fabookie | dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f

Analysis

max time kernel
150s
max time network
156s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
30/09/2023, 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe
Size

166KB
MD5

a75e22d9a213d8fe03135a5ef5f01ce0
SHA1

32230da0b896df1f6895bc256acc1ea75bfcb98d
SHA256

dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f
SHA512

29fe5baa8ca83e3d4929d2065d41114f52b4daa7ecd5bda27f3863f719f712f28d9ae4686b2f23bc2b95f06ddca990d6482bcf5db70bc86b27b34a5fcc4c78a9
SSDEEP

3072:WhyUoV6V+E7NWgHEjwAuIASGGhNpIPMoCgab8wHWwL/JOaYZizj:Wh92ksgHE8AKSGUce8wHWu/JZkoj

Score

10^/10

fabookie glupteba mystic redline smokeloader gruha up3 backdoor google dropper evasion infostealer loader persistence phishing spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral1/memory/3588-676-0x00000000029E0000-0x0000000002B11000-memory.dmp	family_fabookie

Detected google phishing page
phishing google
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 4 IoCs

resource	yara_rule
behavioral1/memory/3240-509-0x0000000004A30000-0x000000000531B000-memory.dmp	family_glupteba
behavioral1/memory/3240-528-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/3240-673-0x0000000000400000-0x000000000298D000-memory.dmp	family_glupteba
behavioral1/memory/3240-674-0x0000000004A30000-0x000000000531B000-memory.dmp	family_glupteba

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001b091-446.dat	family_redline
behavioral1/files/0x000700000001b091-452.dat	family_redline
behavioral1/memory/4220-463-0x0000000000840000-0x000000000089A000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
5636	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 8 IoCs

pid	Process
1388	266F.exe
2844	x9185365.exe
4652	27F6.exe
3584	x3490328.exe
3404	x9179884.exe
8	x1354664.exe
2164	g0286977.exe
1008	2C7D.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	266F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9185365.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x3490328.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x9179884.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	x1354664.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 3212	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	72
PID 4652 set thread context of 204	4652	27F6.exe	86
PID 2164 set thread context of 4372	2164	g0286977.exe	90
PID 1008 set thread context of 4332	1008	2C7D.exe	93

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2652	4768	WerFault.exe	69
2540	4652	WerFault.exe	77
2244	2164	WerFault.exe	82
852	4372	WerFault.exe	90

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3352	schtasks.exe
1228	schtasks.exe
2376	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f29bacbbc1f3d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 298c7abbc1f3d901	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c9a83bbcc1f3d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-844837608-3875958368-2945961404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3212	AppLaunch.exe
3212	AppLaunch.exe
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found
2796	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	Process not Found

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3212	AppLaunch.exe
456	MicrosoftEdgeCP.exe
456	MicrosoftEdgeCP.exe
456	MicrosoftEdgeCP.exe
456	MicrosoftEdgeCP.exe
456	MicrosoftEdgeCP.exe
456	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4156	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found
Token: SeShutdownPrivilege	2796	Process not Found
Token: SeCreatePagefilePrivilege	2796	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2052	MicrosoftEdge.exe
456	MicrosoftEdgeCP.exe
4156	MicrosoftEdgeCP.exe
456	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3360	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	71
PID 4768 wrote to memory of 3360	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	71
PID 4768 wrote to memory of 3360	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	71
PID 4768 wrote to memory of 3212	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	72
PID 4768 wrote to memory of 3212	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	72
PID 4768 wrote to memory of 3212	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	72
PID 4768 wrote to memory of 3212	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	72
PID 4768 wrote to memory of 3212	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	72
PID 4768 wrote to memory of 3212	4768	dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe	72
PID 2796 wrote to memory of 1388	2796	Process not Found	75
PID 2796 wrote to memory of 1388	2796	Process not Found	75
PID 2796 wrote to memory of 1388	2796	Process not Found	75
PID 1388 wrote to memory of 2844	1388	266F.exe	76
PID 1388 wrote to memory of 2844	1388	266F.exe	76
PID 1388 wrote to memory of 2844	1388	266F.exe	76
PID 2796 wrote to memory of 4652	2796	Process not Found	77
PID 2796 wrote to memory of 4652	2796	Process not Found	77
PID 2796 wrote to memory of 4652	2796	Process not Found	77
PID 2844 wrote to memory of 3584	2844	x9185365.exe	79
PID 2844 wrote to memory of 3584	2844	x9185365.exe	79
PID 2844 wrote to memory of 3584	2844	x9185365.exe	79
PID 3584 wrote to memory of 3404	3584	x3490328.exe	80
PID 3584 wrote to memory of 3404	3584	x3490328.exe	80
PID 3584 wrote to memory of 3404	3584	x3490328.exe	80
PID 3404 wrote to memory of 8	3404	x9179884.exe	81
PID 3404 wrote to memory of 8	3404	x9179884.exe	81
PID 3404 wrote to memory of 8	3404	x9179884.exe	81
PID 8 wrote to memory of 2164	8	x1354664.exe	82
PID 8 wrote to memory of 2164	8	x1354664.exe	82
PID 8 wrote to memory of 2164	8	x1354664.exe	82
PID 2796 wrote to memory of 1300	2796	Process not Found	83
PID 2796 wrote to memory of 1300	2796	Process not Found	83
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 4652 wrote to memory of 204	4652	27F6.exe	86
PID 2796 wrote to memory of 1008	2796	Process not Found	88
PID 2796 wrote to memory of 1008	2796	Process not Found	88
PID 2796 wrote to memory of 1008	2796	Process not Found	88
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 2164 wrote to memory of 4372	2164	g0286977.exe	90
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93
PID 1008 wrote to memory of 4332	1008	2C7D.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe
"C:\Users\Admin\AppData\Local\Temp\dcca60e92aa719faf5f258d926240a696abf6e274cc4e5054e6a7935a690e73f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 248
  2⤵
  - Program crash
  PID:2652

