dcrat | d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789

Analysis

max time kernel
107s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2023 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe
Size

883KB
MD5

f05a9889603ecec5591bf50c07117941
SHA1

aa9ffd8ed66b23d0f0b478e19997f6148abcd605
SHA256

d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789
SHA512

ca76cd1672094fadbef98cf9537d226990211a5b8b6a0a60334668f5219660c1a11d21895b2005308d1138e599079b1264a550f1d50b598b28a3d9ed83dbcd23
SSDEEP

12288:0+XAoDKeDW9g145x58OpGH2EJ/qdDyyZpxThSGu4ywpRXI/9:04dW9g145x58Opc/yVzSQXw9

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

redline

Botnet

luate

77.91.124.55:19071

Attributes

auth_value
e45cd419aba6c9d372088ffe5629308b

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

DcRat 3 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Processes:

schtasks.exeAppLaunch.exeschtasks.exe

pid process

4412 schtasks.exe
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe
4792 schtasks.exe

pid	process
4412	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
4792	schtasks.exe

Detect Fabookie payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4428-267-0x0000000003780000-0x00000000038B1000-memory.dmp	family_fabookie

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2316-68-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2140-184-0x0000000004B40000-0x000000000542B000-memory.dmp	family_glupteba
behavioral1/memory/2140-209-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/2140-262-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/2140-409-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/2140-477-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/3200-565-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/3200-584-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/2320-678-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4220-79-0x00000000007E0000-0x000000000083A000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\698B.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\698B.exe	family_redline
behavioral1/memory/4648-101-0x0000000000020000-0x000000000007A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

4712 netsh.exe

pid	process
4712	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

kos.exe65B1.exekos1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	kos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	65B1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	kos1.exe

Executes dropped EXE 25 IoCs

Processes:

4590.exe46E8.exex4835485.exex5615539.exe498A.exex1377404.exeg8676483.exe4B60.exemsedge.exe5574.exe65B1.exe698B.exeh7685267.exess41.exemsedge.exe31839b57a4f11171d6abc8bbc4451ee4.exekos1.exetoolspub2.exeset16.exekos.exeis-O307E.tmppreviewer.exepreviewer.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exe

pid	process
844	4590.exe
640	46E8.exe
3668	x4835485.exe
4952	x5615539.exe
4704	498A.exe
3608	x1377404.exe
3124	g8676483.exe
3836	4B60.exe
3440	msedge.exe
4220	5574.exe
4208	65B1.exe
4648	698B.exe
1892	h7685267.exe
4428	ss41.exe
3940	msedge.exe
2140	31839b57a4f11171d6abc8bbc4451ee4.exe
1712	kos1.exe
4076	toolspub2.exe
5072	set16.exe
4688	kos.exe
4192	is-O307E.tmp
5300	previewer.exe
5560	previewer.exe
3200	31839b57a4f11171d6abc8bbc4451ee4.exe
2320	csrss.exe

Loads dropped DLL 5 IoCs

Processes:

5574.exeis-O307E.tmp

pid process

4220 5574.exe
4220 5574.exe
4192 is-O307E.tmp
4192 is-O307E.tmp
4192 is-O307E.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4220	5574.exe
4220	5574.exe
4192	is-O307E.tmp
4192	is-O307E.tmp
4192	is-O307E.tmp

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4590.exex4835485.exex5615539.exex1377404.exe31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4590.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x4835485.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x5615539.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x1377404.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe46E8.exe4B60.exeg8676483.exe498A.exemsedge.exemsedge.exe

description	pid	process	target process
PID 2824 set thread context of 4428	2824	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe	AppLaunch.exe
PID 640 set thread context of 404	640	46E8.exe	AppLaunch.exe
PID 3836 set thread context of 2316	3836	4B60.exe	AppLaunch.exe
PID 3124 set thread context of 4776	3124	g8676483.exe	AppLaunch.exe
PID 4704 set thread context of 1372	4704	498A.exe	AppLaunch.exe
PID 3440 set thread context of 3684	3440	msedge.exe	AppLaunch.exe
PID 3940 set thread context of 4076	3940	msedge.exe	toolspub2.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 7 IoCs

Processes:

is-O307E.tmp

description	ioc	process
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-O307E.tmp
File created	C:\Program Files (x86)\PA Previewer\is-IVLQI.tmp	is-O307E.tmp
File created	C:\Program Files (x86)\PA Previewer\is-94N11.tmp	is-O307E.tmp
File created	C:\Program Files (x86)\PA Previewer\is-BRGQH.tmp	is-O307E.tmp
File created	C:\Program Files (x86)\PA Previewer\is-U2SOD.tmp	is-O307E.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-O307E.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-O307E.tmp

