amadey | d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6

Analysis

max time kernel
35s
max time network
116s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
04/10/2023, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe
Size

1.3MB
MD5

ff1bc02c443e96896ef1f29d7ee15bae
SHA1

016524f420b6323bf99d4fbf6a6d4a1b9deb1f92
SHA256

d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6
SHA512

278b4cda5cbc1212541f19cb6ea7a80ed094e70a981ec676510a77eb5ae3952151313f88e3bb6610c0e70f7ea34f9f3eb9052430430a4ff790daea0f946c3f8a
SSDEEP

12288:S2YxrsbsJ+G1+wrluoVf9X6a9Dhvhz4Rajbj:SDrqsJ+GpD6a9DhvhPj

Score

10^/10

amadey healer mystic redline smokeloader @ytlogsbot frant backdoor google dropper infostealer persistence phishing stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

frant

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

@ytlogsbot

176.123.4.46:33783

Attributes

auth_value
295b226f1b63bcd55148625381b27b19

Extracted

Family

amadey

Version

3.83

http://5.42.65.80/8bmeVwqx/index.php

Attributes

install_dir
207aa4515d
install_file
oneetx.exe
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Detected google phishing page
phishing google

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b035-132.dat	healer
behavioral2/memory/3100-133-0x0000000000010000-0x000000000001A000-memory.dmp	healer
behavioral2/files/0x000700000001b035-131.dat	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/368-134-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
1108	F4C0.exe
4108	ly0UG6Fv.exe
164	XI0nn7yU.exe
4056	MU4Kd4pb.exe
4768	As8cR5IO.exe
2216	1tL58UM0.exe
4028	3B5.exe
4524	FBD.exe
3100	1339.exe
5020	1703.exe
4600	explothe.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	F4C0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ly0UG6Fv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	XI0nn7yU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	MU4Kd4pb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	As8cR5IO.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1880 set thread context of 3076	1880	d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe	71
PID 2216 set thread context of 3236	2216	1tL58UM0.exe	81
PID 4028 set thread context of 1908	4028	3B5.exe	89
PID 4524 set thread context of 368	4524	FBD.exe	99

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
316	1880	WerFault.exe	69
5068	2216	WerFault.exe	79
4460	3236	WerFault.exe	81
4912	4028	WerFault.exe	84

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2932	schtasks.exe
1784	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1f63bf5b75f6d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 622d025c75f6d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5dfa385c75f6d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{6CEEDBA3-4B0B-446E-8219-F3B032ACE0ED} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 064cea5b75f6d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1384669652-2270756765-572751751-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3076	AppLaunch.exe
3076	AppLaunch.exe
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found
3256	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3256	Process not Found

