fabookie | f6e4e507c58b29c405b98d90f85fe673a56743a8d7a1bd1f371a8d491000cb73

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adcc66edac3435337462e6dfe62b572e.exe
Size

239KB
MD5

adcc66edac3435337462e6dfe62b572e
SHA1

f5ef299eab18ed07fca463d0619ef2d80f274b1d
SHA256

f6e4e507c58b29c405b98d90f85fe673a56743a8d7a1bd1f371a8d491000cb73
SHA512

dd3d63579aa97389351bb05eb6ec21ded86d9304c33ad88b54ab615e0092801b8f7befa9f5f07f81bd80fda342f503c08c24f7e569b50e8c9f8e4aa8374745ac
SSDEEP

6144:ySV46fuYXChoQTjlFgLuCY1dRuAOMAcZ3EOdw8y0:yhYzXChdTbv1buTczw8y

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Extracted

Family

smokeloader

Botnet

up3

Signatures

Detect Fabookie payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5216-315-0x0000000002EB0000-0x0000000002FE1000-memory.dmp	family_fabookie
behavioral2/memory/5216-457-0x0000000002EB0000-0x0000000002FE1000-memory.dmp	family_fabookie

Detect rhadamanthys stealer shellcode 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2260-451-0x0000000002E80000-0x0000000003280000-memory.dmp	family_rhadamanthys
behavioral2/memory/2260-454-0x0000000002E80000-0x0000000003280000-memory.dmp	family_rhadamanthys
behavioral2/memory/2260-453-0x0000000002E80000-0x0000000003280000-memory.dmp	family_rhadamanthys
behavioral2/memory/2260-455-0x0000000002E80000-0x0000000003280000-memory.dmp	family_rhadamanthys

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5404-562-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5580-195-0x0000000000CB0000-0x0000000000E88000-memory.dmp	family_redline
behavioral2/memory/5764-198-0x0000000000800000-0x000000000085A000-memory.dmp	family_redline
behavioral2/memory/5580-243-0x0000000000CB0000-0x0000000000E88000-memory.dmp	family_redline
behavioral2/memory/5816-253-0x0000000000540000-0x000000000059A000-memory.dmp	family_redline

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

AD76.exe

description pid process target process

PID 2260 created 2212 2260 AD76.exe Explorer.EXE
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

description	pid	process	target process
PID 2260 created 2212	2260	AD76.exe	Explorer.EXE

XMRig Miner payload 8 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/5948-568-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/5948-572-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/5948-575-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/5948-599-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/5948-600-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/5948-601-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/5948-602-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig
behavioral2/memory/5948-604-0x0000000140000000-0x00000001407CF000-memory.dmp	xmrig

Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

5232 netsh.exe
3380 netsh.exe

pid	process
5232	netsh.exe
3380	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8876.exekos1.exekos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	8876.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	kos1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	kos.exe

Drops startup file 1 IoCs

Processes:

6jf.exe

description ioc process

File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\6jf.exe 6jf.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\6jf.exe	6jf.exe

Executes dropped EXE 23 IoCs

Processes:

8876.exess41.exetoolspub2.exe8D97.exe31839b57a4f11171d6abc8bbc4451ee4.exekos1.exe94DB.exeset16.exe9B16.exekos.exeis-JHNDL.tmppreviewer.exeAD76.exepreviewer.exeAD76.exetoolspub2.exey2B.exe6jf.exey2B.exey2B.exe6jf.exe6jf.exe6jf.exe

pid	process
228	8876.exe
5216	ss41.exe
5288	toolspub2.exe
5356	8D97.exe
5404	31839b57a4f11171d6abc8bbc4451ee4.exe
5476	kos1.exe
5580	94DB.exe
5704	set16.exe
5816	9B16.exe
5832	kos.exe
5896	is-JHNDL.tmp
4764	previewer.exe
5824	AD76.exe
5480	previewer.exe
2260	AD76.exe
5992	toolspub2.exe
3196	y2B.exe
4156	6jf.exe
2284	y2B.exe
5632	y2B.exe
5404	6jf.exe
1736	6jf.exe
5216	6jf.exe

Loads dropped DLL 3 IoCs

Processes:

is-JHNDL.tmp

pid process

5896 is-JHNDL.tmp
5896 is-JHNDL.tmp
5896 is-JHNDL.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
5896	is-JHNDL.tmp
5896	is-JHNDL.tmp
5896	is-JHNDL.tmp

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

Processes:

certreq.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	certreq.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6jf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6jf = "C:\\Users\\Admin\\AppData\\Local\\6jf.exe"	6jf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6jf = "C:\\Users\\Admin\\AppData\\Local\\6jf.exe"	6jf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

Processes:

6jf.exe

description	ioc	process
File opened for modification	C:\Program Files\desktop.ini	6jf.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-3027552071-446050021-1254071215-1000\desktop.ini	6jf.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3027552071-446050021-1254071215-1000\desktop.ini	6jf.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 9 IoCs

Processes:

adcc66edac3435337462e6dfe62b572e.exe94DB.exe8D97.exeAD76.exetoolspub2.exeaspnet_compiler.exey2B.exe6jf.exe6jf.exe

description	pid	process	target process
PID 4988 set thread context of 4252	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 5580 set thread context of 5764	5580	94DB.exe	vbc.exe
PID 5356 set thread context of 1528	5356	8D97.exe	aspnet_compiler.exe
PID 5824 set thread context of 2260	5824	AD76.exe	AD76.exe
PID 5288 set thread context of 5992	5288	toolspub2.exe	toolspub2.exe
PID 1528 set thread context of 5948	1528	aspnet_compiler.exe	AddInProcess.exe
PID 3196 set thread context of 5632	3196	y2B.exe	y2B.exe
PID 4156 set thread context of 5404	4156	6jf.exe	6jf.exe
PID 1736 set thread context of 5216	1736	6jf.exe	6jf.exe

Drops file in Program Files directory 64 IoCs

Processes:

