amadey | 961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3

Analysis

max time kernel
33s
max time network
110s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
05/10/2023, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe
Size

1.6MB
MD5

cd1af740ec16c24e33ad2038c233320f
SHA1

32f26fe00bded3ad1d69f913f200ed76c3f2086f
SHA256

961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3
SHA512

f6feb514040dfaf2fdf0117a098b96eb6625d9b9014f59f2ded4ae85d4a6b674d0b31fdc76bae4fe2270ccf216d2daf2b80ee926c62dd7e81fbf73f0aa86448c
SSDEEP

12288:xreQ/YQvi8Iv71ZtBXtjxaslVndVmRQH9j4K1uTaO9X6a9Dhvht6Nqp:mQvi8O1ZtBXtjH3dVJdk6a9Dhvh

Score

10^/10

amadey fabookie healer mystic redline smokeloader @ytlogsbot frant backdoor google dropper evasion infostealer persistence phishing spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

frant

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

amadey

Version

3.83

http://5.42.65.80/8bmeVwqx/index.php

Attributes

install_dir
207aa4515d
install_file
oneetx.exe
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4

rc4.plain

Extracted

Family

redline

Botnet

@ytlogsbot

176.123.4.46:33783

Extracted

Family

fabookie

http://app.nnnaajjjgc.com/check/safe

Extracted

Family

mystic

http://5.42.92.211/loghub/master

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral2/memory/5480-600-0x00000000035F0000-0x0000000003721000-memory.dmp	family_fabookie
behavioral2/memory/5480-1004-0x00000000035F0000-0x0000000003721000-memory.dmp	family_fabookie

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral2/memory/3284-54-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2544-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2544-66-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3284-65-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3284-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3284-68-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/2544-69-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3284-71-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detected google phishing page
phishing google

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000001b00c-122.dat	healer
behavioral2/files/0x000700000001b00c-123.dat	healer
behavioral2/memory/4116-124-0x0000000000450000-0x000000000045A000-memory.dmp	healer

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	FA90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	FA90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	FA90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	FA90.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	FA90.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/memory/1712-138-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral2/memory/4420-492-0x00000000001F0000-0x00000000003EC000-memory.dmp	family_redline
behavioral2/memory/4420-508-0x00000000001F0000-0x00000000003EC000-memory.dmp	family_redline
behavioral2/memory/4552-512-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1288	E474.exe
760	Ba3Im7ez.exe
4772	wB8Uf1HI.exe
3552	cH6YD8NC.exe
3076	HZ5Ax2CC.exe
4232	E7C1.exe
316	1dX95mj1.exe
3744	F8BB.exe
4116	FA90.exe
5052	FDCE.exe
696	explothe.exe
5076	B7C.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	FA90.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	wB8Uf1HI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	cH6YD8NC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	HZ5Ax2CC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	E474.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ba3Im7ez.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3560 set thread context of 2288	3560	961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe	70
PID 4232 set thread context of 3284	4232	E7C1.exe	81
PID 316 set thread context of 2544	316	1dX95mj1.exe	80
PID 3744 set thread context of 1712	3744	F8BB.exe	95

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3992	3560	WerFault.exe	69
3416	4232	WerFault.exe	77
2664	316	WerFault.exe	79
4520	2544	WerFault.exe	80

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2032	schtasks.exe
1672	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b2b2604b47f7d901	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2288	AppLaunch.exe
2288	AppLaunch.exe
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found
3240	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3240	Process not Found