C:\Users\Admin\AppData\Local\Temp\266F.exe
C:\Users\Admin\AppData\Local\Temp\266F.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 568
        8⤵
        Program crash
        
        PID:852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 152
        7⤵
        Program crash
        
        PID:2244

C:\Users\Admin\AppData\Local\Temp\27F6.exe
C:\Users\Admin\AppData\Local\Temp\27F6.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 256
  2⤵
  - Program crash
  PID:2540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2A2A.bat" "
1⤵
- Checks computer location settings
PID:1300

C:\Users\Admin\AppData\Local\Temp\2C7D.exe
C:\Users\Admin\AppData\Local\Temp\2C7D.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2052

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2072

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:456

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4156

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1564

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4704

C:\Users\Admin\AppData\Local\Temp\6189.exe
C:\Users\Admin\AppData\Local\Temp\6189.exe
1⤵
PID:4336
- C:\Users\Admin\AppData\Local\Temp\ss41.exe
  "C:\Users\Admin\AppData\Local\Temp\ss41.exe"
  2⤵
  PID:3588
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  PID:3112
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    PID:4392
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:3240
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:5564
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:5416
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5960
  - - C:\Windows\System32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:4608
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:5636
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:5624
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:3100
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:972
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2120
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:2376
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:5108
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5160
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4692
- C:\Users\Admin\AppData\Local\Temp\kos1.exe
  "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
  2⤵
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\set16.exe
    "C:\Users\Admin\AppData\Local\Temp\set16.exe"
    3⤵
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\is-23C5D.tmp\is-AI7P1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-23C5D.tmp\is-AI7P1.tmp" /SL4 $70362 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
      4⤵
      PID:5132
    - - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        5⤵
        
        PID:5408
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        5⤵
        
        PID:5396
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        6⤵
        
        PID:5724
    - - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        5⤵
        
        PID:5668
- - C:\Users\Admin\AppData\Local\Temp\kos.exe
    "C:\Users\Admin\AppData\Local\Temp\kos.exe"
    3⤵
    PID:3100

C:\Users\Admin\AppData\Local\Temp\65D0.exe
C:\Users\Admin\AppData\Local\Temp\65D0.exe
1⤵
PID:4220

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5856

C:\Users\Admin\AppData\Local\Temp\8D7D.exe
C:\Users\Admin\AppData\Local\Temp\8D7D.exe
1⤵
PID:6028

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4460

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5576

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:5536

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:5468
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:5740
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:3764
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:5276
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5812

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5732

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml"
1⤵
- Creates scheduled task(s)
PID:3352

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:5552

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
PID:5712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4836

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:604
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:4892
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:5208
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:200
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1292