Drops file in Windows directory 2 IoCs

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5292 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5292	sc.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3980	2824	WerFault.exe	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe
4592	640	WerFault.exe	46E8.exe
3508	3836	WerFault.exe	4B60.exe
3944	3124	WerFault.exe	g8676483.exe
2940	4704	WerFault.exe	498A.exe
3184	3440	WerFault.exe	4E30.exe
3388	4220	WerFault.exe	5574.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub2.exeAppLaunch.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4792 schtasks.exe
4412 schtasks.exe

pid	process
4792	schtasks.exe
4412	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exe

pid	process
4428	AppLaunch.exe
4428	AppLaunch.exe
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192
3192

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3192
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

AppLaunch.exetoolspub2.exe

pid process

4428 AppLaunch.exe
4076 toolspub2.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

3476 msedge.exe
3476 msedge.exe
3476 msedge.exe

pid	process
3192

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AppLaunch.exekos.exe

description	pid	process
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeDebugPrivilege	2316	AppLaunch.exe
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeDebugPrivilege	4688	kos.exe
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192
Token: SeShutdownPrivilege	3192
Token: SeCreatePagefilePrivilege	3192

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe4590.exex4835485.exex5615539.exex1377404.exe46E8.exe4B60.exeg8676483.exe

description	pid	process	target process
PID 2824 wrote to memory of 4428	2824	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe	AppLaunch.exe
PID 2824 wrote to memory of 4428	2824	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe	AppLaunch.exe
PID 2824 wrote to memory of 4428	2824	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe	AppLaunch.exe
PID 2824 wrote to memory of 4428	2824	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe	AppLaunch.exe
PID 2824 wrote to memory of 4428	2824	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe	AppLaunch.exe
PID 2824 wrote to memory of 4428	2824	d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe	AppLaunch.exe
PID 3192 wrote to memory of 844	3192		4590.exe
PID 3192 wrote to memory of 844	3192		4590.exe
PID 3192 wrote to memory of 844	3192		4590.exe
PID 3192 wrote to memory of 640	3192		46E8.exe
PID 3192 wrote to memory of 640	3192		46E8.exe
PID 3192 wrote to memory of 640	3192		46E8.exe
PID 844 wrote to memory of 3668	844	4590.exe	x4835485.exe
PID 844 wrote to memory of 3668	844	4590.exe	x4835485.exe
PID 844 wrote to memory of 3668	844	4590.exe	x4835485.exe
PID 3192 wrote to memory of 2196	3192		cmd.exe
PID 3192 wrote to memory of 2196	3192		cmd.exe
PID 3668 wrote to memory of 4952	3668	x4835485.exe	x5615539.exe
PID 3668 wrote to memory of 4952	3668	x4835485.exe	x5615539.exe
PID 3668 wrote to memory of 4952	3668	x4835485.exe	x5615539.exe
PID 3192 wrote to memory of 4704	3192		498A.exe
PID 3192 wrote to memory of 4704	3192		498A.exe
PID 3192 wrote to memory of 4704	3192		498A.exe
PID 4952 wrote to memory of 3608	4952	x5615539.exe	x1377404.exe
PID 4952 wrote to memory of 3608	4952	x5615539.exe	x1377404.exe
PID 4952 wrote to memory of 3608	4952	x5615539.exe	x1377404.exe
PID 3608 wrote to memory of 3124	3608	x1377404.exe	g8676483.exe
PID 3608 wrote to memory of 3124	3608	x1377404.exe	g8676483.exe
PID 3608 wrote to memory of 3124	3608	x1377404.exe	g8676483.exe
PID 3192 wrote to memory of 3836	3192		4B60.exe
PID 3192 wrote to memory of 3836	3192		4B60.exe
PID 3192 wrote to memory of 3836	3192		4B60.exe
PID 3192 wrote to memory of 3440	3192		msedge.exe
PID 3192 wrote to memory of 3440	3192		msedge.exe
PID 3192 wrote to memory of 3440	3192		msedge.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 640 wrote to memory of 404	640	46E8.exe	AppLaunch.exe
PID 3192 wrote to memory of 4220	3192		5574.exe
PID 3192 wrote to memory of 4220	3192		5574.exe
PID 3192 wrote to memory of 4220	3192		5574.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3124 wrote to memory of 3792	3124	g8676483.exe	AppLaunch.exe
PID 3124 wrote to memory of 3792	3124	g8676483.exe	AppLaunch.exe
PID 3124 wrote to memory of 3792	3124	g8676483.exe	AppLaunch.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3836 wrote to memory of 2316	3836	4B60.exe	AppLaunch.exe
PID 3124 wrote to memory of 4276	3124	g8676483.exe	AppLaunch.exe
PID 3124 wrote to memory of 4276	3124	g8676483.exe	AppLaunch.exe
PID 3124 wrote to memory of 4276	3124	g8676483.exe	AppLaunch.exe
PID 3124 wrote to memory of 4776	3124	g8676483.exe	AppLaunch.exe
PID 3124 wrote to memory of 4776	3124	g8676483.exe	AppLaunch.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe
"C:\Users\Admin\AppData\Local\Temp\d9388c538176c9b7c0b39aa7ea7c9260fd1688ddd175608be5dd560e83490789.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 320
2⤵
- Program crash
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2824 -ip 2824
1⤵
PID:4220