6jf.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui	6jf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sw.pak	6jf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll	6jf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak	6jf.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui	6jf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	6jf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak	6jf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	6jf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe	6jf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	6jf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nl-NL\tipresx.dll.mui	6jf.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\Java\jdk1.8.0_66\db\bin\ij.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	6jf.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	6jf.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui	6jf.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	6jf.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOLoaderUI.dll.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	6jf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	6jf.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui	6jf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\3RDPARTY	6jf.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado20.tlb	6jf.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\COPYRIGHT	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	6jf.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui	6jf.exe
File opened for modification	C:\Program Files\Internet Explorer\images\bing.ico	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	6jf.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\ConvertFromAssert.ram	6jf.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\tr.pak.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	6jf.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.id[37068CCF-3483].[[email protected]].8base	6jf.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	6jf.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui	6jf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2160 4988 WerFault.exe adcc66edac3435337462e6dfe62b572e.exe

pid	pid_target	process	target process
2160	4988	WerFault.exe	adcc66edac3435337462e6dfe62b572e.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub2.exey2B.exeAppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	y2B.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	y2B.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	y2B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

certreq.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	certreq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	certreq.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

848 vssadmin.exe
Runs net.exe

pid	process
848	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeExplorer.EXE

pid	process
4252	AppLaunch.exe
4252	AppLaunch.exe
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE
2212	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2212 Explorer.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

672
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

AppLaunch.exey2B.exe

pid process

4252 AppLaunch.exe
5632 y2B.exe

pid	process
2212	Explorer.EXE

pid	process
672

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exemsedge.exe

pid	process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXE8D97.exekos.exeaspnet_compiler.exeAD76.exepreviewer.exepreviewer.exe

description	pid	process
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeDebugPrivilege	5356	8D97.exe
Token: SeDebugPrivilege	5832	kos.exe
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeDebugPrivilege	1528	aspnet_compiler.exe
Token: SeDebugPrivilege	5824	AD76.exe
Token: SeDebugPrivilege	4764	previewer.exe
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeDebugPrivilege	5480	previewer.exe
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE
Token: SeShutdownPrivilege	2212	Explorer.EXE
Token: SeCreatePagefilePrivilege	2212	Explorer.EXE

Suspicious use of FindShellTrayWindow 52 IoCs

Processes:

msedge.exemsedge.exeAddInProcess.exe

pid	process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5948	AddInProcess.exe

Suspicious use of SendNotifyMessage 48 IoCs

Processes:

msedge.exemsedge.exe

pid	process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe
5844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

adcc66edac3435337462e6dfe62b572e.exeExplorer.EXEmsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 4988 wrote to memory of 2552	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 2552	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 2552	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 4252	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 4252	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 4252	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 4252	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 4252	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 4988 wrote to memory of 4252	4988	adcc66edac3435337462e6dfe62b572e.exe	AppLaunch.exe
PID 2212 wrote to memory of 4584	2212	Explorer.EXE	cmd.exe
PID 2212 wrote to memory of 4584	2212	Explorer.EXE	cmd.exe
PID 4584 wrote to memory of 1652	4584	msedge.exe	msedge.exe
PID 4584 wrote to memory of 1652	4584	msedge.exe	msedge.exe
PID 4584 wrote to memory of 1940	4584	msedge.exe	msedge.exe
PID 4584 wrote to memory of 1940	4584	msedge.exe	msedge.exe
PID 1940 wrote to memory of 1668	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 1668	1940	msedge.exe	msedge.exe
PID 1652 wrote to memory of 4576	1652	msedge.exe	msedge.exe
PID 1652 wrote to memory of 4576	1652	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 3660	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 1196	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 1196	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 1764	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 1764	1940	msedge.exe	msedge.exe
PID 1940 wrote to memory of 1764	1940	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

Processes:

certreq.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	certreq.exe

outlook_win_path 1 IoCs

Processes:

certreq.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	certreq.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212

C:\Users\Admin\AppData\Local\Temp\adcc66edac3435337462e6dfe62b572e.exe
"C:\Users\Admin\AppData\Local\Temp\adcc66edac3435337462e6dfe62b572e.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 256
3⤵
- Program crash
PID:2160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7B84.bat" "
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff534946f8,0x7fff53494708,0x7fff53494718
4⤵
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
4⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
4⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
4⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
4⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
4⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
4⤵
- Suspicious use of WriteProcessMemory
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
4⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
4⤵
PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
4⤵
PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
4⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
4⤵
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,10028120202431838979,11384302524735898887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
4⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
3⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff534946f8,0x7fff53494708,0x7fff53494718
4⤵
PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,7734662314497098379,16723281387256340226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
4⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,7734662314497098379,16723281387256340226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
4⤵
PID:1472

C:\Users\Admin\AppData\Local\Temp\8876.exe
C:\Users\Admin\AppData\Local\Temp\8876.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:228

C:\Users\Admin\AppData\Local\Temp\ss41.exe
"C:\Users\Admin\AppData\Local\Temp\ss41.exe"
3⤵
- Executes dropped EXE
PID:5216

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5288

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5992

C:\Users\Admin\AppData\Local\Temp\kos1.exe
"C:\Users\Admin\AppData\Local\Temp\kos1.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:5476

C:\Users\Admin\AppData\Local\Temp\set16.exe
"C:\Users\Admin\AppData\Local\Temp\set16.exe"
4⤵
- Executes dropped EXE
PID:5704

C:\Users\Admin\AppData\Local\Temp\is-BSO7J.tmp\is-JHNDL.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BSO7J.tmp\is-JHNDL.tmp" /SL4 $50214 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5896

C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -s
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -i
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 8
6⤵
PID:5656

C:\Users\Admin\AppData\Local\Temp\kos.exe
"C:\Users\Admin\AppData\Local\Temp\kos.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
PID:5404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\8D97.exe
C:\Users\Admin\AppData\Local\Temp\8D97.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RBvfugTGdvfZCHCgvSoHZdsYt2u1JwYhUP.RIG_CPU -p x --cpu-max-threads-hint=50
4⤵
- Suspicious use of FindShellTrayWindow
PID:5948