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml"
1⤵
- Creates scheduled task(s)
PID:1228

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:5840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\ProgramData\ContentDVSvc\ContentDVSvc.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2RZQZMR9\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\A9GZ0ZAW\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\F2P5BMKK\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QWNH0W9Y\m=_b,_tp[1].js

Filesize
205KB

MD5
d160bfba324f171e70fc9d079cdb40dc

SHA1
3453614744b94313dab508a5fd35f3a90671d54e

SHA256
57ed0ed5bf76f49ef521ee64e6beac870924c30bd11db6b752c10afba6b21397

SHA512
58d1d42cde6c3d07f6fb61fc246ea13b5567e6df1c3209e3a81c7c55d97cd43c2b1b4e9dd16a4f9cadd3a40880b22b11d63854064dddd3150c30f4ce75e0bd29

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\CUR5S000.cookie

Filesize
132B

MD5
43d19ab76c75178d348d7516961b421e

SHA1
ee9cbc25d269ae50628bf96da104c02ace91b12b

SHA256
5b7a742c5db58c1b6cc285fd80b73af8e7d5e4bc0a06a4f9a227a6f2a9aa5c29

SHA512
b300beea906b532f42808e1683a41c0fe3ae7ca16db144e081ef6088194a6d0c92c04193b830a584764f7d8d6d7a5332db75b9d1d0d3055cd1c72e5679025bab

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
48a81b79b740fce3baba6dde888f01a6

SHA1
24ccab545a148189eaa52a05f0167466240cb698

SHA256
7eadd60e78dc6116e3bf24b1ff4e936b7e418ae180de47ea537e4588a5496329

SHA512
8fb61c8c96595b3b34326dcc3af5898a498d796a2cf48ec20388f7c23694a7ee87c3f0fc5a6038cea2d6f274e08aabfc0cd513e81c7974aaea3daa1e9339faf6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_88B06D18F336F4573DA4CD16EEF01E99

Filesize
471B

MD5
3c85c63522b8d9311fd17b60cc3f0245

SHA1
05c4621bf02336bf463bc9247c63e2cf7ea7afca

SHA256
3c7cbe3679e411d320ca86d457cfc507d2f4b8e127d8d2748b9758fd79b0c7b4

SHA512
f548fa65114b27ce881e4782b43f0fe5478d3f6264ef286a9fb57a9996c706bad089096aa87650a26d3fa14361903c14c6c2eb0dc7bc6b1f9c6e6c273666676e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
471B

MD5
53e27cd9ad64962d442e9b91ac9e68ce

SHA1
df935e007d5933e7c46e9c3f210b8d5c8ae93157

SHA256
3867ca77a666a242a5a403d7abe1fa7c0ad43639e99694c7d8830ea668477d7b

SHA512
9da7c2c45b8ed6bd6ab14b6a859e8b0db5b6b6d2aad60a66f978dd2a5843c32f5b8f9239ddb5b129140f2349e1d304df61d09f5cdc9db3acfd63c94e1652d568

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
37999f59fa3ae677bc10abd728653542

SHA1
dd9c1557d108eac3c40a1af43e6e1763cea02103

SHA256
de2f2e56844b2c84345189f473f5baedb1c0c477412f7b7ad32742cc02c72f9a

SHA512
9e94eb61ed9520b4fce5e04b93a553b582053999b53aecdd4ed20beb54e67b2ac948c25b0c136f9f433e408cbad02ed5e7deb8b559a5534c4f45f4515d636306

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
58d414d922463b3f10de3ec6feb2c69f

SHA1
55eb3b8083a205d0d7cb4fb9d026e1f7acf8c656

SHA256
3126f2028a806524cc600dd7d07090f82ae0e72b4ff9f750aff649e79a23e35f

SHA512
8549a56f417ee49954de71655481fd83e527f6865c48dbe9b7dbc72cbf5fba94d424cdc095332f5d9c97742d1b568b01f6dd610b25d820707d99cca6fbbc1f9c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_88B06D18F336F4573DA4CD16EEF01E99

Filesize
406B

MD5
3c1e50c7e090e2b4a4218c2e9dcbf854

SHA1
adbf6aa7e31c3e8000b5967514780da25f83fa98

SHA256
51801d5c983932bb631ebe4f3b2c71b9daf675ff7cd83a250564f50df3b0032d

SHA512
26f7dc03a10d269185847d4fda9f8f9c6112707c86a58c56bc60319a4ce53ee0f08958c65a2d526042d4bbb4d686ce75f3db5a2f387bc3ffd5c53ddd722a8d4b