C:\Users\Admin\AppData\Local\Temp\4590.exe
C:\Users\Admin\AppData\Local\Temp\4590.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:844

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4835485.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4835485.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3668

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5615539.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5615539.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1377404.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1377404.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3608

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8676483.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8676483.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 608
6⤵
- Program crash
PID:3944

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7685267.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7685267.exe
5⤵
- Executes dropped EXE
PID:1892

C:\Users\Admin\AppData\Local\Temp\46E8.exe
C:\Users\Admin\AppData\Local\Temp\46E8.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 148
2⤵
- Program crash
PID:4592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\47B4.bat" "
1⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb676a46f8,0x7ffb676a4708,0x7ffb676a4718
3⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,1597426988941386347,4202055049481767156,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
3⤵
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,1597426988941386347,4202055049481767156,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
3⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,1597426988941386347,4202055049481767156,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1597426988941386347,4202055049481767156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1597426988941386347,4202055049481767156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
3⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,1597426988941386347,4202055049481767156,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
3⤵
PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
2⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb676a46f8,0x7ffb676a4708,0x7ffb676a4718
3⤵
PID:3604

C:\Users\Admin\AppData\Local\Temp\498A.exe
C:\Users\Admin\AppData\Local\Temp\498A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 148
2⤵
- Program crash
PID:2940

C:\Users\Admin\AppData\Local\Temp\4B60.exe
C:\Users\Admin\AppData\Local\Temp\4B60.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 308
2⤵
- Program crash
PID:3508

C:\Users\Admin\AppData\Local\Temp\4E30.exe
C:\Users\Admin\AppData\Local\Temp\4E30.exe
1⤵
PID:3440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 148
2⤵
- Program crash
PID:3184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 640 -ip 640
1⤵
PID:928

C:\Users\Admin\AppData\Local\Temp\5574.exe
C:\Users\Admin\AppData\Local\Temp\5574.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 772
2⤵
- Program crash
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3836 -ip 3836
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 3124 -ip 3124
1⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4704 -ip 4704
1⤵
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4776 -ip 4776
1⤵
PID:1144

C:\Users\Admin\AppData\Local\Temp\65B1.exe
C:\Users\Admin\AppData\Local\Temp\65B1.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4208

C:\Users\Admin\AppData\Local\Temp\ss41.exe
"C:\Users\Admin\AppData\Local\Temp\ss41.exe"
2⤵
- Executes dropped EXE
PID:4428

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
2⤵
PID:3940

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4076

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
2⤵
- Executes dropped EXE
PID:2140

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
PID:5696

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5124

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
4⤵
PID:1908

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
5⤵
- Modifies Windows Firewall
PID:4712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2068

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
4⤵
- Executes dropped EXE
PID:2320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Modifies data under HKEY_USERS
PID:5668

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- DcRat
- Creates scheduled task(s)
PID:4792

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
5⤵
PID:3320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:5764

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:6028

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
5⤵
PID:6092

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
5⤵
- DcRat
- Creates scheduled task(s)
PID:4412

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
5⤵
PID:5288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
6⤵
PID:1500

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
- Launches sc.exe
PID:5292

C:\Users\Admin\AppData\Local\Temp\kos1.exe
"C:\Users\Admin\AppData\Local\Temp\kos1.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1712

C:\Users\Admin\AppData\Local\Temp\kos.exe
"C:\Users\Admin\AppData\Local\Temp\kos.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Users\Admin\AppData\Local\Temp\set16.exe
"C:\Users\Admin\AppData\Local\Temp\set16.exe"
3⤵
- Executes dropped EXE
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4220 -ip 4220
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3440 -ip 3440
1⤵
PID:4156