C:\Users\Admin\AppData\Local\Temp\94DB.exe
C:\Users\Admin\AppData\Local\Temp\94DB.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
3⤵
PID:5764

C:\Users\Admin\AppData\Local\Temp\9B16.exe
C:\Users\Admin\AppData\Local\Temp\9B16.exe
2⤵
- Executes dropped EXE
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9B16.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
4⤵
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
4⤵
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3028 /prefetch:8
4⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
4⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
4⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
4⤵
PID:6032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
4⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
4⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
4⤵
PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
4⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
4⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
4⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
4⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7853379478567650969,3178854338508355923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
4⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9B16.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:840

C:\Users\Admin\AppData\Local\Temp\AD76.exe
C:\Users\Admin\AppData\Local\Temp\AD76.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Users\Admin\AppData\Local\Temp\AD76.exe
C:\Users\Admin\AppData\Local\Temp\AD76.exe
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:2260

C:\Windows\system32\certreq.exe
"C:\Windows\system32\certreq.exe"
2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
PID:368

C:\Users\Admin\AppData\Local\Temp\C4C3.exe
C:\Users\Admin\AppData\Local\Temp\C4C3.exe
2⤵
PID:5716

C:\Users\Admin\AppData\Local\Temp\C4C3.exe
C:\Users\Admin\AppData\Local\Temp\C4C3.exe
3⤵
PID:276

C:\Users\Admin\AppData\Local\Temp\C5DE.exe
C:\Users\Admin\AppData\Local\Temp\C5DE.exe
2⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4988 -ip 4988
1⤵
PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 8
1⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff534946f8,0x7fff53494708,0x7fff53494718
1⤵
PID:5908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff534946f8,0x7fff53494708,0x7fff53494718
1⤵
PID:500

C:\Users\Admin\AppData\Local\Microsoft\y2B.exe
"C:\Users\Admin\AppData\Local\Microsoft\y2B.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3196

C:\Users\Admin\AppData\Local\Microsoft\y2B.exe
C:\Users\Admin\AppData\Local\Microsoft\y2B.exe
2⤵
- Executes dropped EXE
PID:2284

C:\Users\Admin\AppData\Local\Microsoft\y2B.exe
C:\Users\Admin\AppData\Local\Microsoft\y2B.exe
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5632

C:\Users\Admin\AppData\Local\Microsoft\6jf.exe
"C:\Users\Admin\AppData\Local\Microsoft\6jf.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4156

C:\Users\Admin\AppData\Local\Microsoft\6jf.exe
C:\Users\Admin\AppData\Local\Microsoft\6jf.exe
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:5404

C:\Users\Admin\AppData\Local\Microsoft\6jf.exe
"C:\Users\Admin\AppData\Local\Microsoft\6jf.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1736

C:\Users\Admin\AppData\Local\Microsoft\6jf.exe
C:\Users\Admin\AppData\Local\Microsoft\6jf.exe
4⤵
- Executes dropped EXE
PID:5216

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:4676

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:848

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
PID:5920

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
PID:1788

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:5232

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:3380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[37068CCF-3483].[[email protected]].8base

Filesize
3.2MB

MD5
fb40badd97512d6f24f7e510df60b646

SHA1
fb7524091e6af3a93c7bec5fc36b87e61815a3bc

SHA256
866b5e6e2bb2b38a43e6df06638074d4f8c88f3040b52f5cc7c59c7bc40a04e4

SHA512
ece45dfe2b8c40f551a1a07de229a8c2d0c70004ecc72406a2b976707b885009ae24a3f9879c36f5d5e28daf93f4226e1e80c4caf5cf88781340c744d41ea55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
45fe8440c5d976b902cfc89fb780a578

SHA1
5696962f2d0e89d4c561acd58483b0a4ffeab800

SHA256
f620e0b35ac0ead6ed51984859edc75f7d4921aaa90d829bb9ad362d15504f96

SHA512
efe817ea03c203f8e63d7b50a965cb920fb4f128e72b458a7224c0c1373b31fae9eaa55a504290d2bc0cf55c96fd43f295f9aef6c2791a35fc4ab3e965f6ff25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b6cb0cd947496a54b553a297af9e980

SHA1
eda496a57cf579ef088c9b8f55ff89115f2a2759

SHA256
a94520aad20e10bbc314163566db7e3c1182de6b28d6a9eb47750e4bfd9d0a81

SHA512
73b5f6bf6fa7e81bf945ae9b39bb87a932ce7d17d0d5ed21abcdce7a454251db7e015560fadf3ff181d3aa48116428b7dff9bec223ef7a85bb449bb03281cdcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bf009481892dd0d1c49db97428428ede

SHA1
aee4e7e213f6332c1629a701b42335eb1a035c66

SHA256
18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4

SHA512
d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1c9e11f3589a7ac65e9152ddab41493c

SHA1
88e24ebf692d042d066abd784c5e85b148f72ab4

SHA256
69a5d72e773a4c52d09b04a1d5d851dbc3394b93c158c681cbd3810c530dff9c

SHA512
0abe0294454a7645083a38dbb44b9a52592aa3eb33b70178d7c9bfe8370591362a413f771770f9a42c7259317f106474ccd01370278a2d004a7b2ce88321ec36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
4cb6adaaf16d9523fc3780e22226b202

SHA1
6686fd3fba8735b240fca8695fba8fae3a0496dd

SHA256
3bd000215981b8910589343fd4c0ad6a2ebebbcb72fb671effb123d6d3ef2089

SHA512
1e2a8489a670ec931ed3dd09343463d176bf40033b884e53d3e99bf65b6ec309e31c147c26ed193b64090c438c16628944ca3c492c6c1b9342c7ead4987d8d3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1008B