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
decba507324f7b6ddb4b3c69a11c0806

SHA1
f5eb5aae08703071c237eb08c5ac70a90d03c30f

SHA256
2324b9a5fb8817ac9320f0534dc0e9915e1a2d52774fe9db10521c2ff493d387

SHA512
2efc42e0eaea26cb36428aa9ed166b39866da659c4db5c6967e2b24f69997573ca5d886b45c0f3c1d1e8160fa86f2238c8892830db150805e049a0b15b190cb1

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
406B

MD5
599342f96b72c99b74f125baee032a27

SHA1
662ea82b9dde9389afe8ed332ed5c793e7462226

SHA256
a9f2df7028c234ccacda76443a6ac1661e36d11252ea6715bcdedd776f1f20ef

SHA512
b5fe0f39ebb30c8bffded7df104ae0d1c89e3b76aed1893f4d11c14eb63f6b1f08fe67713c200f31fc2b127dc3a850ed9bac7bc07d2b43d65c637f1e29daf125

Download Submit
C:\Users\Admin\AppData\Local\Temp\266F.exe

Filesize
1.0MB

MD5
26a94d3fea2244861be8140c6acb2b49

SHA1
de730504e44110a9f1923b858cd5ee2a3cd72cd2

SHA256
c9695798ea1e94e39d82b6624fec3f9aea38086b109de06a7e4bd3411e998fa9

SHA512
7b5515a581cfed0afbd99eef41315a82e0494a814dc16f989e1d14a65288d1c67c3f4a7d9892e68f499b8f6b6782b9da72a38887724fe744b532ff93854e1d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\266F.exe

Filesize
1.0MB

MD5
26a94d3fea2244861be8140c6acb2b49

SHA1
de730504e44110a9f1923b858cd5ee2a3cd72cd2

SHA256
c9695798ea1e94e39d82b6624fec3f9aea38086b109de06a7e4bd3411e998fa9

SHA512
7b5515a581cfed0afbd99eef41315a82e0494a814dc16f989e1d14a65288d1c67c3f4a7d9892e68f499b8f6b6782b9da72a38887724fe744b532ff93854e1d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\27F6.exe

Filesize
276KB

MD5
8fcdd768668c750919704d83e48dc905

SHA1
5c346c0070b1916f34817ef6d70df45be7f6d72e

SHA256
943331c244cbbdccb54759760a2520be456ea2847878d5a61b6c1c239e758f06

SHA512
336dd28205785c3c57e9f70b598b2d1736f27906ffc88edf77b93dd20abf2f722e4d64cde67c0711702d61d7fbcda687569b6f95375e68bcd6c4a58675366563

Download Submit
C:\Users\Admin\AppData\Local\Temp\27F6.exe

Filesize
276KB

MD5
8fcdd768668c750919704d83e48dc905

SHA1
5c346c0070b1916f34817ef6d70df45be7f6d72e

SHA256
943331c244cbbdccb54759760a2520be456ea2847878d5a61b6c1c239e758f06

SHA512
336dd28205785c3c57e9f70b598b2d1736f27906ffc88edf77b93dd20abf2f722e4d64cde67c0711702d61d7fbcda687569b6f95375e68bcd6c4a58675366563

Download Submit
C:\Users\Admin\AppData\Local\Temp\2A2A.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\2C7D.exe

Filesize
310KB

MD5
da21b103cbfa0cffc6beab2abcb5be8a

SHA1
a7f250d84b21f61d7b0f6c01e4986aff4a648a40

SHA256
7c3a088040cbd7895bc654dcc40cd0055758ac2e613d170afe04a547528fdc7b

SHA512
b4f02701f6ab3d3b84c68773f220b1089702c2e88ca17a1ec2e355706e41be88d363ac1e0fd9296eff239a4d2e710115ec8aff8c562b8512006ec176aa673b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\2C7D.exe

Filesize
310KB

MD5
da21b103cbfa0cffc6beab2abcb5be8a

SHA1
a7f250d84b21f61d7b0f6c01e4986aff4a648a40

SHA256
7c3a088040cbd7895bc654dcc40cd0055758ac2e613d170afe04a547528fdc7b

SHA512
b4f02701f6ab3d3b84c68773f220b1089702c2e88ca17a1ec2e355706e41be88d363ac1e0fd9296eff239a4d2e710115ec8aff8c562b8512006ec176aa673b90

