9d369557d1f342f438e8d17

SHA1
fc2adc46989dc2cd3b3a81c70fd1838da7fcbd92

SHA256
bb62b3301d97f04e1bd0e85e40cb06739fe09a6a050efe208365fb0e39bc9316

SHA512
42280bd774051f73cfa8b124bf4699a7fa5b9fa2b29ad6ce2b32d33d162e92bfa1c1bdd79337ad69eccf669cfa41fd4d1a06b69eddb46e347d3dcfa9ab0b9897

Download Submit
C:\Users\Admin\AppData\Roaming\biwrfus

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Roaming\biwrfus

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
\Users\Admin\AppData\Local\Temp\BOfwH.cpl

Filesize
2.6MB

MD5
ec759e82a9d369557d1f342f438e8d17

SHA1
fc2adc46989dc2cd3b3a81c70fd1838da7fcbd92

SHA256
bb62b3301d97f04e1bd0e85e40cb06739fe09a6a050efe208365fb0e39bc9316

SHA512
42280bd774051f73cfa8b124bf4699a7fa5b9fa2b29ad6ce2b32d33d162e92bfa1c1bdd79337ad69eccf669cfa41fd4d1a06b69eddb46e347d3dcfa9ab0b9897

Download Submit
\Users\Admin\AppData\Local\Temp\BOfwH.cpl

Filesize
2.6MB

MD5
ec759e82a9d369557d1f342f438e8d17

SHA1
fc2adc46989dc2cd3b3a81c70fd1838da7fcbd92

SHA256
bb62b3301d97f04e1bd0e85e40cb06739fe09a6a050efe208365fb0e39bc9316

SHA512
42280bd774051f73cfa8b124bf4699a7fa5b9fa2b29ad6ce2b32d33d162e92bfa1c1bdd79337ad69eccf669cfa41fd4d1a06b69eddb46e347d3dcfa9ab0b9897

Download Submit
memory/2696-184-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2696-156-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-60-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2696-44-0x00000000006D0000-0x0000000000700000-memory.dmp

Filesize
192KB

Download
memory/2696-50-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-49-0x0000000002470000-0x0000000002476000-memory.dmp

Filesize
24KB

Download
memory/2764-109-0x00000000030D0000-0x00000000030D6000-memory.dmp

Filesize
24KB

Download
memory/2764-125-0x0000000005360000-0x0000000005445000-memory.dmp

Filesize
916KB

Download
memory/2764-117-0x0000000005260000-0x000000000535D000-memory.dmp

Filesize
1012KB

Download
memory/2764-128-0x0000000005360000-0x0000000005445000-memory.dmp

Filesize
916KB

Download
memory/2764-129-0x0000000005360000-0x0000000005445000-memory.dmp

Filesize
916KB

Download
memory/3008-61-0x0000000004D90000-0x0000000004E8D000-memory.dmp

Filesize
1012KB

Download
memory/3008-103-0x0000000004E90000-0x0000000004F75000-memory.dmp

Filesize
916KB

Download
memory/3008-57-0x0000000002D40000-0x0000000002D46000-memory.dmp

Filesize
24KB

Download
memory/3008-58-0x0000000010000000-0x0000000010296000-memory.dmp

Filesize
2.6MB

Download
memory/3008-73-0x0000000004E90000-0x0000000004F75000-memory.dmp

Filesize
916KB

Download
memory/3008-80-0x0000000004E90000-0x0000000004F75000-memory.dmp

Filesize
916KB

Download
memory/3140-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3140-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3140-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3176-4-0x0000000000450000-0x0000000000466000-memory.dmp

Filesize
88KB

Download
memory/4188-27-0x0000000007EF0000-0x0000000007F02000-memory.dmp

Filesize
72KB

Download
memory/4188-28-0x00000000085F0000-0x00000000086FA000-memory.dmp

Filesize
1.0MB

Download
memory/4188-93-0x000000000A790000-0x000000000ACBC000-memory.dmp

Filesize
5.2MB

Download
memory/4188-97-0x0000000009FD0000-0x0000000009FEE000-memory.dmp

Filesize
120KB

Download
memory/4188-88-0x0000000009E40000-0x0000000009EB6000-memory.dmp

Filesize
472KB

Download
memory/4188-102-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/4188-17-0x00000000080F0000-0x00000000085EE000-memory.dmp

Filesize
5.0MB

Download
memory/4188-30-0x0000000007FD0000-0x000000000801B000-memory.dmp

Filesize
300KB

Download
memory/4188-29-0x0000000007F70000-0x0000000007FAE000-memory.dmp

Filesize
248KB

Download
memory/4188-16-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/4188-118-0x0000000007F60000-0x0000000007F70000-memory.dmp

Filesize
64KB

Download
memory/4188-42-0x00000000087A0000-0x0000000008806000-memory.dmp

Filesize
408KB

Download
memory/4188-26-0x0000000008C00000-0x0000000009206000-memory.dmp

Filesize
6.0MB

Download
memory/4188-25-0x0000000007E30000-0x0000000007E3A000-memory.dmp

Filesize
40KB

Download
memory/4188-24-0x0000000007F60000-0x0000000007F70000-memory.dmp

Filesize
64KB

Download
memory/4188-91-0x000000000A090000-0x000000000A252000-memory.dmp

Filesize
1.8MB

Download
memory/4188-15-0x0000000000F50000-0x0000000000FAA000-memory.dmp

Filesize
360KB

Download
memory/4188-22-0x0000000007CD0000-0x0000000007D62000-memory.dmp

Filesize
584KB

Download
memory/4188-518-0x00000000740B0000-0x000000007479E000-memory.dmp

Filesize
6.9MB

Download
memory/4484-107-0x000001921F320000-0x000001921F322000-memory.dmp

Filesize
8KB

Download
memory/4484-82-0x0000019220900000-0x0000019220910000-memory.dmp

Filesize
64KB

Download
memory/4484-62-0x0000019220020000-0x0000019220030000-memory.dmp

Filesize
64KB

Download
memory/4956-175-0x0000000002DA0000-0x0000000002F11000-memory.dmp

Filesize
1.4MB

Download
memory/4956-505-0x0000000002F20000-0x0000000003051000-memory.dmp

Filesize
1.2MB

Download
memory/4956-182-0x0000000002F20000-0x0000000003051000-memory.dmp

Filesize
1.2MB

Download
memory/4956-41-0x00007FF60C290000-0x00007FF60C2DE000-memory.dmp

Filesize
312KB

Download
memory/4960-434-0x000001D63C1E0000-0x000001D63C1E2000-memory.dmp

Filesize
8KB

Download
memory/4960-431-0x000001D63BBE0000-0x000001D63BBE2000-memory.dmp

Filesize
8KB

Download
memory/4960-422-0x000001D63BBD0000-0x000001D63BBD2000-memory.dmp

Filesize
8KB

Download
memory/4960-417-0x000001D63B170000-0x000001D63B172000-memory.dmp

Filesize
8KB

Download
memory/4960-297-0x000001D63BB40000-0x000001D63BB60000-memory.dmp

Filesize
128KB

Download
memory/4960-287-0x000001D63BF00000-0x000001D63C000000-memory.dmp

Filesize
1024KB

Download