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3076	AppLaunch.exe
352	MicrosoftEdgeCP.exe
352	MicrosoftEdgeCP.exe
352	MicrosoftEdgeCP.exe
352	MicrosoftEdgeCP.exe
352	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeDebugPrivilege	2428	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2428	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2428	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2428	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeShutdownPrivilege	3256	Process not Found
Token: SeCreatePagefilePrivilege	3256	Process not Found
Token: SeDebugPrivilege	3100	1339.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4952	MicrosoftEdge.exe
352	MicrosoftEdgeCP.exe
2428	MicrosoftEdgeCP.exe
352	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3076	1880	d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe	71
PID 1880 wrote to memory of 3076	1880	d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe	71
PID 1880 wrote to memory of 3076	1880	d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe	71
PID 1880 wrote to memory of 3076	1880	d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe	71
PID 1880 wrote to memory of 3076	1880	d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe	71
PID 1880 wrote to memory of 3076	1880	d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe	71
PID 3256 wrote to memory of 1108	3256	Process not Found	74
PID 3256 wrote to memory of 1108	3256	Process not Found	74
PID 3256 wrote to memory of 1108	3256	Process not Found	74
PID 1108 wrote to memory of 4108	1108	F4C0.exe	75
PID 1108 wrote to memory of 4108	1108	F4C0.exe	75
PID 1108 wrote to memory of 4108	1108	F4C0.exe	75
PID 4108 wrote to memory of 164	4108	ly0UG6Fv.exe	76
PID 4108 wrote to memory of 164	4108	ly0UG6Fv.exe	76
PID 4108 wrote to memory of 164	4108	ly0UG6Fv.exe	76
PID 164 wrote to memory of 4056	164	XI0nn7yU.exe	77
PID 164 wrote to memory of 4056	164	XI0nn7yU.exe	77
PID 164 wrote to memory of 4056	164	XI0nn7yU.exe	77
PID 4056 wrote to memory of 4768	4056	MU4Kd4pb.exe	78
PID 4056 wrote to memory of 4768	4056	MU4Kd4pb.exe	78
PID 4056 wrote to memory of 4768	4056	MU4Kd4pb.exe	78
PID 4768 wrote to memory of 2216	4768	As8cR5IO.exe	79
PID 4768 wrote to memory of 2216	4768	As8cR5IO.exe	79
PID 4768 wrote to memory of 2216	4768	As8cR5IO.exe	79
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 2216 wrote to memory of 3236	2216	1tL58UM0.exe	81
PID 3256 wrote to memory of 4028	3256	Process not Found	84
PID 3256 wrote to memory of 4028	3256	Process not Found	84
PID 3256 wrote to memory of 4028	3256	Process not Found	84
PID 3256 wrote to memory of 4812	3256	Process not Found	86
PID 3256 wrote to memory of 4812	3256	Process not Found	86
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 4028 wrote to memory of 1908	4028	3B5.exe	89
PID 3256 wrote to memory of 4524	3256	Process not Found	96
PID 3256 wrote to memory of 4524	3256	Process not Found	96
PID 3256 wrote to memory of 4524	3256	Process not Found	96
PID 3256 wrote to memory of 3100	3256	Process not Found	98
PID 3256 wrote to memory of 3100	3256	Process not Found	98
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 4524 wrote to memory of 368	4524	FBD.exe	99
PID 3256 wrote to memory of 5020	3256	Process not Found	100
PID 3256 wrote to memory of 5020	3256	Process not Found	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe
"C:\Users\Admin\AppData\Local\Temp\d91ff346ca745e7d1b92df52d905c2c7da306a7ad64cfc7da65e0b161efa19d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 348
  2⤵
  - Program crash
  PID:316

C:\Users\Admin\AppData\Local\Temp\F4C0.exe
C:\Users\Admin\AppData\Local\Temp\F4C0.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ly0UG6Fv.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ly0UG6Fv.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XI0nn7yU.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XI0nn7yU.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:164
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MU4Kd4pb.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MU4Kd4pb.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\As8cR5IO.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\As8cR5IO.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1tL58UM0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1tL58UM0.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 568
        8⤵
        Program crash
        
        PID:4460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 588
        7⤵
        Program crash
        
        PID:5068

C:\Users\Admin\AppData\Local\Temp\3B5.exe
C:\Users\Admin\AppData\Local\Temp\3B5.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 148
  2⤵
  - Program crash
  PID:4912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4EF.bat" "
1⤵
- Checks computer location settings
PID:4812

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2720

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:352

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2448

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2132

C:\Users\Admin\AppData\Local\Temp\FBD.exe
C:\Users\Admin\AppData\Local\Temp\FBD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:368

C:\Users\Admin\AppData\Local\Temp\1339.exe
C:\Users\Admin\AppData\Local\Temp\1339.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Users\Admin\AppData\Local\Temp\1703.exe
C:\Users\Admin\AppData\Local\Temp\1703.exe
1⤵
- Executes dropped EXE
PID:5020
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:3136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5088
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:5100
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:4068
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2744
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:4832
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:4068

C:\Users\Admin\AppData\Local\Temp\1FED.exe
C:\Users\Admin\AppData\Local\Temp\1FED.exe
1⤵
PID:2112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3124

C:\Users\Admin\AppData\Local\Temp\2F8F.exe
C:\Users\Admin\AppData\Local\Temp\2F8F.exe
1⤵
PID:992
- C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
  2⤵
  PID:5064
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
    3⤵
    PID:2856
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:4240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1328
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:2832
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:N"
      4⤵
      PID:4232
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:3428
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:R" /E
      4⤵
      PID:4900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5032

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4384

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5304

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\NZM57IND\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\QIXRF8VB\m=_b,_tp[1].js