MD5
9f5a05c67291b37ad77139ee231460b1

SHA1
8fe838515fc66c36255c1cde54c08ca9cd06d1c3

SHA256
330dc2be1c8739792d2cf1abdec00d67acc647795069328f804b86912fd6bec0

SHA512
7981420c9af6a7c313bd4298dacfa40ea70b5ab17411291c0b82778a41a0d1f473ebe8f112e7407f02ca579fb27dad9d0545d95b50d7d1f703627430ff0ed261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
9ce0d1f80670273fed1b110b92cb5c89

SHA1
67b1dbfff78a1aa866dbe801aba7b59b496b42c9

SHA256
21e0445f096920c11c27bb8be98bcda00c29a5286665eda6c0013be8ddd9274b

SHA512
35bacbe8e1d9d39df221dbe325fae4140db258d9bad562cb6b52dcacaea38f0547c6b72b2f1561698e2e12d0ddf76206c03b1421fa97ff68b16f3f70b3a059bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
a5b92d8017309329e052b1bc4f265773

SHA1
8d10649b25b60b1c68128a0e88ed4f43a4fe1330

SHA256
1571b1e2543856d892bacd3ff8ffb4b48bb5f82e8f70886c7afd2db0d27b5037

SHA512
d3fc884236175df11c719412a5a2cf69cdcff7c168f87adb39cbc12bfd8208ca25cd73e155da94e99a177b6f5888a6f2be1aae13ac8fc2839b0f2d72a7f17708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5ded8adea62f1ec75d6b0873c231add2

SHA1
f50351defa486c2e2ca0bf4b12b27eedd6a4f227

SHA256
19ffc6f30e5235733eebf420d79d271cb76be13e8707c0b379ee85d66642768d

SHA512
8ce3a4e25ee2133458e38e0627a97559b16970898b9e9976bc59bf9e3cc0c153c5a783231658b56b96c49b59af0cc5648cb8ca3a5b4185b5dabc6770c33ac632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d83cf40093950c0d51eb32c80c6a0d8

SHA1
2a6a5bd31409b600104e44bfb3244753e0ffc19f

SHA256
6d953bf3630b2ba48d7748e09bdf68533ecac8a4c0d4959e5c7299a6636eb3f2

SHA512
f45740b6682a4136515f11b46d0f1253cfad920fcc6a6503341a381e92c080a31c4e8bea5f7be23be060c311316e245b3c390aa17a025ff3be65c77c76c88134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c228fdd214d8077cfa8c6178a3b8997

SHA1
881f62d07cc98b4f6d7166442855b631f6046b0c

SHA256
a31bb2fb859983dc77774623940d3f4e56f046c67bd29ce26d48704a32a8406b

SHA512
1546196babae21c14ad4a3b193be3336cdbcb876673480ea97bf47d5c4306dbeadfacb406c2e22cbd6ff305266ddcb68f2311c90491f4aa13fb0ff1f08f9b738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c3cc2a83bcf76893281092c0874ac3c9

SHA1
c5d366b220f8a5de2e675f351c32bef851f3a1d2

SHA256
fb161ab0eae33062878e851061d64df9a412f4a77d9c62fb8e74b4c6dce2a49d

SHA512
b7982b01ce12624a26c2ac60b665f152b1bf972bd2fa789358bd38a903f60d7c4cc2e8481d6b2f9f9b7bb47df26b3e7f6a28e50b39e39b49537b7b942277e396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c3cc2a83bcf76893281092c0874ac3c9

SHA1
c5d366b220f8a5de2e675f351c32bef851f3a1d2

SHA256
fb161ab0eae33062878e851061d64df9a412f4a77d9c62fb8e74b4c6dce2a49d

SHA512
b7982b01ce12624a26c2ac60b665f152b1bf972bd2fa789358bd38a903f60d7c4cc2e8481d6b2f9f9b7bb47df26b3e7f6a28e50b39e39b49537b7b942277e396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6c828a9a555fbde17e3b0c1c0a33bbe6

SHA1
a92bad2249afed0e971651e45c2fb3523f5ed5b6

SHA256
e53d470dd3f5e57b2e6532b3d992b32ae698844ccd2a4ee548038a637fff447d

SHA512
68d8c43d3f339bc06f343dae50504d0026833cbda7703b977fcdcfa3e24326161bb5819554b9dc2772a3788f39920a969d96fce0757b423e1b8c6b0ccac6d6e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b690c7643af8bf5f3a96b59e33522135

SHA1
204ca48a942ecba4d2f2ef844275c3f5905ed453

SHA256
4577c23a112c820b430e2b16d0283f4715b06f64164e1e5bf883034a7201c695

SHA512
f690f6f5cb19c2e7338feda4741c47b107e48e86db530829cff7e4a0737b813051d31625b1f3108bf8a2f496fad14767b6c255bc816a3e8a3bc43d4c2b63036d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
25ac77f8c7c7b76b93c8346e41b89a95

SHA1
5a8f769162bab0a75b1014fb8b94f9bb1fb7970a

SHA256
8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b

SHA512
df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
a45e5f15e57ae6660683052fb0be6f2c

SHA1
ed7edd8a8743484fd886dc03adbf6dc091201f4f

SHA256
d120aa000d4e5726ed765d3de18fb38acb1030382f097a1605472511a13f0531

SHA512
998dec75fcb94d26f7939518d27712fd82fa26607e0fad29cd307d2b19d990b9116870e48143cfa0f131e706f4f1411cd19725e949d8e34303eab057d722b08d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a06737554b6a04078d2fdadb3ab67fda

SHA1
7de6d97627df43c9aa5533a90cb987df21d6e6e5

SHA256
110e3637d7f37c69acdd0a208bc3e816ff105bc3530ca2083d30838a513516de

SHA512
8e675c84eed30f872ccf996dc898af9d26566e733bb1a27bbd4b1edf1ef40d9c922fa3064abca2421f6339cfded19739374a792a5a66b66a483dd7c88ac49044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
97615ac55618fc883d36db48ecac6b4a