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
2288	AppLaunch.exe
4248	MicrosoftEdgeCP.exe
4248	MicrosoftEdgeCP.exe
4248	MicrosoftEdgeCP.exe
4248	MicrosoftEdgeCP.exe
4248	MicrosoftEdgeCP.exe
4248	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeDebugPrivilege	1528	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1528	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1528	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1528	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeDebugPrivilege	4116	FA90.exe
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found
Token: SeShutdownPrivilege	3240	Process not Found
Token: SeCreatePagefilePrivilege	3240	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
352	MicrosoftEdge.exe
4248	MicrosoftEdgeCP.exe
1528	MicrosoftEdgeCP.exe
4248	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2288	3560	961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe	70
PID 3560 wrote to memory of 2288	3560	961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe	70
PID 3560 wrote to memory of 2288	3560	961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe	70
PID 3560 wrote to memory of 2288	3560	961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe	70
PID 3560 wrote to memory of 2288	3560	961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe	70
PID 3560 wrote to memory of 2288	3560	961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe	70
PID 3240 wrote to memory of 1288	3240	Process not Found	73
PID 3240 wrote to memory of 1288	3240	Process not Found	73
PID 3240 wrote to memory of 1288	3240	Process not Found	73
PID 1288 wrote to memory of 760	1288	E474.exe	74
PID 1288 wrote to memory of 760	1288	E474.exe	74
PID 1288 wrote to memory of 760	1288	E474.exe	74
PID 760 wrote to memory of 4772	760	Ba3Im7ez.exe	75
PID 760 wrote to memory of 4772	760	Ba3Im7ez.exe	75
PID 760 wrote to memory of 4772	760	Ba3Im7ez.exe	75
PID 4772 wrote to memory of 3552	4772	wB8Uf1HI.exe	76
PID 4772 wrote to memory of 3552	4772	wB8Uf1HI.exe	76
PID 4772 wrote to memory of 3552	4772	wB8Uf1HI.exe	76
PID 3552 wrote to memory of 3076	3552	cH6YD8NC.exe	78
PID 3552 wrote to memory of 3076	3552	cH6YD8NC.exe	78
PID 3552 wrote to memory of 3076	3552	cH6YD8NC.exe	78
PID 3240 wrote to memory of 4232	3240	Process not Found	77
PID 3240 wrote to memory of 4232	3240	Process not Found	77
PID 3240 wrote to memory of 4232	3240	Process not Found	77
PID 3076 wrote to memory of 316	3076	HZ5Ax2CC.exe	79
PID 3076 wrote to memory of 316	3076	HZ5Ax2CC.exe	79
PID 3076 wrote to memory of 316	3076	HZ5Ax2CC.exe	79
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 4232 wrote to memory of 3284	4232	E7C1.exe	81
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 316 wrote to memory of 2544	316	1dX95mj1.exe	80
PID 3240 wrote to memory of 5008	3240	Process not Found	82
PID 3240 wrote to memory of 5008	3240	Process not Found	82
PID 3240 wrote to memory of 3744	3240	Process not Found	93
PID 3240 wrote to memory of 3744	3240	Process not Found	93
PID 3240 wrote to memory of 3744	3240	Process not Found	93
PID 3240 wrote to memory of 4116	3240	Process not Found	94
PID 3240 wrote to memory of 4116	3240	Process not Found	94
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3744 wrote to memory of 1712	3744	F8BB.exe	95
PID 3240 wrote to memory of 5052	3240	Process not Found	96
PID 3240 wrote to memory of 5052	3240	Process not Found	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe
"C:\Users\Admin\AppData\Local\Temp\961dc505a86a3e0db5c77d3ad4c966cfcd43ec23e94190a879a2b171b930beb3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 172
  2⤵
  - Program crash
  PID:3992

C:\Users\Admin\AppData\Local\Temp\E474.exe
C:\Users\Admin\AppData\Local\Temp\E474.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ba3Im7ez.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ba3Im7ez.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wB8Uf1HI.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wB8Uf1HI.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cH6YD8NC.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cH6YD8NC.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HZ5Ax2CC.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HZ5Ax2CC.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3076
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dX95mj1.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dX95mj1.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 568
        8⤵
        Program crash
        
        PID:4520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 560
        7⤵
        Program crash
        
        PID:2664

C:\Users\Admin\AppData\Local\Temp\E7C1.exe
C:\Users\Admin\AppData\Local\Temp\E7C1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 324
  2⤵
  - Program crash
  PID:3416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EB8B.bat" "
1⤵
PID:5008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:352

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4620

C:\Users\Admin\AppData\Local\Temp\F8BB.exe
C:\Users\Admin\AppData\Local\Temp\F8BB.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1712