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\6189.exe

Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\6189.exe

Filesize
6.4MB

MD5
3c81534d635fbe4bfab2861d98422f70

SHA1
9cc995fa42313cd82eacaad9e3fe818cd3805f58

SHA256
88921dad96a51ff9f15a1d93b51910b2ac75589020fbb75956b6f090381d4d4f

SHA512
132fa532fad96b512b795cf4786245cc24bbdbbab433bf34925cf20401a819cab7bed92771e7f0b4c970535804d42f7f1d2887765ed8f999c99a0e15d93a0136

Download Submit
C:\Users\Admin\AppData\Local\Temp\65D0.exe

Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\65D0.exe

Filesize
341KB

MD5
53df0c8b56120e03e1657e366720ecd9

SHA1
a09ccc5dfa35fe46f1203e5e95c3025ff2f0930d

SHA256
bc3a7ba547b8a0f5cc6be6748eb9fa06ae2d09ca4b3c158add5e4868197c72ff

SHA512
b940864beb7a9d300173e98e343a7d21bef9b3aa48f3d198816b8e9909463f35354312ffb699893e27ef312504d1ddcad9288792ec2492086d3716d217c1011b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D7D.exe

Filesize
5.2MB

MD5
d381d9db9cbd1b60afdfb4f05e52a775

SHA1
d59c52583ca791e07f3e6aec2ee2590ab9bfd67e

SHA256
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9

SHA512
cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D7D.exe

Filesize
5.2MB

MD5
d381d9db9cbd1b60afdfb4f05e52a775

SHA1
d59c52583ca791e07f3e6aec2ee2590ab9bfd67e

SHA256
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9

SHA512
cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe

Filesize
931KB

MD5
48b1727650d180d5d2bfc51ea90108e4

SHA1
ad447f7fa768d276b2c5ee37574e93b8594778a3

SHA256
0d7b047cfcada969198aea6162c434d48cbacffec0e6bb06e2f9763275de053f

SHA512
8bc0dddd28bb7dcb45db83cdfa576a99e7cad70f1bc8f409e6b0f5480750b5b1a272a93b08e88581a2495e2e6924c5018110fc2bc1c6149cfe289bf905d46ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9185365.exe

Filesize
931KB

MD5
48b1727650d180d5d2bfc51ea90108e4

SHA1
ad447f7fa768d276b2c5ee37574e93b8594778a3

SHA256
0d7b047cfcada969198aea6162c434d48cbacffec0e6bb06e2f9763275de053f

SHA512
8bc0dddd28bb7dcb45db83cdfa576a99e7cad70f1bc8f409e6b0f5480750b5b1a272a93b08e88581a2495e2e6924c5018110fc2bc1c6149cfe289bf905d46ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe

Filesize
748KB

MD5
fc728d6abd04be5401735385b82706b6

SHA1
a5a74781b9a768ef30fa1ba7b890f6049da51352

SHA256
ab2eadf977f954413b51fa720a749cce15d84aca42ff12b674e7a1599f014cf1

SHA512
69007ea0c967734e6995c0dfcdbb0ddbd59cf91518cb61e492af3380f6c9863e51983e994ca589755e76634b7885bdb395236213685108a4240c22b76e8166b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3490328.exe

Filesize
748KB

MD5
fc728d6abd04be5401735385b82706b6

SHA1
a5a74781b9a768ef30fa1ba7b890f6049da51352

SHA256
ab2eadf977f954413b51fa720a749cce15d84aca42ff12b674e7a1599f014cf1

SHA512
69007ea0c967734e6995c0dfcdbb0ddbd59cf91518cb61e492af3380f6c9863e51983e994ca589755e76634b7885bdb395236213685108a4240c22b76e8166b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe

Filesize
516KB

MD5
3559853a0486dfc73dddbacbdd7d168d

SHA1
192df594266e7782acbfed0a51e7720a3f48a237

SHA256
3d2f43acbd43a31276d831a5f12aa6c89c353673bb044c8d4f6c8db0399f4ed6

SHA512
b7c5efc5db4cf3ff85d58e5bc055980f24a4c0646ce8ee2be3fa1a07ae4397e48bd91758566d751075cbdbb16cb6e826e4a599f042337571a57e26feb2bc11c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9179884.exe