C:\Users\Admin\AppData\Local\Temp\698B.exe
C:\Users\Admin\AppData\Local\Temp\698B.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Users\Admin\AppData\Local\Temp\is-9PEN3.tmp\is-O307E.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9PEN3.tmp\is-O307E.tmp" /SL4 $D003A "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:4192

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 8
2⤵
PID:5280

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 8
3⤵
PID:5596

C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -i
2⤵
- Executes dropped EXE
PID:5300

C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -s
2⤵
- Executes dropped EXE
PID:5560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:5272

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe
Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe
Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe
Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a5637ef384a864af2687a7d7808a214b

SHA1
25c086b7e37e9bf22eed99b126f4442dd30cfecd

SHA256
79f04eaa390ef84cfe5c6ae3891f2b15e9c8dcc4f7300e133498d493fea9d7b8

SHA512
ec1935ddedd3dd26430ee04c61dca97712291c096e55513f15ae8769e561ca57775a77cceeeb809809eb769c2e489c9842a77c50ac2f3ecfca0a2936db8fe6ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
17edb49e18b0725617c1b2af21a841bc

SHA1
4da6b6095944503d84df57171209c8f7dd0be133

SHA256
9424b7ccf21de7b5a540f15c001e5c4ea9cb7d50bafa2ecb5f8789a458c4a300

SHA512
774f1b88007c79324915f771105e3e11739223fa6faadcd5a859d60d79c4700013fc8a06d18d01b188806d8387a4d498e28446dd84628713624b991cc845775a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
01808655c624e1752acc157b88d0dc51

SHA1
1d998842efa5b71d79ee050b64e2ac70e75bd130

SHA256
42532506988d749f210bc44b3cb2adf33458116d46d336870933d8711ba87039

SHA512
15df0fe0d702a8d41fdbe95f4d651700f1cb0011ae2501a84e3cbfe17618155f6705636d963b8014f4b16bc1bb835f75f0bc8b098403ec3b64b53327e6a0c0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
deacbaf5385abf0b8620bd8d8b285e34

SHA1
f9048736af2ab16160a978d80c88085334e8c926

SHA256
93c7b8b4a004950b25c5c84ab2a23c072c1f810d1a90d29a6a532938b18f9247

SHA512
2a145609111dd6504eec12fd3b24ecd96b98835363e09c495b9af98e8361399d7cdb1587e6198a751a792e8a11afea9df9e55c2424bca5ab70e99a5519edb9ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
af94b2b9982d0a678c83d361bf58bfaa

SHA1
53cfa5231747bf9deb55dd249be22aaa4e79b440

SHA256
6ee5b995cc9da647ac925130a0cc5d8ccfca81c29468cd6135cddd5e96e50e28

SHA512
7eb320b5991a37375f210ffa9d98fcdf7c511e9baa2564532e7cdc0628d10738b34a16fbff3e9efcab9d40045779a98751e1da743efa1e277da0d35034155975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
af94b2b9982d0a678c83d361bf58bfaa

SHA1
53cfa5231747bf9deb55dd249be22aaa4e79b440

SHA256
6ee5b995cc9da647ac925130a0cc5d8ccfca81c29468cd6135cddd5e96e50e28

SHA512
7eb320b5991a37375f210ffa9d98fcdf7c511e9baa2564532e7cdc0628d10738b34a16fbff3e9efcab9d40045779a98751e1da743efa1e277da0d35034155975

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\4590.exe
Filesize
1.1MB

MD5
11dd5eeddd1c5a8eae4258a5ce11588b

SHA1
4d173b5e48d2a74cc63695b5f7bd1933285aea5d

SHA256
1cf0b6eb2f9c3e4d6260a541e3834d243a3247f2ec2610d955b75f94beb197fb

SHA512
c710bcf98a10285644d500f5b77257a4db745877ae1c79dd6ea877e8e49130ffdf21e0c947e3ac2c8742b163773d32deab6032fdf1ac47beb19f258d5d3db671

Download Submit
C:\Users\Admin\AppData\Local\Temp\4590.exe
Filesize
1.1MB

MD5
11dd5eeddd1c5a8eae4258a5ce11588b

SHA1
4d173b5e48d2a74cc63695b5f7bd1933285aea5d

SHA256
1cf0b6eb2f9c3e4d6260a541e3834d243a3247f2ec2610d955b75f94beb197fb

SHA512
c710bcf98a10285644d500f5b77257a4db745877ae1c79dd6ea877e8e49130ffdf21e0c947e3ac2c8742b163773d32deab6032fdf1ac47beb19f258d5d3db671