Filesize
205KB

MD5
d160bfba324f171e70fc9d079cdb40dc

SHA1
3453614744b94313dab508a5fd35f3a90671d54e

SHA256
57ed0ed5bf76f49ef521ee64e6beac870924c30bd11db6b752c10afba6b21397

SHA512
58d1d42cde6c3d07f6fb61fc246ea13b5567e6df1c3209e3a81c7c55d97cd43c2b1b4e9dd16a4f9cadd3a40880b22b11d63854064dddd3150c30f4ce75e0bd29

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\S3AUR4FX.cookie

Filesize
132B

MD5
6a9bc2857866b9bd98cfe24b899f73db

SHA1
7388e7f4b4596cce3f700cca164922d6d6ba3354

SHA256
202bfbd8e321c272d63953412fb1c418a7f8fcc474ad3c870d9d69587a7977f2

SHA512
e71d45455b212dd231407f0e080adc9d17b281fde5928dcd935bdaf9f7d957fdef76fb8cc2b88089739ae3855ec64e875b2b7f70b9573b43a77864f7595eb5dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
09327dbcee5275514602c362cfaddd13

SHA1
029ddcae1e96b1aa1e07eb58e2cd40243d5caa7f

SHA256
168384aed3019a203dc122259d5028e84fbd510d89cf91ee89f046402036b6bc

SHA512
e63d21426bb029ddf1376f286fb2a04bae09c25f17d008b7ac7db30312e8b068bfae49b314a0062cf68198f632a6fce0ef7e5a041eb0a00f9b6d783be3c642d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_88B06D18F336F4573DA4CD16EEF01E99

Filesize
471B

MD5
5f93d2ee1f8bc9c027d662cfca92d7a3

SHA1
8281e9ca3a7923e4c24d271e16380d50ad76e13d

SHA256
af7bd320100aa1edaedb93e43ece4cf882b46ea8d018a390535efe5ef2062356

SHA512
89d7e6f3842967d747b4484c8fe72200c4671d6d739b0cc622e5b21cac01adceea46588ac26633f94bf54cd2c963f68c39db8cd54209cda2527f23b814ebf13c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
471B

MD5
f55be45293c626c75f6f9e3a64a75a8c

SHA1
7fcd93b0663578e4b3c12fb7c260a4b511e8fd91

SHA256
ad529cb315ce13925a1c72b1b7127084241ff77027e6548a4d9704dd8eb42223

SHA512
62e05a2068c740ece93b3c35ca740cbd6943d321b3c54837b8a7bfd1327125f4992ccf7bb0f8438b8fa20c33471967fd761d0bc9a98d9bffc93f670e25f4be58

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
0bce063fabc807562730fe24859d86e6

SHA1
0ce33715127898ce29bbdefc58912016115926c8

SHA256
3e364a50efe0faa3fe57ba823fa0e36c4ed91e9d4b937213b08e0a9c0cd15fe6

SHA512
bc756a3a718696f26db65a2ff8f88329377ede232b997d163ad083af35796fb5b0b6d7b395183a7c06684c09b6f1f07bf1895f17aafcaec6388a2721533aa2e7

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_88B06D18F336F4573DA4CD16EEF01E99

Filesize
406B

MD5
2bc9307e0ce27daebaadce033425af26

SHA1
3c90b689b71c38b025f9cd41bf2ea725285a9ef2

SHA256
af8d13e82e56097fd80de86ca0b52b20fa59cbf0d50451707f5ee24344930da8

SHA512
995ae427679de1da9f6842a7ea0a579c3c6d4e8967b76bebe28b4f730b04cf9b5bacdce4acc8335910a447a8ba5601a49cafb24666537410196aa8b9fc065ab9

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
3f651884e0956bcb1d6b6220e02e5be2

SHA1
d1e3c665b14da8c70c95b374f8e7a86bda29ac9b

SHA256
bdc44391431a9a6b69634f283b4f0b59c948ac685bf83558a432ee3e5fc52104

SHA512
f4fffed27a80e9ab39d128ca9dbef7cca996ac02a4651cb2f1171d936e1f1c876518b364ef937c3a225945ada11d4a60a2c3df825b69de112751a83c4d766176