SHA1
3c67dcff1fdf249590e149975927d5d1f6289423

SHA256
d52410db5cbebcc12263fbaac80605abea6444013a1089bf367fdeb0a0f9e924

SHA512
dc401d143520c68e55e02023fa3ec2bd4be441346ec23c7422537553b959cf6bd985c0e5357aa6e39f00abcf5922818086a2d018cc7d9a4849513915a1229569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
7d6ef156d027e057ac66bd67112d61c0

SHA1
613d24ed804ef818a0a9e992e30bd3e72ef84c66

SHA256
65a5c357e50f84298a0abf5ad0d254faa43dd287e1449c4364a7ab52e71df6fb

SHA512
a986303ca100bf2e96b0009d045d16828f556bd6eabc60653979e8a4d4ef62930ecae2b8ba4fb6ba65a4c59729d59bae06b32ab8e72c65a8840e09920933d84e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
d92a05e1548280a4000d48d198964baf

SHA1
821a51a976d9341ed84f24608e82a08077310314

SHA256
b663548e7dc3697267093ab8ae100fe2d04cadb8bfb3d95916434a473d388502

SHA512
1977040a3b17e2dc077c937f14f1c8f001208540cd6b06c4281f54674485a3492b58fd24e18a734a760f571c34a60d9ee33be0cc0989696ecb83e8a754edb624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
25ad1df3417665298747f442fbdfd1c9

SHA1
d54f4fcdcba826b610c567057f7150b16919b0ab

SHA256
7848ad4817e8876be162d7271b8ee96f384e0394352b71349e6c107bfd6ab8c0

SHA512
2f6dd8ed23cd38801cf7273a5c85a0f12eb7efd0c92f94f1d7379b42942a3b0aa89fee4ea57efa603c649eb5b721d80d68dd6ade291e9f230522e20925b4a47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
17KB

MD5
6bc4851424575eaf03ebe2efee6073ab

SHA1
2d014fe2feb929d03a46322645a94556ca5c9e96

SHA256
abaded8e235fdf329521806af30a1cc7701eaca3fe2efccb9da760ec6d8e5e4e

SHA512
af3b7d93fa2243475d74d4bd7f918ce2706bf6eca28029b9e49869f5f793e483efaafdfab1fed6306d5fc77a5ed3b27097b27448cd04560bed4df6fa3268ccf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002

Filesize
17KB

MD5
fc97b88a7ce0b008366cd0260b0321dc

SHA1
4eae02aecb04fa15f0bb62036151fa016e64f7a9

SHA256
6388415a307a208b0a43b817ccd9e5fcdda9b6939ecd20ef4c0eda1aa3a0e49e

SHA512
889a0db0eb5ad4de4279b620783964bfda8edc6b137059d1ec1da9282716fe930f8c4ebfadea7cd5247a997f8d4d2990f7b972a17106de491365e3c2d2138175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ec99b90e5189c3cdd64e5cd9ef46fae7

SHA1
0ec084ad4bc0c41ec600aa8005d344e0a043ebb1

SHA256
b4c75012081628b669c6ed0ff1712f16d18731d63e83ae6f63cac7ea6e37dee9

SHA512
d74ec260e70a9eeb901657c857b4425be060223f5c883430097d1333da8faa53fb4c1c857097b48a32c873b1d3c7b5f32eb58fee98d3ecf0270c5a333f83f871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36139efd7b90aed73ed380b85491ab41

SHA1
07748614bb7740885f26d794dd4acb333303a6ea

SHA256
ad0abd593bcc1c21d6c354fa1899891d11921e06444e4edb301cb74b61882132

SHA512
d864b2f91c713d05511aa201f120cac8abc6496ac9c3ce63089943c8335990bc53ec6429652ca922c2a109d9371d1d3e383e9511114d2142b5a73535098a990a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a9432c275dbb89265e2db983ef768a7

SHA1
197ef1071c004b49590442532bc7b36b5732ef63

SHA256
d48b256394620a2436e5d52112ce33f8b1bc1fa686d7e182622c3359205ccce9

SHA512
ddf32316188dd05866f18a5214a09a8de60af4614a081a04aae96355c94f034489ad9990ce79a171e77f274f42a02e68156682a062eae6b4a98bbe0ca18fa7b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5ea8b5468f848c13f423380759b28ace

SHA1
4881c36422a715eca8a677230e049ace940845fd

SHA256
a05771754c2ec25a8a0eb346e99691087ae0019350c89693241b58a48b28ffc7

SHA512
dae5056d67a09ff1833822f882ef2daaabac0ea16a371328f15190451c10ea5c061fd06f8409d0627587078b1754b85207804981e02dd0e4f2337e72be21a05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5ea8b5468f848c13f423380759b28ace

SHA1
4881c36422a715eca8a677230e049ace940845fd

SHA256
a05771754c2ec25a8a0eb346e99691087ae0019350c89693241b58a48b28ffc7

SHA512
dae5056d67a09ff1833822f882ef2daaabac0ea16a371328f15190451c10ea5c061fd06f8409d0627587078b1754b85207804981e02dd0e4f2337e72be21a05e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36139efd7b90aed73ed380b85491ab41

SHA1
07748614bb7740885f26d794dd4acb333303a6ea

SHA256
ad0abd593bcc1c21d6c354fa1899891d11921e06444e4edb301cb74b61882132

SHA512
d864b2f91c713d05511aa201f120cac8abc6496ac9c3ce63089943c8335990bc53ec6429652ca922c2a109d9371d1d3e383e9511114d2142b5a73535098a990a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
d974162e0cccb469e745708ced4124c0

SHA1
2749ebc0ddaa6ae0c59c1f92f6dbb509cc0f5929

SHA256
77793c069040127f89af88feb293829bd66c1df811b31d5b709868f0c9dd1df5

SHA512
ab716b96f09c5a8c1a957c209ed13958f5a21abcd488437aab8f1b1107e758207e3a51c264b39463256bf58a2266de771fa73477b0555be6cc4221f84e3684a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
d974162e0cccb469e745708ced4124c0