Download Submit
C:\Users\Admin\AppData\Local\Temp\46E8.exe
Filesize
1016KB

MD5
f6dd0acbd8878a7733fe9406c640dae7

SHA1
13d258d04038e91059aceb86a024e25c426ffa26

SHA256
584cc7470b9cbbf5045d7e2bee8d6d535e4f50a509eaa2eb34409a5bb1ab89f9

SHA512
1a9ade14b6e99956a01fb3c0f21e92341a9f878ee51ae774dfe701f835a6c94c17cd444d78808afec84ce0ddca6e9bcd2981677f0ce3746d400b32e344117bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\46E8.exe
Filesize
1016KB

MD5
f6dd0acbd8878a7733fe9406c640dae7

SHA1
13d258d04038e91059aceb86a024e25c426ffa26

SHA256
584cc7470b9cbbf5045d7e2bee8d6d535e4f50a509eaa2eb34409a5bb1ab89f9

SHA512
1a9ade14b6e99956a01fb3c0f21e92341a9f878ee51ae774dfe701f835a6c94c17cd444d78808afec84ce0ddca6e9bcd2981677f0ce3746d400b32e344117bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\47B4.bat
Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\498A.exe
Filesize
1.0MB

MD5
be74b3c2069f72cdefeb4affac42f48e

SHA1
abdcba0be6b67111b4ff184a717ed518c5a3caf6

SHA256
55264d5e8490b7aa90f7e471f66efcc2f472399eb30f3ae7135bdc54288b51fb

SHA512
334febf96f997840023158af43ccd7d25a4710c4f553d305c76dafcba0c3965f8d23d2f839d3236124c2ebeda6c7573d0a16400022c25a99698ee6e9172135ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\498A.exe
Filesize
1.0MB

MD5
be74b3c2069f72cdefeb4affac42f48e

SHA1
abdcba0be6b67111b4ff184a717ed518c5a3caf6

SHA256
55264d5e8490b7aa90f7e471f66efcc2f472399eb30f3ae7135bdc54288b51fb

SHA512
334febf96f997840023158af43ccd7d25a4710c4f553d305c76dafcba0c3965f8d23d2f839d3236124c2ebeda6c7573d0a16400022c25a99698ee6e9172135ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\4B60.exe
Filesize
860KB

MD5
6fe9ef544a71f7f994e1f57042c005ad

SHA1
dae887624b2fd2cdfb9f3e9f9fc5fb0f563c2c9d

SHA256
d9ca6bbd8c83a5f220a54c088ec584b2cfb63f9b888e12250674303723bcebdc

SHA512
3be17c4e01bb4c9777ddd091a955147aba26742c3a1c334c5b0313711b7491199b6408c50cd190694c30a7850fe925ebd550d3d473243ec5d71f4830fa0078ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\4B60.exe
Filesize
860KB

MD5
6fe9ef544a71f7f994e1f57042c005ad

SHA1
dae887624b2fd2cdfb9f3e9f9fc5fb0f563c2c9d

SHA256
d9ca6bbd8c83a5f220a54c088ec584b2cfb63f9b888e12250674303723bcebdc

SHA512
3be17c4e01bb4c9777ddd091a955147aba26742c3a1c334c5b0313711b7491199b6408c50cd190694c30a7850fe925ebd550d3d473243ec5d71f4830fa0078ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\4E30.exe
Filesize
1.0MB

MD5
be74b3c2069f72cdefeb4affac42f48e

SHA1
abdcba0be6b67111b4ff184a717ed518c5a3caf6

SHA256
55264d5e8490b7aa90f7e471f66efcc2f472399eb30f3ae7135bdc54288b51fb

SHA512
334febf96f997840023158af43ccd7d25a4710c4f553d305c76dafcba0c3965f8d23d2f839d3236124c2ebeda6c7573d0a16400022c25a99698ee6e9172135ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\4E30.exe
Filesize
1.0MB

MD5
be74b3c2069f72cdefeb4affac42f48e

SHA1
abdcba0be6b67111b4ff184a717ed518c5a3caf6

SHA256
55264d5e8490b7aa90f7e471f66efcc2f472399eb30f3ae7135bdc54288b51fb

SHA512
334febf96f997840023158af43ccd7d25a4710c4f553d305c76dafcba0c3965f8d23d2f839d3236124c2ebeda6c7573d0a16400022c25a99698ee6e9172135ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\4E30.exe
Filesize
1.0MB