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
406B

MD5
625c3b4e02ac4c97ca55db7ea464e247

SHA1
aa92f6934a7c2585fe9fc6ad358d9a7a6cd7bc4a

SHA256
997b1048afdf71184cceb89ad882e4d1b0650e3b4d18a525f557f08a143281d9

SHA512
3749c90ce17d810977ad9176a7c6b313cdfd3a972bbbcd5b5b4e626b72bb2e62cd216a0d94e79bdad0afc370043bf134fd2f464702beaae868d85679552d7b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1339.exe

Filesize
19KB

MD5
cb71132b03f15b037d3e8a5e4d9e0285

SHA1
95963fba539b45eb6f6acbd062c48976733519a1

SHA256
7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373

SHA512
d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1339.exe

Filesize
19KB

MD5
cb71132b03f15b037d3e8a5e4d9e0285

SHA1
95963fba539b45eb6f6acbd062c48976733519a1

SHA256
7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373

SHA512
d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1703.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1703.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1FED.exe

Filesize
1.4MB

MD5
965fcf373f3e95995f8ae35df758eca1

SHA1
a62d2494f6ba8a02a80a02017e7c347f76b18fa6

SHA256
82eab1b2cab9f16d77c242e4ff1eb983d7e0a64b78b5dc69d87af2a4016f4f39

SHA512
55e9fefbe2a1ed92034573f3c4bb03fe29b0d345ebe834f2f9192d5ddd2237f1bb8e4fb5f9516852e7e0efa42a3122a11d2f0db7c9633b1566901cdd7862ff52

Download Submit
C:\Users\Admin\AppData\Local\Temp\1FED.exe

Filesize
1.4MB

MD5
965fcf373f3e95995f8ae35df758eca1

SHA1
a62d2494f6ba8a02a80a02017e7c347f76b18fa6

SHA256
82eab1b2cab9f16d77c242e4ff1eb983d7e0a64b78b5dc69d87af2a4016f4f39

SHA512
55e9fefbe2a1ed92034573f3c4bb03fe29b0d345ebe834f2f9192d5ddd2237f1bb8e4fb5f9516852e7e0efa42a3122a11d2f0db7c9633b1566901cdd7862ff52

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\2F8F.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\2F8F.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B5.exe

Filesize
1.4MB

MD5
405bed3c81dda333c1c046b8a4acddb7

SHA1
04a92bfe3803f487bd045859f367527408bb598f

SHA256
fc4f2e3a7ffa549ac71fe68f4dbfe23a7eae3ba1538cb34bfe87964150ebb78a

SHA512
c2e2ac21e95f33cc577f002f8b745c9a2b90e5a639d411e66715d77bb5c39d82f7baca1670a839b786269d98c1bd20b1bcace503de250dd1e6cbcc5fc441bd24

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B5.exe

Filesize
1.4MB

MD5
405bed3c81dda333c1c046b8a4acddb7

SHA1
04a92bfe3803f487bd045859f367527408bb598f

SHA256
fc4f2e3a7ffa549ac71fe68f4dbfe23a7eae3ba1538cb34bfe87964150ebb78a

SHA512
c2e2ac21e95f33cc577f002f8b745c9a2b90e5a639d411e66715d77bb5c39d82f7baca1670a839b786269d98c1bd20b1bcace503de250dd1e6cbcc5fc441bd24

Download Submit
C:\Users\Admin\AppData\Local\Temp\4EF.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4C0.exe

Filesize
1.5MB

MD5
4c2d232ab1f1fdbb6ec9cbf1b7f98bdb

SHA1
6c1676147d99e16c12b37352e4e00422f6d30922

SHA256
89fe2c4d9c055097bdb16f629fd9261d5947c4a944ff39efdfdeadde037647cf

SHA512
b10656d98a33a3bff97fbabe5fb3ed67a766ce90948cba3fabe1fde70d1dee06d962108dc8d9446cac0c19d6e1c4a0c29e23c5c19f7c8849b29bb3dda00e1dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\F4C0.exe

Filesize
1.5MB

MD5
4c2d232ab1f1fdbb6ec9cbf1b7f98bdb

SHA1
6c1676147d99e16c12b37352e4e00422f6d30922

SHA256
89fe2c4d9c055097bdb16f629fd9261d5947c4a944ff39efdfdeadde037647cf

SHA512
b10656d98a33a3bff97fbabe5fb3ed67a766ce90948cba3fabe1fde70d1dee06d962108dc8d9446cac0c19d6e1c4a0c29e23c5c19f7c8849b29bb3dda00e1dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBD.exe