Filesize
516KB

MD5
3559853a0486dfc73dddbacbdd7d168d

SHA1
192df594266e7782acbfed0a51e7720a3f48a237

SHA256
3d2f43acbd43a31276d831a5f12aa6c89c353673bb044c8d4f6c8db0399f4ed6

SHA512
b7c5efc5db4cf3ff85d58e5bc055980f24a4c0646ce8ee2be3fa1a07ae4397e48bd91758566d751075cbdbb16cb6e826e4a599f042337571a57e26feb2bc11c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe

Filesize
350KB

MD5
b86a7ec2d00b6390007a92ce3e6e2fdf

SHA1
f204601ad9af77f5f89e583465cfa208315b1fb6

SHA256
b79cb93c8cc1b40b43cdbbed584d00cb8966a9892bb506f820dafe6b05a33c6f

SHA512
58e29caa58fa3b6cd4e3f9e22449ed67288ce7c936eefac9ea2498b909b8f858616caf197769c86daca64d82c76ebc2f7ba86a9fba45628ee57daf8f5db179b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\x1354664.exe

Filesize
350KB

MD5
b86a7ec2d00b6390007a92ce3e6e2fdf

SHA1
f204601ad9af77f5f89e583465cfa208315b1fb6

SHA256
b79cb93c8cc1b40b43cdbbed584d00cb8966a9892bb506f820dafe6b05a33c6f

SHA512
58e29caa58fa3b6cd4e3f9e22449ed67288ce7c936eefac9ea2498b909b8f858616caf197769c86daca64d82c76ebc2f7ba86a9fba45628ee57daf8f5db179b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe

Filesize
276KB

MD5
36e2da51b07559373a2086a3782677f2

SHA1
df3d784f80514b0f2a21e1ea3c811c582303eba1

SHA256
d6c56fac3d2b69bad7589bb1b4d2ecc790e918c0cf0733065ed8c20160c53f5d

SHA512
5cd2dca321c4b672603350844c4ea4f67507b8db42fe65936f466a94944c95a49c53cf68e50573abd8fe295a86031513df1759ee80889e31c59b77f595bbb11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\g0286977.exe

Filesize
276KB

MD5
36e2da51b07559373a2086a3782677f2

SHA1
df3d784f80514b0f2a21e1ea3c811c582303eba1

SHA256
d6c56fac3d2b69bad7589bb1b4d2ecc790e918c0cf0733065ed8c20160c53f5d

SHA512
5cd2dca321c4b672603350844c4ea4f67507b8db42fe65936f466a94944c95a49c53cf68e50573abd8fe295a86031513df1759ee80889e31c59b77f595bbb11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_us2tg2my.t4z.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-23C5D.tmp\is-AI7P1.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-23C5D.tmp\is-AI7P1.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\starkrqppzsg.xml

Filesize
1KB

MD5
059ccb70dc2c65c81c0dc8bea26a4bb2

SHA1
09c60376bf998dff186950104a6e7e4f74b37c24

SHA256
0b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d

SHA512
416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe

Filesize
5.2MB

MD5
d381d9db9cbd1b60afdfb4f05e52a775

SHA1
d59c52583ca791e07f3e6aec2ee2590ab9bfd67e

SHA256
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9

SHA512
cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861

Download Submit
C:\Users\Admin\AppData\Roaming\gcfhvtg

Filesize
338KB

MD5
528b5dc5ede359f683b73a684b9c19f6

SHA1
8bff4feae6dbdaafac1f9f373f15850d08e0a206

SHA256
3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9

SHA512
87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
c2ee6d7a10a9215018a003f4a456d3c4

SHA1
3ead9b1186b3d0f0c87f94c55fb15d3801e61bfc

SHA256
1bb42aa006521fb1773b4b45b47afdd6ff32887c054fa760de7be31fb87de99e

SHA512
a108965a434ba604fc5795469858307f8894b8374dfe03bb5ead5a81362bbafbe69da528a0e9a8d2d8c973861bb6f097e75f4a68375c7607f416e2026423cb63

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
4b4f28d74ac6cf9bcf1a10837f4b3e01