C:\Users\Admin\AppData\Local\Temp\FA90.exe
C:\Users\Admin\AppData\Local\Temp\FA90.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Users\Admin\AppData\Local\Temp\FDCE.exe
C:\Users\Admin\AppData\Local\Temp\FDCE.exe
1⤵
- Executes dropped EXE
PID:5052
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Executes dropped EXE
  PID:696
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:824
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:2284
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:4016
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:3556
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:3732
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:5424

C:\Users\Admin\AppData\Local\Temp\B7C.exe
C:\Users\Admin\AppData\Local\Temp\B7C.exe
1⤵
- Executes dropped EXE
PID:5076
- C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
  "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
    3⤵
    PID:4064
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:N"
      4⤵
      PID:5132
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5124
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "oneetx.exe" /P "Admin:R" /E
      4⤵
      PID:5416
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:5560
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:N"
      4⤵
      PID:5616
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\207aa4515d" /P "Admin:R" /E
      4⤵
      PID:5636
- - C:\Users\Admin\AppData\Local\Temp\1000494001\ss41.exe
    "C:\Users\Admin\AppData\Local\Temp\1000494001\ss41.exe"
    3⤵
    PID:5480

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5008

C:\Users\Admin\AppData\Local\Temp\12C0.exe
C:\Users\Admin\AppData\Local\Temp\12C0.exe
1⤵
PID:4420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:4552

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1672

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5448

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\6GLEL24P\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\QHT6483Z.cookie

Filesize
132B

MD5
3033aae13cb1661db1619709a4bec7de

SHA1
ed0aa32cb5492461ee13fc28a41bd75868631573

SHA256
74ecf274e7f8ba46e38b991e1514592255f46c28c530f31cc15c2ebda20e1d50

SHA512
e7d06e23b8db264659ca6ba72ecc0cd3e12c0faef93d5d38469e7651c931382c26561fa6da4692ed9c9ee00a13c703bc4ff102972e7b0b70abf9cd5688093054

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
dbe229b55b31b4938e0e528b4fc7bc53

SHA1
abada084d6e300e6f8051242543a96ecb56b9a42

SHA256
dae58f95414f813e1e7f8a6480ee10ba2fcd8e2e17587efd7c1969957de1b182

SHA512
7c3a63248465cb1d7feb96a9d9538f7322b79b254191b091caf1d3facd5ebf129dd2ae1c561f637fc6fc4215b705e22958aa7c6c405601401c466788a6656dcb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
471B

MD5
bea8a58e83b85f772d2bd831991a7207

SHA1
b8c27f645c48af4baccd2bad5ddc5c592a4c1acc

SHA256
f850af37618f8d74894a9dd01b5c932b62e14cfe27b45a6475b5d4721a8dd6c6

SHA512
e15d2fd31274c512176317ddbaf4164aab766c4998dd21a78e731622100aee057a56a8c78693ed236ff8ca054f17d3ad1366885796766fd17a666647388d95e3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
279815969e454e74c9c1b045fb672f8e

SHA1
b207a74f1c34bc07b13f1f4299f62c9b3275ea35

SHA256
91724b330676807796873d10b2318db037545ab6760ad8cf14aaef2ba0125edf

SHA512
abee6bd1c37cf479d515ef2090bda40ac75c5114c5978981c8f636237669364e349ffd943c1c2a0b3bc84d815c0015f0504dbc23479fa2424761ff4fc7369ddd

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
52f7b8d18ff495889b46dd9e946a1e8b

SHA1
ed7c973922e760951ff414970f985833effe7c28

SHA256
7dec6a017e97e85ffcfb6a0ce7c1562bbc0b32732f485806f2b0fd67c329a3f2

SHA512
b081d0820b3a689173c67d20b8d740b1cff542913b3ec33788bdd44050201ad34ac55a152835b929cfbcd7e015b45338fe4a6127f810444fa70049d3184d9389

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
7ab2b7bd8abd9a4e991bcf65cab358cb