MD5
be74b3c2069f72cdefeb4affac42f48e

SHA1
abdcba0be6b67111b4ff184a717ed518c5a3caf6

SHA256
55264d5e8490b7aa90f7e471f66efcc2f472399eb30f3ae7135bdc54288b51fb

SHA512
334febf96f997840023158af43ccd7d25a4710c4f553d305c76dafcba0c3965f8d23d2f839d3236124c2ebeda6c7573d0a16400022c25a99698ee6e9172135ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\5574.exe
Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5574.exe
Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5574.exe
Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5574.exe
Filesize
407KB

MD5
ab42dd45f0015269d23c14792397617f

SHA1
0d6a95083466527b58b87fcfa2ba182758c534b3

SHA256
53bc1e571f46bd27d5eb5130efb564ffaa9644d1f8b5bb23e24e0f1d006ec14f

SHA512
67d76904b2015d2368b272a0c974f712b8840b26aed555b52443a96387b0f95df5ed8523e732261f7ac8916c27a1ce1c3d3e0abc9e0b501efcf83193e91b37a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\65B1.exe
Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\65B1.exe
Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\698B.exe
Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\698B.exe
Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4835485.exe
Filesize
1.0MB

MD5
2070369b448cae3833a28d0cbc099123

SHA1
be0e0c90bd1f6b764b0be2b10eb47a4fd1d3d623

SHA256
8763824be645d79f08f5c788c52e0ee02676024f70488791fc79e91875108f77

SHA512
d868206ca468ba46eafc3575ad7ef4815211aad5ce3d0658b097878fddbf8c33fd6b5443d23232e8ce568c35b33e0a6f29f714da911324b8b91f809e2b49479d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4835485.exe
Filesize
1.0MB

MD5
2070369b448cae3833a28d0cbc099123

SHA1
be0e0c90bd1f6b764b0be2b10eb47a4fd1d3d623

SHA256
8763824be645d79f08f5c788c52e0ee02676024f70488791fc79e91875108f77

SHA512
d868206ca468ba46eafc3575ad7ef4815211aad5ce3d0658b097878fddbf8c33fd6b5443d23232e8ce568c35b33e0a6f29f714da911324b8b91f809e2b49479d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5615539.exe
Filesize
675KB

MD5
6b4e32f26ea7058ca96e0864081ca6c8

SHA1
8242f15d37ce2f148871ca512f37a3ea960f2455

SHA256
3d87dbb059f2c6c808715784b0419e88373d2af5e4e6b85211b1b0cffaa9f910

SHA512
f1d3b4183d311a5c8662f618f20e38b7818459131ababcfc590b58a26d51f17396e538333728958a2aa1973dc3ce1cbaa9dadbfc8c2ac4c7c293c0f536ebba45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5615539.exe
Filesize
675KB

MD5
6b4e32f26ea7058ca96e0864081ca6c8

SHA1
8242f15d37ce2f148871ca512f37a3ea960f2455

SHA256
3d87dbb059f2c6c808715784b0419e88373d2af5e4e6b85211b1b0cffaa9f910

SHA512
f1d3b4183d311a5c8662f618f20e38b7818459131ababcfc590b58a26d51f17396e538333728958a2aa1973dc3ce1cbaa9dadbfc8c2ac4c7c293c0f536ebba45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1377404.exe
Filesize
509KB

MD5
aa9fbc8bd6bb361cddf31396a6ce068d

SHA1
f7e40930b9112f97ab1a621628528cbd7c8af4fd

SHA256
865ae94a056ef600f73c201a68dc4b98f1ef0729c3d17abd406d46a250bd811d

SHA512
11755cd5c2d396fd109b64db809eb9c23d2d8251ae2971f02554eda2e66041342090968ab4b49587210943514e2daf4950be2b0a409251d3d30e59a432df651c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1377404.exe
Filesize
509KB

MD5
aa9fbc8bd6bb361cddf31396a6ce068d

SHA1
f7e40930b9112f97ab1a621628528cbd7c8af4fd

SHA256
865ae94a056ef600f73c201a68dc4b98f1ef0729c3d17abd406d46a250bd811d

SHA512
11755cd5c2d396fd109b64db809eb9c23d2d8251ae2971f02554eda2e66041342090968ab4b49587210943514e2daf4950be2b0a409251d3d30e59a432df651c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8676483.exe
Filesize
1016KB