SHA1
de77c0b349e3f84d791812986a0c9fd18744c121

SHA256
7ab61959d7c1c786a835d16abf8554a9d9c9fd16732023ef84376f6f1a1703ce

SHA512
703af6f24ed868e991eea25ad7b32461af84ede5da4c012230195b21b5ed22bee727d0d6a86baac478ddf93839a9df4788cc8a43cd86ad1f2b05c5f9835988b7

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.2MB

MD5
7ea584dc49967de03bebdacec829b18d

SHA1
3d47f0e88c7473bedeed2f14d7a8db1318b93852

SHA256
79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53

SHA512
ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

Download Submit
\Users\Admin\AppData\Local\Temp\is-O71B8.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-O71B8.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
\Users\Admin\AppData\Local\Temp\is-O71B8.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
memory/204-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/204-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/204-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/204-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/204-75-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-467-0x0000000000A10000-0x0000000000B84000-memory.dmp

Filesize
1.5MB

Download
memory/1088-476-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/1088-524-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/1564-450-0x00000209C2BF0000-0x00000209C2BF2000-memory.dmp

Filesize
8KB

Download
memory/1564-486-0x00000209C4380000-0x00000209C4382000-memory.dmp

Filesize
8KB

Download
memory/1564-490-0x00000209C4390000-0x00000209C4392000-memory.dmp

Filesize
8KB

Download
memory/1564-565-0x00000209C3A20000-0x00000209C3A22000-memory.dmp

Filesize
8KB

Download
memory/1564-546-0x00000209C19A0000-0x00000209C19C0000-memory.dmp

Filesize
128KB

Download
memory/1564-470-0x00000209C35E0000-0x00000209C35E2000-memory.dmp

Filesize
8KB

Download
memory/1564-496-0x00000209C43A0000-0x00000209C43A2000-memory.dmp

Filesize
8KB

Download
memory/1564-478-0x00000209C3E30000-0x00000209C3E32000-memory.dmp

Filesize
8KB

Download
memory/1564-420-0x00000209C25F0000-0x00000209C25F2000-memory.dmp

Filesize
8KB

Download
memory/1564-293-0x00000209C2400000-0x00000209C2420000-memory.dmp

Filesize
128KB

Download
memory/1564-343-0x00000209C1BC0000-0x00000209C1BE0000-memory.dmp

Filesize
128KB

Download
memory/1564-415-0x00000209C2160000-0x00000209C2162000-memory.dmp

Filesize
8KB

Download
memory/2052-81-0x000001F7B6620000-0x000001F7B6630000-memory.dmp

Filesize
64KB

Download
memory/2052-424-0x000001F7BD810000-0x000001F7BD811000-memory.dmp

Filesize
4KB

Download
memory/2052-425-0x000001F7BD820000-0x000001F7BD821000-memory.dmp

Filesize
4KB

Download
memory/2052-123-0x000001F7B6A40000-0x000001F7B6A42000-memory.dmp

Filesize
8KB

Download
memory/2052-98-0x000001F7B6E80000-0x000001F7B6E90000-memory.dmp

Filesize
64KB

Download
memory/2796-573-0x0000000004590000-0x00000000045A6000-memory.dmp

Filesize
88KB

Download
memory/2796-4-0x0000000000950000-0x0000000000966000-memory.dmp

Filesize
88KB

Download
memory/3100-562-0x00007FFB6F190000-0x00007FFB6FB7C000-memory.dmp

Filesize
9.9MB

Download
memory/3100-517-0x0000000000FC0000-0x0000000000FC8000-memory.dmp

Filesize
32KB

Download
memory/3100-529-0x000000001BC80000-0x000000001BC90000-memory.dmp

Filesize
64KB

Download
memory/3100-668-0x00007FFB6F190000-0x00007FFB6FB7C000-memory.dmp

Filesize
9.9MB

Download
memory/3112-469-0x00000000026D0000-0x00000000027D0000-memory.dmp

Filesize
1024KB

Download
memory/3112-471-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/3212-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3212-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3212-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3240-528-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/3240-674-0x0000000004A30000-0x000000000531B000-memory.dmp