SHA1
2749ebc0ddaa6ae0c59c1f92f6dbb509cc0f5929

SHA256
77793c069040127f89af88feb293829bd66c1df811b31d5b709868f0c9dd1df5

SHA512
ab716b96f09c5a8c1a957c209ed13958f5a21abcd488437aab8f1b1107e758207e3a51c264b39463256bf58a2266de771fa73477b0555be6cc4221f84e3684a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
d974162e0cccb469e745708ced4124c0

SHA1
2749ebc0ddaa6ae0c59c1f92f6dbb509cc0f5929

SHA256
77793c069040127f89af88feb293829bd66c1df811b31d5b709868f0c9dd1df5

SHA512
ab716b96f09c5a8c1a957c209ed13958f5a21abcd488437aab8f1b1107e758207e3a51c264b39463256bf58a2266de771fa73477b0555be6cc4221f84e3684a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7B84.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\8876.exe

Filesize
6.5MB

MD5
6b254caca548f0be01842a0c4bd4c649

SHA1
79bbeed18d08c3010e8954f6d5c9f52967dcc32e

SHA256
01a7afff3220c1a442e3b8bc41dbf4036e9c223f9aab374265d9beae0709e434

SHA512
b69f8c71f2b71268150cc74e8e842b6526e87c5e944d163bb3def85cc919428c249a733ca9bbefc4cf4b80a8dbf6961b8e6f0333194713faf10551b8eb97d3ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\8876.exe

Filesize
6.5MB

MD5
6b254caca548f0be01842a0c4bd4c649

SHA1
79bbeed18d08c3010e8954f6d5c9f52967dcc32e

SHA256
01a7afff3220c1a442e3b8bc41dbf4036e9c223f9aab374265d9beae0709e434

SHA512
b69f8c71f2b71268150cc74e8e842b6526e87c5e944d163bb3def85cc919428c249a733ca9bbefc4cf4b80a8dbf6961b8e6f0333194713faf10551b8eb97d3ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D97.exe

Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D97.exe

Filesize
894KB

MD5
ef11a166e73f258d4159c1904485623c

SHA1
bc1f4c685f4ec4f617f79e3f3f8c82564cccfc4e

SHA256
dc24474e1211ef4554c63f4d70380cc71063466c3d0a07e1a4d0726e0f587747

SHA512
2db0b963f92ce1f0b965011f250361e0951702267e8502a7648a726c407941e6b95abb360545e61ff7914c66258ee33a86766b877da3ad4603d68901fbd95708

Download Submit
C:\Users\Admin\AppData\Local\Temp\94DB.exe

Filesize
1.5MB

MD5
52c2f13a9fa292d1f32439dde355ff71

SHA1
03a9aa82a8070de26b9a347cfbd4090fd239f8df

SHA256
020c6da8f2bbd3a3f15dcbc8808255c2650df37f2b499b680e69d9e3cb1c1316

SHA512
097d5415d7ed0ebb6b6f89cc38b29471a47ef99df79e7c6b0b01592174dfb115abdf496126bb7177527c252803bcc53a31b8c40d2f1aa65fae4331b5afe9e36a

Download Submit
C:\Users\Admin\AppData\Local\Temp\94DB.exe

Filesize
1.5MB

MD5
52c2f13a9fa292d1f32439dde355ff71

SHA1
03a9aa82a8070de26b9a347cfbd4090fd239f8df

SHA256
020c6da8f2bbd3a3f15dcbc8808255c2650df37f2b499b680e69d9e3cb1c1316

SHA512
097d5415d7ed0ebb6b6f89cc38b29471a47ef99df79e7c6b0b01592174dfb115abdf496126bb7177527c252803bcc53a31b8c40d2f1aa65fae4331b5afe9e36a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B16.exe

Filesize
415KB

MD5
bf58b6afac98febc716a85be5b8e9d9e

SHA1
4a36385b3f8e8a84a995826d77fcd8e76eba7328

SHA256
16b88051fd1e27d08d1408bb51002dd25edb88292807a92ee25ba5f4c0895b8d

SHA512
a3f8deabbb35e4d4928ec6cf836cdef1a57aed879ce10646d3f8cd9cccf93c0c80c89d1e82dc6c9c558f61429eb6416f5ecd8235f8933f90db6bb46f7cf165ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\9B16.exe

Filesize
415KB

MD5
bf58b6afac98febc716a85be5b8e9d9e

SHA1
4a36385b3f8e8a84a995826d77fcd8e76eba7328

SHA256
16b88051fd1e27d08d1408bb51002dd25edb88292807a92ee25ba5f4c0895b8d

SHA512
a3f8deabbb35e4d4928ec6cf836cdef1a57aed879ce10646d3f8cd9cccf93c0c80c89d1e82dc6c9c558f61429eb6416f5ecd8235f8933f90db6bb46f7cf165ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD76.exe

Filesize
1.9MB

MD5
1b87684768db892932be3f0661c54251

SHA1
e5acdb93f6eb75656c9a8242e21b01bf978dc7cf

SHA256
65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

SHA512
0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD76.exe

Filesize
1.9MB

MD5
1b87684768db892932be3f0661c54251

SHA1
e5acdb93f6eb75656c9a8242e21b01bf978dc7cf

SHA256
65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

SHA512
0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD76.exe

Filesize
1.9MB

MD5
1b87684768db892932be3f0661c54251

SHA1
e5acdb93f6eb75656c9a8242e21b01bf978dc7cf

SHA256
65fcd66d75c64db0f8b7819431d77f83a421e9fd210ff6bdf74c47e7a4c39636

SHA512
0fc3cc6ed99e45a3d1ca7cd2dd4d7bfc2f5f11ee7cf0e3d58bfbb4db26f16599cae45b96fc032cd6a050c1ea70bfd02291537088168dd149eee85b38d2527a82

Download Submit
C:\Users\Admin\AppData\Local\Temp\C4C3.exe

Filesize
262KB

MD5
5d2b3f808075ab6e605f4242d9c7a398

SHA1
2b0d4edf8ab7b84e7f8b5e05a18b39bf3ee5cf5b

SHA256
32d1458fb5c0c08156568a658f30143786336a73dea1d76bef9becf4a55c0964

SHA512
901a107dd865c14752cc61cfe9a08c5b50729a49d47b7010a03f44f5f3d51d9909c162bdd330771d9aa27f462f085fb2307543a8a28a62b46ed68ac7c037f797