MD5
f6dd0acbd8878a7733fe9406c640dae7

SHA1
13d258d04038e91059aceb86a024e25c426ffa26

SHA256
584cc7470b9cbbf5045d7e2bee8d6d535e4f50a509eaa2eb34409a5bb1ab89f9

SHA512
1a9ade14b6e99956a01fb3c0f21e92341a9f878ee51ae774dfe701f835a6c94c17cd444d78808afec84ce0ddca6e9bcd2981677f0ce3746d400b32e344117bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8676483.exe
Filesize
1016KB

MD5
f6dd0acbd8878a7733fe9406c640dae7

SHA1
13d258d04038e91059aceb86a024e25c426ffa26

SHA256
584cc7470b9cbbf5045d7e2bee8d6d535e4f50a509eaa2eb34409a5bb1ab89f9

SHA512
1a9ade14b6e99956a01fb3c0f21e92341a9f878ee51ae774dfe701f835a6c94c17cd444d78808afec84ce0ddca6e9bcd2981677f0ce3746d400b32e344117bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8676483.exe
Filesize
1016KB

MD5
f6dd0acbd8878a7733fe9406c640dae7

SHA1
13d258d04038e91059aceb86a024e25c426ffa26

SHA256
584cc7470b9cbbf5045d7e2bee8d6d535e4f50a509eaa2eb34409a5bb1ab89f9

SHA512
1a9ade14b6e99956a01fb3c0f21e92341a9f878ee51ae774dfe701f835a6c94c17cd444d78808afec84ce0ddca6e9bcd2981677f0ce3746d400b32e344117bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7685267.exe
Filesize
174KB

MD5
492b0770857a87e04549fdfe732aa420

SHA1
56147c0ec6e13e15f90c329789f20bc710327bd8

SHA256
f09c367a950c0484cc95c77d63d3f7c4dee58eecf94636dbf2f0816074f2ab4e

SHA512
48a18a42fd90bf7c1609186290a171bb4880bb9192829187542a712066812dd01649880ed6884345d52a4e589943772258b7fcc5280d54500f68141c73fe2f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7685267.exe
Filesize
174KB

MD5
492b0770857a87e04549fdfe732aa420

SHA1
56147c0ec6e13e15f90c329789f20bc710327bd8

SHA256
f09c367a950c0484cc95c77d63d3f7c4dee58eecf94636dbf2f0816074f2ab4e

SHA512
48a18a42fd90bf7c1609186290a171bb4880bb9192829187542a712066812dd01649880ed6884345d52a4e589943772258b7fcc5280d54500f68141c73fe2f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
Filesize
116B

MD5
ec6aae2bb7d8781226ea61adca8f0586

SHA1
d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

SHA256
b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

SHA512
aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jj0twk3e.izw.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9PEN3.tmp\is-O307E.tmp
Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9PEN3.tmp\is-O307E.tmp
Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MQNAU.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MQNAU.tmp\_isetup\_isdecmp.dll
Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MQNAU.tmp\_isetup\_isdecmp.dll
Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe
Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe
Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe
Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe
Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe
Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe
Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe
Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe
Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe
Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe
Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
8b89af2537c448d82c0ad32d9dfb2147

SHA1
9eb6371731c5f5e4e9f284f15b1293b405c62486

SHA256
669e20f277b7733f9851899c5ee459efe58c87d6dcabe5da6099228800c0b9ff

SHA512
0a852ba972f9da4d7e0ef2370513714374f49556c924d06183f2c307fafde9c6e9646b226e04f384e11d63ac55ecbba86b58b3d22c13324a682b00185c30fa54

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
6a1343e258741e44859c3f5ab21f4847

SHA1
bdd4ce414bd6cd5376df6be30316e5c11f2ae39d

SHA256
9a2c90a21a3608273e62c5833706ef7f4e1e7944af1edcd33a6326dd3c1fe002

SHA512
a0e65870babcf6ca58d067cecfd1eba14ff5654943c50f2617249af7e88a8d07e8f5342041587b8546aea391cb93dcc8a3a5d7ba2ef4153803be000466a51fff

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
\??\pipe\LOCAL\crashpad_3476_BNQWBRTVWVJRECVY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/404-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/404-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/404-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/404-61-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/404-84-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1372-78-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/1372-73-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1372-114-0x00000000059D0000-0x0000000005A0C000-memory.dmp

Filesize
240KB

Download
memory/1372-77-0x00000000032A0000-0x00000000032A6000-memory.dmp

Filesize
24KB

Download
memory/1372-120-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/1372-99-0x0000000005FF0000-0x0000000006608000-memory.dmp

Filesize
6.1MB

Download
memory/1372-106-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

Filesize
1.0MB

Download
memory/1372-371-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/1372-108-0x0000000005930000-0x0000000005942000-memory.dmp