Filesize
8.9MB

Download
memory/3240-509-0x0000000004A30000-0x000000000531B000-memory.dmp

Filesize
8.9MB

Download
memory/3240-673-0x0000000000400000-0x000000000298D000-memory.dmp

Filesize
37.6MB

Download
memory/3240-497-0x0000000004630000-0x0000000004A30000-memory.dmp

Filesize
4.0MB

Download
memory/3240-667-0x0000000004630000-0x0000000004A30000-memory.dmp

Filesize
4.0MB

Download
memory/3588-675-0x0000000002860000-0x00000000029D1000-memory.dmp

Filesize
1.4MB

Download
memory/3588-676-0x00000000029E0000-0x0000000002B11000-memory.dmp

Filesize
1.2MB

Download
memory/3588-451-0x00007FF6B8BB0000-0x00007FF6B8C1A000-memory.dmp

Filesize
424KB

Download
memory/4220-492-0x0000000007740000-0x000000000774A000-memory.dmp

Filesize
40KB

Download
memory/4220-666-0x0000000007730000-0x0000000007740000-memory.dmp

Filesize
64KB

Download
memory/4220-603-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/4220-638-0x0000000009C00000-0x0000000009C76000-memory.dmp

Filesize
472KB

Download
memory/4220-643-0x0000000009E50000-0x000000000A012000-memory.dmp

Filesize
1.8MB

Download
memory/4220-648-0x000000000A550000-0x000000000AA7C000-memory.dmp

Filesize
5.2MB

Download
memory/4220-656-0x0000000009D40000-0x0000000009D5E000-memory.dmp

Filesize
120KB

Download
memory/4220-687-0x0000000008FD0000-0x0000000009020000-memory.dmp

Filesize
320KB

Download
memory/4220-480-0x0000000007AD0000-0x0000000007FCE000-memory.dmp

Filesize
5.0MB

Download
memory/4220-487-0x00000000075D0000-0x0000000007662000-memory.dmp

Filesize
584KB

Download
memory/4220-458-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/4220-491-0x0000000007730000-0x0000000007740000-memory.dmp

Filesize
64KB

Download
memory/4220-724-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/4220-568-0x0000000008090000-0x00000000080F6000-memory.dmp

Filesize
408KB

Download
memory/4220-463-0x0000000000840000-0x000000000089A000-memory.dmp

Filesize
360KB

Download
memory/4332-110-0x000000000E900000-0x000000000E912000-memory.dmp

Filesize
72KB

Download
memory/4332-108-0x000000000E9D0000-0x000000000EADA000-memory.dmp

Filesize
1.0MB

Download
memory/4332-112-0x0000000006E90000-0x0000000006EA0000-memory.dmp

Filesize
64KB

Download
memory/4332-265-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/4332-115-0x000000000E960000-0x000000000E99E000-memory.dmp

Filesize
248KB

Download
memory/4332-119-0x000000000EAE0000-0x000000000EB2B000-memory.dmp

Filesize
300KB

Download
memory/4332-104-0x000000000EE60000-0x000000000F466000-memory.dmp

Filesize
6.0MB

Download
memory/4332-418-0x0000000006E90000-0x0000000006EA0000-memory.dmp

Filesize
64KB

Download
memory/4332-85-0x0000000006EA0000-0x0000000006EA6000-memory.dmp

Filesize
24KB

Download
memory/4332-80-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/4332-76-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4372-74-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4372-72-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4372-71-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4392-475-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4392-481-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4392-585-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4508-505-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/4508-542-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5132-572-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5408-578-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5408-586-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5564-708-0x0000000072270000-0x000000007295E000-memory.dmp

Filesize
6.9MB

Download
memory/5564-757-0x0000000009080000-0x00000000090BC000-memory.dmp

Filesize
240KB

Download
memory/5564-721-0x0000000006EB0000-0x0000000006ECC000-memory.dmp

Filesize
112KB

Download
memory/5564-719-0x0000000007CB0000-0x0000000008000000-memory.dmp

Filesize
3.3MB

Download
memory/5564-718-0x0000000007C40000-0x0000000007CA6000-memory.dmp

Filesize
408KB

Download
memory/5564-717-0x0000000007140000-0x0000000007162000-memory.dmp

Filesize
136KB

Download
memory/5564-714-0x0000000007300000-0x0000000007928000-memory.dmp

Filesize
6.2MB

Download
memory/5564-713-0x0000000003080000-0x0000000003090000-memory.dmp

Filesize
64KB

Download
memory/5564-709-0x0000000004B30000-0x0000000004B66000-memory.dmp

Filesize
216KB

Download
memory/5668-608-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5668-594-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download