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
116B

MD5
ec6aae2bb7d8781226ea61adca8f0586

SHA1
d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

SHA256
b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

SHA512
aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hzuvwrt4.j3p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BSO7J.tmp\is-JHNDL.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BSO7J.tmp\is-JHNDL.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CCJ00.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CCJ00.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CCJ00.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
860KB

MD5
2527628a2b3b4343c614e48132ab3edb

SHA1
0d60f573a21251dcfd61d28a7a0566dc29d38aa6

SHA256
04ce968bedd7f177b35e130887aee1ec599e3d7b72f45f370f3ade343950b6bf

SHA512
416b0990011e24ba2d03d3859b63a2b2ba4494aafeb6cd27efd335055ab063bd677902b74faa1162493dae827a96ef768b957f8a407d25902c067a13a8718dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
860KB

MD5
2527628a2b3b4343c614e48132ab3edb

SHA1
0d60f573a21251dcfd61d28a7a0566dc29d38aa6

SHA256
04ce968bedd7f177b35e130887aee1ec599e3d7b72f45f370f3ade343950b6bf

SHA512
416b0990011e24ba2d03d3859b63a2b2ba4494aafeb6cd27efd335055ab063bd677902b74faa1162493dae827a96ef768b957f8a407d25902c067a13a8718dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
860KB

MD5
2527628a2b3b4343c614e48132ab3edb

SHA1
0d60f573a21251dcfd61d28a7a0566dc29d38aa6

SHA256
04ce968bedd7f177b35e130887aee1ec599e3d7b72f45f370f3ade343950b6bf

SHA512
416b0990011e24ba2d03d3859b63a2b2ba4494aafeb6cd27efd335055ab063bd677902b74faa1162493dae827a96ef768b957f8a407d25902c067a13a8718dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
186KB

MD5
f0ba7739cc07608c54312e79abaf9ece

SHA1
38b075b2e04bc8eee78b89766c1cede5ad889a7e

SHA256
9e96d77f013c6ca17f641c947be11a1bb8921937ed79ec98c4b49ef4c641ae5f

SHA512
15da0554fdd9fb80325883344349b3b4d7b5a612c13eecb810c488621f805ab59c159a54c526ae92f1b81064949bf408f9f2ad07a4c8eda424b2a8f89ea6e165

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
186KB

MD5
f0ba7739cc07608c54312e79abaf9ece

SHA1
38b075b2e04bc8eee78b89766c1cede5ad889a7e

SHA256
9e96d77f013c6ca17f641c947be11a1bb8921937ed79ec98c4b49ef4c641ae5f

SHA512
15da0554fdd9fb80325883344349b3b4d7b5a612c13eecb810c488621f805ab59c159a54c526ae92f1b81064949bf408f9f2ad07a4c8eda424b2a8f89ea6e165

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
186KB

MD5
f0ba7739cc07608c54312e79abaf9ece

SHA1
38b075b2e04bc8eee78b89766c1cede5ad889a7e

SHA256
9e96d77f013c6ca17f641c947be11a1bb8921937ed79ec98c4b49ef4c641ae5f

SHA512
15da0554fdd9fb80325883344349b3b4d7b5a612c13eecb810c488621f805ab59c159a54c526ae92f1b81064949bf408f9f2ad07a4c8eda424b2a8f89ea6e165

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
186KB

MD5
f0ba7739cc07608c54312e79abaf9ece

SHA1
38b075b2e04bc8eee78b89766c1cede5ad889a7e

SHA256
9e96d77f013c6ca17f641c947be11a1bb8921937ed79ec98c4b49ef4c641ae5f

SHA512
15da0554fdd9fb80325883344349b3b4d7b5a612c13eecb810c488621f805ab59c159a54c526ae92f1b81064949bf408f9f2ad07a4c8eda424b2a8f89ea6e165

Download Submit
\??\pipe\LOCAL\crashpad_1652_WHZWYQOFLJHAXUPO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_1940_CFLFOTIMTJBKDBWS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/368-695-0x00007FF4DD7E0000-0x00007FF4DD90F000-memory.dmp

Filesize
1.2MB

Download
memory/368-696-0x00007FF4DD7E0000-0x00007FF4DD90F000-memory.dmp

Filesize
1.2MB

Download
memory/368-693-0x00007FF4DD7E0000-0x00007FF4DD90F000-memory.dmp

Filesize
1.2MB

Download
memory/368-694-0x00007FF4DD7E0000-0x00007FF4DD90F000-memory.dmp

Filesize
1.2MB

Download
memory/368-691-0x00000259C9670000-0x00000259C9673000-memory.dmp

Filesize
12KB

Download
memory/368-482-0x00000259C9670000-0x00000259C9673000-memory.dmp

Filesize
12KB

Download
memory/368-692-0x00000259C9710000-0x00000259C9717000-memory.dmp

Filesize
28KB

Download
memory/1528-245-0x000001783BE50000-0x000001783BF52000-memory.dmp

Filesize
1.0MB

Download
memory/1528-251-0x0000017823770000-0x0000017823780000-memory.dmp

Filesize
64KB

Download
memory/1528-414-0x0000017823770000-0x0000017823780000-memory.dmp

Filesize
64KB

Download
memory/1528-268-0x000001783C0C0000-0x000001783C116000-memory.dmp

Filesize
344KB

Download
memory/1528-241-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1528-412-0x00007FFF4F5C0000-0x00007FFF50081000-memory.dmp

Filesize
10.8MB

Download
memory/1528-250-0x00007FFF4F5C0000-0x00007FFF50081000-memory.dmp

Filesize
10.8MB

Download
memory/1528-259-0x0000017823600000-0x0000017823608000-memory.dmp

Filesize
32KB

Download
memory/2212-2-0x0000000002B70000-0x0000000002B86000-memory.dmp

Filesize
88KB

Download
memory/2260-419-0x0000000001030000-0x0000000001037000-memory.dmp

Filesize
28KB

Download
memory/2260-451-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2260-453-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2260-379-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2260-555-0x0000000002DE0000-0x0000000002E16000-memory.dmp