SHA1
193710cb67986eb5e715084c849f45a5bdbf45b0

SHA256
b05ee952824411ddca8be42b3064bbc38b9ebeb1d5b87845304e5c04b921a92c

SHA512
508561ea14783fa01a09f74b66a96d2ab111af71e3f85f37765e4e73e8e394de214d5db4a5848d47e458bff24dcf848cc5043dcae2c5153f08b8e3f8303a3c36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_87DCDABBB68171FA19C9A78DBA85E190

Filesize
406B

MD5
2fd586fc07540fb405392b4a51fc4d95

SHA1
56a237324f4f2ac935401e7ea2a1751084950aac

SHA256
b6fda2ea95f4c4b24c0f1ee048ebb5572cc5e3b682dde37eacdb9ec51b311dd5

SHA512
771e8360fc4bc88a631dc9327cc5f7fd2aa91359099ca82b3cf4c1c66226ca464628ffb91152a225815cd8a1fac7788a15ef811565a16dbab030f8c794245998

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000494001\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000494001\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000494001\ss41.exe

Filesize
416KB

MD5
83330cf6e88ad32365183f31b1fd3bda

SHA1
1c5b47be2b8713746de64b39390636a81626d264

SHA256
7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e

SHA512
e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

Download Submit
C:\Users\Admin\AppData\Local\Temp\12C0.exe

Filesize
1.7MB

MD5
c5999a94094f1b68b36ecdb65e809730

SHA1
98cf102907fdbb1028a27f3373dcbadd90e6d9c6

SHA256
0283b90f2de0901b3321e21889e7f068b8ddeebe02cb910bf267edd2690c9b39

SHA512
7c518085c7601c9b3ed83178795ee9a6d2475dc0f2b067f3b385d5eb06c98979c4f661e32a9a99a5993e04df6b380e4ccab2a02985b1a8747c60a424f9c6c4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\12C0.exe

Filesize
1.7MB

MD5
c5999a94094f1b68b36ecdb65e809730

SHA1
98cf102907fdbb1028a27f3373dcbadd90e6d9c6

SHA256
0283b90f2de0901b3321e21889e7f068b8ddeebe02cb910bf267edd2690c9b39

SHA512
7c518085c7601c9b3ed83178795ee9a6d2475dc0f2b067f3b385d5eb06c98979c4f661e32a9a99a5993e04df6b380e4ccab2a02985b1a8747c60a424f9c6c4f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\B7C.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\B7C.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\E474.exe

Filesize
1.7MB

MD5
311b8e9d4a3084f26e1035ead880ba69

SHA1
7e198a922c3b0bbd72e898724c9b142c722b3e8c

SHA256
5fb3469b518dc772d6c9528f4bbb94224819e54bd0b7933ec37529169f716f82

SHA512
6a4d2955caad3f809f3e926c89497afd26f178280b42e25be857512554fb69c6d13c9719b7e517a4cc1ad4a7c418ffe989e2a67debeb34d7d4b72bff1ad8c224

Download Submit
C:\Users\Admin\AppData\Local\Temp\E474.exe

Filesize
1.7MB

MD5
311b8e9d4a3084f26e1035ead880ba69

SHA1
7e198a922c3b0bbd72e898724c9b142c722b3e8c

SHA256
5fb3469b518dc772d6c9528f4bbb94224819e54bd0b7933ec37529169f716f82

SHA512
6a4d2955caad3f809f3e926c89497afd26f178280b42e25be857512554fb69c6d13c9719b7e517a4cc1ad4a7c418ffe989e2a67debeb34d7d4b72bff1ad8c224

Download Submit
C:\Users\Admin\AppData\Local\Temp\E7C1.exe

Filesize
1.8MB

MD5
f3f2f8b5752ef75807bb50f7cdca9813

SHA1
0b4c8a7da527a45432922e8f6eaddc5959165ae1

SHA256
0fef3487fff91a01030ad443e6e548c323825a6c9d354d406c5d224b25dc880d

SHA512
6bd7f737e4490756f520f21d3f3c5c08b36f70c001f861c6cea9b75ae59254a1fa42d265f121c2ba54d0f12bdfd6b03580cf5a4a8e037fd0331732bddd95d09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E7C1.exe