Filesize
1.5MB

MD5
ff3bcf3a580783ec9a16d2901ff055d0

SHA1
88dcbee891bfa9f4e80dec42eebe6529ded3a2f1

SHA256
d3a0b18e5bf5d2734cbe0af28c4afaca88814f356a78b1e8deb56464762eaaf2

SHA512
a2e48a3187ea4c86806a95ccc29d45594d0919a2d2f23cecc5ace6f85233692c2b17ec369f2367de47ea518ce0fed2b1f71c4c25e8ce2e610b5d671bd389e7ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\FBD.exe

Filesize
1.5MB

MD5
ff3bcf3a580783ec9a16d2901ff055d0

SHA1
88dcbee891bfa9f4e80dec42eebe6529ded3a2f1

SHA256
d3a0b18e5bf5d2734cbe0af28c4afaca88814f356a78b1e8deb56464762eaaf2

SHA512
a2e48a3187ea4c86806a95ccc29d45594d0919a2d2f23cecc5ace6f85233692c2b17ec369f2367de47ea518ce0fed2b1f71c4c25e8ce2e610b5d671bd389e7ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ly0UG6Fv.exe

Filesize
1.3MB

MD5
1cf2448c77912ef19264deb29336b0ba

SHA1
47d4c2cead3661b2e4c9aa43141dc707555d5630

SHA256
fd8bab041e12ed9c6f731a9664496357ad378ad9504bebd2587ca56398d801b0

SHA512
dbd983aeda9cbff0fc3bb96673031f54eade14401620c30a6aef73815b7a439c3eb99306842615ebc03f630003029c86e62b2154299185d631fd2fe35714308d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ly0UG6Fv.exe

Filesize
1.3MB

MD5
1cf2448c77912ef19264deb29336b0ba

SHA1
47d4c2cead3661b2e4c9aa43141dc707555d5630

SHA256
fd8bab041e12ed9c6f731a9664496357ad378ad9504bebd2587ca56398d801b0

SHA512
dbd983aeda9cbff0fc3bb96673031f54eade14401620c30a6aef73815b7a439c3eb99306842615ebc03f630003029c86e62b2154299185d631fd2fe35714308d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XI0nn7yU.exe

Filesize
1.1MB

MD5
4e0ca4800c8be9e01c1213186c994a26

SHA1
b8ac789303bbf699b27683f87eaf0fee85940cdd

SHA256
9f2881b69c78aa4a3ddd76ab67716c432a63f7679289b9b248859b47c15d7b3a

SHA512
077dba4d7ef42d9eeb9542ca4a02d1727bcdc90e29ecc512ff9145782e21fbc036411d01d7bd64de8ce67f0442ae6d845378fda9560de930bad0843c5a0effd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XI0nn7yU.exe

Filesize
1.1MB

MD5
4e0ca4800c8be9e01c1213186c994a26

SHA1
b8ac789303bbf699b27683f87eaf0fee85940cdd

SHA256
9f2881b69c78aa4a3ddd76ab67716c432a63f7679289b9b248859b47c15d7b3a

SHA512
077dba4d7ef42d9eeb9542ca4a02d1727bcdc90e29ecc512ff9145782e21fbc036411d01d7bd64de8ce67f0442ae6d845378fda9560de930bad0843c5a0effd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MU4Kd4pb.exe

Filesize
736KB

MD5
76768a0b70a87b4f7888dbfcdaa5c543

SHA1
85bf20d470f3169e332040b7a56d51a49386e61f

SHA256
bca37cee4ca880333cb19425edf1abb29a3e9d2dbaa894c8d5b889093288efc9

SHA512
2a09842fba2ddc112f1d6a4668a593e9d1ce2412c2bcd9390de39ef1dc3ad0b3e54ece345ab0c76d04dc7fce267b0f2a3d23bb5b19c69a3feb5afc945d38b112