Filesize
72KB

Download
memory/1372-112-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/1712-179-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/1712-171-0x00000000004D0000-0x0000000000644000-memory.dmp

Filesize
1.5MB

Download
memory/1712-411-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/1892-398-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/1892-125-0x00000000052A0000-0x00000000052B0000-memory.dmp

Filesize
64KB

Download
memory/1892-107-0x0000000001210000-0x0000000001216000-memory.dmp

Filesize
24KB

Download
memory/1892-109-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/1892-361-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/1892-105-0x0000000000910000-0x0000000000940000-memory.dmp

Filesize
192KB

Download
memory/2140-209-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/2140-262-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/2140-181-0x0000000004740000-0x0000000004B3D000-memory.dmp

Filesize
4.0MB

Download
memory/2140-477-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/2140-184-0x0000000004B40000-0x000000000542B000-memory.dmp

Filesize
8.9MB

Download
memory/2140-409-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/2316-76-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/2316-186-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/2316-68-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2316-174-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/2320-678-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/3192-202-0x00000000086A0000-0x00000000086B6000-memory.dmp

Filesize
88KB

Download
memory/3192-2-0x0000000002DF0000-0x0000000002E06000-memory.dmp

Filesize
88KB

Download
memory/3200-565-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/3200-584-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/3684-119-0x00000000053C0000-0x000000000540C000-memory.dmp

Filesize
304KB

Download
memory/3684-237-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/3684-390-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/3684-94-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/3684-115-0x0000000005090000-0x00000000050A0000-memory.dmp

Filesize
64KB

Download
memory/3940-176-0x0000000002700000-0x0000000002709000-memory.dmp

Filesize
36KB

Download
memory/3940-175-0x00000000028DC000-0x00000000028EF000-memory.dmp

Filesize
76KB

Download
memory/4076-177-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4076-170-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4076-207-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4192-331-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/4192-405-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4220-400-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4220-79-0x00000000007E0000-0x000000000083A000-memory.dmp

Filesize
360KB

Download
memory/4220-80-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4220-403-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/4220-182-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/4220-180-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4220-92-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/4428-139-0x00007FF6960A0000-0x00007FF69610A000-memory.dmp

Filesize
424KB

Download
memory/4428-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4428-267-0x0000000003780000-0x00000000038B1000-memory.dmp

Filesize
1.2MB

Download
memory/4428-350-0x0000000003600000-0x0000000003771000-memory.dmp

Filesize
1.4MB

Download
memory/4428-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4428-1-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4648-111-0x0000000006E90000-0x0000000006F22000-memory.dmp

Filesize
584KB

Download
memory/4648-243-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/4648-392-0x0000000006FF0000-0x0000000007000000-memory.dmp

Filesize
64KB

Download
memory/4648-101-0x0000000000020000-0x000000000007A000-memory.dmp

Filesize
360KB

Download
memory/4648-135-0x0000000006FF0000-0x0000000007000000-memory.dmp

Filesize
64KB

Download
memory/4648-183-0x00000000072F0000-0x0000000007356000-memory.dmp

Filesize
408KB

Download
memory/4648-402-0x0000000000920000-0x000000000093E000-memory.dmp

Filesize
120KB

Download
memory/4648-110-0x00000000073A0000-0x0000000007944000-memory.dmp

Filesize
5.6MB

Download
memory/4648-104-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download
memory/4648-368-0x0000000008890000-0x0000000008906000-memory.dmp

Filesize
472KB

Download
memory/4648-126-0x0000000006E10000-0x0000000006E1A000-memory.dmp

Filesize
40KB

Download
memory/4688-283-0x00000000012E0000-0x00000000012F0000-memory.dmp

Filesize
64KB

Download
memory/4688-227-0x0000000000970000-0x0000000000978000-memory.dmp

Filesize
32KB

Download
memory/4688-259-0x00007FFB66360000-0x00007FFB66E21000-memory.dmp

Filesize
10.8MB

Download
memory/4776-71-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4776-70-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4776-74-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5072-282-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5072-205-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5300-393-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5300-367-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-404-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-550-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-472-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-507-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-602-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-649-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-683-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5560-685-0x0000000000910000-0x0000000000959000-memory.dmp

Filesize
292KB

Download
memory/5696-412-0x0000000002600000-0x0000000002636000-memory.dmp

Filesize
216KB

Download
memory/5696-413-0x0000000072FE0000-0x0000000073790000-memory.dmp

Filesize
7.7MB

Download