Filesize
1.8MB

MD5
f3f2f8b5752ef75807bb50f7cdca9813

SHA1
0b4c8a7da527a45432922e8f6eaddc5959165ae1

SHA256
0fef3487fff91a01030ad443e6e548c323825a6c9d354d406c5d224b25dc880d

SHA512
6bd7f737e4490756f520f21d3f3c5c08b36f70c001f861c6cea9b75ae59254a1fa42d265f121c2ba54d0f12bdfd6b03580cf5a4a8e037fd0331732bddd95d09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB8B.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\F8BB.exe

Filesize
1.9MB

MD5
630db5d59b0659769e88d79dcb8a8f97

SHA1
b0f88528ceb4d60a1a20f0e09665922cbd9eb711

SHA256
b44b37f30f08965b2107ae48baa82cc5667887ef0a7d0bc12bc65437630a85ef

SHA512
c0882c82949a54f6a2d1e2ff9a1d86e56003bb094e780a5c5c06f07aa7634a61ca91ba7304c83ad1613521346812b616bd15e99cee2b7be2ec33047ee223d7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\F8BB.exe

Filesize
1.9MB

MD5
630db5d59b0659769e88d79dcb8a8f97

SHA1
b0f88528ceb4d60a1a20f0e09665922cbd9eb711

SHA256
b44b37f30f08965b2107ae48baa82cc5667887ef0a7d0bc12bc65437630a85ef

SHA512
c0882c82949a54f6a2d1e2ff9a1d86e56003bb094e780a5c5c06f07aa7634a61ca91ba7304c83ad1613521346812b616bd15e99cee2b7be2ec33047ee223d7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA90.exe

Filesize
19KB

MD5
cb71132b03f15b037d3e8a5e4d9e0285

SHA1
95963fba539b45eb6f6acbd062c48976733519a1

SHA256
7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373

SHA512
d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA90.exe

Filesize
19KB

MD5
cb71132b03f15b037d3e8a5e4d9e0285

SHA1
95963fba539b45eb6f6acbd062c48976733519a1

SHA256
7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373

SHA512
d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDCE.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDCE.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ba3Im7ez.exe

Filesize
1.5MB

MD5
c01c845d6a76fcd2acbebe2ecaadd33c

SHA1
b11171fbdb7e27f72d20d2386e89a5f6cd4a2277

SHA256
a8735e8205d9fb0270e671c8298d3464bf03b3da5d715cbc30c5d6a947e3cc6d

SHA512
616e08bdd9ddaf715b0a6e045c74987be1ce5295f6dc8664483a83bba4b0f1e58eda893b4e6535a4abd7828849b67ee6f5ae90d771ea6767aa0eb5d7059b3957

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ba3Im7ez.exe

Filesize
1.5MB

MD5
c01c845d6a76fcd2acbebe2ecaadd33c

SHA1
b11171fbdb7e27f72d20d2386e89a5f6cd4a2277

SHA256
a8735e8205d9fb0270e671c8298d3464bf03b3da5d715cbc30c5d6a947e3cc6d

SHA512
616e08bdd9ddaf715b0a6e045c74987be1ce5295f6dc8664483a83bba4b0f1e58eda893b4e6535a4abd7828849b67ee6f5ae90d771ea6767aa0eb5d7059b3957

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wB8Uf1HI.exe

Filesize
1.3MB

MD5
9ff796abf160a90606ebd4ee3eca37b4

SHA1
9212ca488c3f1a9bf006317172de28b4623eeaa4

SHA256
ee060bdfb14633f615d034eb3c862e10dc3fecaf292c1e1e52e25182fd2ed98b

SHA512
92e55c7e1d71754772698d05069ce8f77eecb0bbc1d42927482283b555d27957d1ccb829f2699553bd5ddc4e494d072bfe9ab4bc396bc478b8cf930824d31f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wB8Uf1HI.exe