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\MU4Kd4pb.exe

Filesize
736KB

MD5
76768a0b70a87b4f7888dbfcdaa5c543

SHA1
85bf20d470f3169e332040b7a56d51a49386e61f

SHA256
bca37cee4ca880333cb19425edf1abb29a3e9d2dbaa894c8d5b889093288efc9

SHA512
2a09842fba2ddc112f1d6a4668a593e9d1ce2412c2bcd9390de39ef1dc3ad0b3e54ece345ab0c76d04dc7fce267b0f2a3d23bb5b19c69a3feb5afc945d38b112

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\As8cR5IO.exe

Filesize
563KB

MD5
1ceb7581f80e1295b1b50e4aac513011

SHA1
003f83c51b17141b8f86357380b75ea5613c83af

SHA256
63cdb8598ff1dcfc867f42997462aba3b2808df4e5cec323fd3892463741cf6c

SHA512
fe14c0c3e1a89033c50e0c07c5d4e0e2f5cd5d4ace50bf1ca2adef21390ad2cfba89b8e07f718de455fc219d1f57b405e081d2dcd00330a474e1556784a9f258

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\As8cR5IO.exe

Filesize
563KB

MD5
1ceb7581f80e1295b1b50e4aac513011

SHA1
003f83c51b17141b8f86357380b75ea5613c83af

SHA256
63cdb8598ff1dcfc867f42997462aba3b2808df4e5cec323fd3892463741cf6c

SHA512
fe14c0c3e1a89033c50e0c07c5d4e0e2f5cd5d4ace50bf1ca2adef21390ad2cfba89b8e07f718de455fc219d1f57b405e081d2dcd00330a474e1556784a9f258

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1tL58UM0.exe

Filesize
1.4MB

MD5
da88697bc3fc87e6d07288fd2d96d272

SHA1
073a04f479f786dd333ff612140e40e5e3f29006

SHA256
7400e029eca09f0ccf647e0b16160d693c721aa07d43a55c11db45c840f14829

SHA512
514ee178e834f436104156b300d3c295a71ae18c9cdb9134bc2769f3e4a322412e64176d2d54b418597c6c0be43219400f81524b2a665a3d430e4a6a0988c5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1tL58UM0.exe

Filesize
1.4MB

MD5
da88697bc3fc87e6d07288fd2d96d272

SHA1
073a04f479f786dd333ff612140e40e5e3f29006

SHA256
7400e029eca09f0ccf647e0b16160d693c721aa07d43a55c11db45c840f14829

SHA512
514ee178e834f436104156b300d3c295a71ae18c9cdb9134bc2769f3e4a322412e64176d2d54b418597c6c0be43219400f81524b2a665a3d430e4a6a0988c5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
memory/368-524-0x00000000728F0000-0x0000000072FDE000-memory.dmp

Filesize
6.9MB

Download
memory/368-199-0x000000000B940000-0x000000000B9D2000-memory.dmp

Filesize
584KB

Download
memory/368-145-0x00000000728F0000-0x0000000072FDE000-memory.dmp

Filesize
6.9MB

Download
memory/368-543-0x000000000BBB0000-0x000000000BBC0000-memory.dmp

Filesize
64KB

Download
memory/368-162-0x000000000BDA0000-0x000000000C29E000-memory.dmp

Filesize
5.0MB

Download
memory/368-220-0x000000000BBB0000-0x000000000BBC0000-memory.dmp

Filesize
64KB

Download
memory/368-227-0x000000000B8E0000-0x000000000B8EA000-memory.dmp

Filesize
40KB

Download
memory/368-134-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/368-278-0x000000000BB50000-0x000000000BB9B000-memory.dmp

Filesize
300KB

Download
memory/368-245-0x000000000CAB0000-0x000000000D0B6000-memory.dmp

Filesize
6.0MB

Download
memory/368-254-0x000000000C2A0000-0x000000000C3AA000-memory.dmp

Filesize
1.0MB

Download
memory/368-259-0x000000000BB20000-0x000000000BB32000-memory.dmp

Filesize
72KB

Download
memory/368-270-0x000000000BBC0000-0x000000000BBFE000-memory.dmp

Filesize
248KB

Download
memory/1908-73-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1908-76-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1908-71-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1908-107-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2112-418-0x0000000000180000-0x000000000033D000-memory.dmp