Filesize
216KB

Download
memory/2260-454-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2260-533-0x0000000002DE0000-0x0000000002E16000-memory.dmp

Filesize
216KB

Download
memory/2260-405-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2260-455-0x0000000002E80000-0x0000000003280000-memory.dmp

Filesize
4.0MB

Download
memory/2260-408-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/4252-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4252-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4252-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4764-313-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/4764-303-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/4764-305-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5216-457-0x0000000002EB0000-0x0000000002FE1000-memory.dmp

Filesize
1.2MB

Download
memory/5216-315-0x0000000002EB0000-0x0000000002FE1000-memory.dmp

Filesize
1.2MB

Download
memory/5216-126-0x00007FF62EFF0000-0x00007FF62F0C9000-memory.dmp

Filesize
868KB

Download
memory/5216-312-0x0000000002D30000-0x0000000002EA1000-memory.dmp

Filesize
1.4MB

Download
memory/5356-157-0x00007FFF4F5C0000-0x00007FFF50081000-memory.dmp

Filesize
10.8MB

Download
memory/5356-158-0x0000023E9AFB0000-0x0000023E9B092000-memory.dmp

Filesize
904KB

Download
memory/5356-161-0x0000023E9B090000-0x0000023E9B160000-memory.dmp

Filesize
832KB

Download
memory/5356-163-0x0000023E9B160000-0x0000023E9B170000-memory.dmp

Filesize
64KB

Download
memory/5356-164-0x0000023E80F70000-0x0000023E80FBC000-memory.dmp

Filesize
304KB

Download
memory/5356-145-0x0000023E80A00000-0x0000023E80AE6000-memory.dmp

Filesize
920KB

Download
memory/5356-247-0x00007FFF4F5C0000-0x00007FFF50081000-memory.dmp

Filesize
10.8MB

Download
memory/5404-562-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/5476-160-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/5476-159-0x0000000000E90000-0x0000000001004000-memory.dmp

Filesize
1.5MB

Download
memory/5476-216-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/5480-368-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5480-610-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5480-397-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5480-690-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5580-243-0x0000000000CB0000-0x0000000000E88000-memory.dmp

Filesize
1.8MB

Download
memory/5580-168-0x0000000000CB0000-0x0000000000E88000-memory.dmp

Filesize
1.8MB

Download
memory/5580-195-0x0000000000CB0000-0x0000000000E88000-memory.dmp

Filesize
1.8MB

Download
memory/5704-316-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5704-184-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5764-246-0x0000000007A30000-0x0000000007FD4000-memory.dmp

Filesize
5.6MB

Download
memory/5764-452-0x0000000008E70000-0x0000000008EE6000-memory.dmp

Filesize
472KB

Download
memory/5764-198-0x0000000000800000-0x000000000085A000-memory.dmp

Filesize
360KB

Download
memory/5764-248-0x0000000007520000-0x00000000075B2000-memory.dmp

Filesize
584KB

Download
memory/5764-252-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/5764-407-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/5764-406-0x0000000008050000-0x00000000080B6000-memory.dmp

Filesize
408KB

Download
memory/5764-224-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/5764-291-0x0000000007830000-0x000000000793A000-memory.dmp

Filesize
1.0MB

Download
memory/5764-417-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/5764-420-0x0000000008E20000-0x0000000008E70000-memory.dmp

Filesize
320KB

Download
memory/5764-288-0x0000000007700000-0x0000000007712000-memory.dmp

Filesize
72KB

Download
memory/5764-301-0x0000000007760000-0x000000000779C000-memory.dmp

Filesize
240KB

Download
memory/5764-304-0x00000000077A0000-0x00000000077EC000-memory.dmp

Filesize
304KB

Download
memory/5764-256-0x00000000074B0000-0x00000000074BA000-memory.dmp

Filesize
40KB

Download
memory/5764-263-0x0000000008600000-0x0000000008C18000-memory.dmp

Filesize
6.1MB

Download
memory/5816-253-0x0000000000540000-0x000000000059A000-memory.dmp

Filesize
360KB

Download
memory/5816-254-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/5824-404-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/5824-306-0x00000000737C0000-0x0000000073F70000-memory.dmp

Filesize
7.7MB

Download
memory/5824-302-0x0000000000880000-0x0000000000A66000-memory.dmp

Filesize
1.9MB

Download
memory/5824-307-0x00000000053F0000-0x0000000005468000-memory.dmp

Filesize
480KB

Download
memory/5824-314-0x0000000005470000-0x00000000054D8000-memory.dmp

Filesize
416KB

Download
memory/5824-333-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/5832-410-0x000000001AFE0000-0x000000001AFF0000-memory.dmp

Filesize
64KB

Download
memory/5832-418-0x00007FFF4F5C0000-0x00007FFF50081000-memory.dmp

Filesize
10.8MB

Download
memory/5832-384-0x00007FFF4F5C0000-0x00007FFF50081000-memory.dmp

Filesize
10.8MB

Download
memory/5832-204-0x0000000000320000-0x0000000000328000-memory.dmp

Filesize
32KB

Download
memory/5832-228-0x000000001AFE0000-0x000000001AFF0000-memory.dmp

Filesize
64KB

Download
memory/5832-215-0x00007FFF4F5C0000-0x00007FFF50081000-memory.dmp

Filesize
10.8MB

Download
memory/5896-242-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/5896-416-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/5896-411-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/5948-600-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5948-575-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5948-572-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5948-576-0x0000029A00040000-0x0000029A00060000-memory.dmp

Filesize
128KB

Download
memory/5948-599-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5948-601-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5948-568-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5948-604-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5948-602-0x0000000140000000-0x00000001407CF000-memory.dmp

Filesize
7.8MB

Download
memory/5992-459-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download