Filesize
1.7MB

Download
memory/2112-398-0x0000000000180000-0x000000000033D000-memory.dmp

Filesize
1.7MB

Download
memory/2112-260-0x0000000000180000-0x000000000033D000-memory.dmp

Filesize
1.7MB

Download
memory/2132-231-0x000001B397A90000-0x000001B397A92000-memory.dmp

Filesize
8KB

Download
memory/2132-225-0x000001B397A20000-0x000001B397A22000-memory.dmp

Filesize
8KB

Download
memory/2132-216-0x000001B3976B0000-0x000001B3976B2000-memory.dmp

Filesize
8KB

Download
memory/2448-416-0x00000199237A0000-0x00000199238A0000-memory.dmp

Filesize
1024KB

Download
memory/2448-421-0x0000019923C00000-0x0000019923D00000-memory.dmp

Filesize
1024KB

Download
memory/2448-404-0x0000019922090000-0x0000019922092000-memory.dmp

Filesize
8KB

Download
memory/2448-504-0x00000199228E0000-0x00000199228E2000-memory.dmp

Filesize
8KB

Download
memory/2448-500-0x00000199222E0000-0x00000199222E2000-memory.dmp

Filesize
8KB

Download
memory/2448-310-0x0000019922240000-0x0000019922260000-memory.dmp

Filesize
128KB

Download
memory/2448-210-0x0000019922100000-0x0000019922120000-memory.dmp

Filesize
128KB

Download
memory/2448-305-0x0000019911100000-0x0000019911200000-memory.dmp

Filesize
1024KB

Download
memory/3076-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3076-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3076-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3100-136-0x00007FF9B2CC0000-0x00007FF9B36AC000-memory.dmp

Filesize
9.9MB

Download
memory/3100-133-0x0000000000010000-0x000000000001A000-memory.dmp

Filesize
40KB

Download
memory/3100-528-0x00007FF9B2CC0000-0x00007FF9B36AC000-memory.dmp

Filesize
9.9MB

Download
memory/3100-496-0x00007FF9B2CC0000-0x00007FF9B36AC000-memory.dmp

Filesize
9.9MB

Download
memory/3124-420-0x00000000728F0000-0x0000000072FDE000-memory.dmp

Filesize
6.9MB

Download
memory/3124-595-0x000000000FB70000-0x000000000FD32000-memory.dmp

Filesize
1.8MB

Download
memory/3124-972-0x000000000FAA0000-0x000000000FAF0000-memory.dmp

Filesize
320KB

Download
memory/3124-727-0x0000000008ED0000-0x0000000008EE0000-memory.dmp

Filesize
64KB

Download
memory/3124-726-0x00000000728F0000-0x0000000072FDE000-memory.dmp

Filesize
6.9MB

Download
memory/3124-437-0x0000000008ED0000-0x0000000008EE0000-memory.dmp

Filesize
64KB

Download
memory/3124-599-0x0000000010270000-0x000000001079C000-memory.dmp

Filesize
5.2MB

Download
memory/3124-581-0x000000000E7D0000-0x000000000E836000-memory.dmp

Filesize
408KB

Download
memory/3124-576-0x000000000E610000-0x000000000E686000-memory.dmp

Filesize
472KB

Download
memory/3124-401-0x0000000000370000-0x00000000003A0000-memory.dmp

Filesize
192KB

Download
memory/3124-425-0x0000000000BA0000-0x0000000000BA6000-memory.dmp

Filesize
24KB

Download
memory/3236-50-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3236-53-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3236-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3236-56-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3256-4-0x0000000000CA0000-0x0000000000CB6000-memory.dmp

Filesize
88KB

Download
memory/4952-87-0x00000170F9B00000-0x00000170F9B10000-memory.dmp

Filesize
64KB

Download
memory/4952-65-0x00000170F9720000-0x00000170F9730000-memory.dmp

Filesize
64KB

Download
memory/4952-463-0x00000170814E0000-0x00000170814E1000-memory.dmp

Filesize
4KB

Download
memory/4952-464-0x00000170814F0000-0x00000170814F1000-memory.dmp

Filesize
4KB

Download
memory/4952-106-0x00000170F6AE0000-0x00000170F6AE2000-memory.dmp

Filesize
8KB

Download