Filesize
1.3MB

MD5
9ff796abf160a90606ebd4ee3eca37b4

SHA1
9212ca488c3f1a9bf006317172de28b4623eeaa4

SHA256
ee060bdfb14633f615d034eb3c862e10dc3fecaf292c1e1e52e25182fd2ed98b

SHA512
92e55c7e1d71754772698d05069ce8f77eecb0bbc1d42927482283b555d27957d1ccb829f2699553bd5ddc4e494d072bfe9ab4bc396bc478b8cf930824d31f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cH6YD8NC.exe

Filesize
824KB

MD5
b2370a4d608610c0b4eac8d25f63e804

SHA1
5026177202cc34487f1be1ae2bb87a25c2b4e1a0

SHA256
df5991e15c4a3b94ff93017d775629c86b2afd1a13c852dcb78b53ccf0fb9742

SHA512
2d9b2ebfeeef0fd8c5100fd2f07cece5d5dae21f59ab5b477164f94fd0b66c7b495baecfdbc5d2038a470481f6fc30f76b2e297648cda19979ddcc492a79bd69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cH6YD8NC.exe

Filesize
824KB

MD5
b2370a4d608610c0b4eac8d25f63e804

SHA1
5026177202cc34487f1be1ae2bb87a25c2b4e1a0

SHA256
df5991e15c4a3b94ff93017d775629c86b2afd1a13c852dcb78b53ccf0fb9742

SHA512
2d9b2ebfeeef0fd8c5100fd2f07cece5d5dae21f59ab5b477164f94fd0b66c7b495baecfdbc5d2038a470481f6fc30f76b2e297648cda19979ddcc492a79bd69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HZ5Ax2CC.exe

Filesize
652KB

MD5
0ed585616bc564d894e04013c2db9f21

SHA1
43ef62a926031f8e79a245bd4fc21ee41032add7

SHA256
0f04d4a41d2246841166b4969a00e0fc10ced422a451209653c5360a3b5f93d5

SHA512
dce212a99c66cce99d0d09b8eaae67265ce6e91c42c10a78b7cce55640191cfea5ceef6eb053fd5cb877b27fd244f9646e2315578cdafabcd204495c7934cc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HZ5Ax2CC.exe

Filesize
652KB

MD5
0ed585616bc564d894e04013c2db9f21

SHA1
43ef62a926031f8e79a245bd4fc21ee41032add7

SHA256
0f04d4a41d2246841166b4969a00e0fc10ced422a451209653c5360a3b5f93d5

SHA512
dce212a99c66cce99d0d09b8eaae67265ce6e91c42c10a78b7cce55640191cfea5ceef6eb053fd5cb877b27fd244f9646e2315578cdafabcd204495c7934cc63

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dX95mj1.exe

Filesize
1.8MB

MD5
f3f2f8b5752ef75807bb50f7cdca9813

SHA1
0b4c8a7da527a45432922e8f6eaddc5959165ae1

SHA256
0fef3487fff91a01030ad443e6e548c323825a6c9d354d406c5d224b25dc880d

SHA512
6bd7f737e4490756f520f21d3f3c5c08b36f70c001f861c6cea9b75ae59254a1fa42d265f121c2ba54d0f12bdfd6b03580cf5a4a8e037fd0331732bddd95d09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dX95mj1.exe

Filesize
1.8MB

MD5
f3f2f8b5752ef75807bb50f7cdca9813

SHA1
0b4c8a7da527a45432922e8f6eaddc5959165ae1

SHA256
0fef3487fff91a01030ad443e6e548c323825a6c9d354d406c5d224b25dc880d

SHA512
6bd7f737e4490756f520f21d3f3c5c08b36f70c001f861c6cea9b75ae59254a1fa42d265f121c2ba54d0f12bdfd6b03580cf5a4a8e037fd0331732bddd95d09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dX95mj1.exe

Filesize
1.8MB

MD5
f3f2f8b5752ef75807bb50f7cdca9813

SHA1
0b4c8a7da527a45432922e8f6eaddc5959165ae1

SHA256
0fef3487fff91a01030ad443e6e548c323825a6c9d354d406c5d224b25dc880d

SHA512
6bd7f737e4490756f520f21d3f3c5c08b36f70c001f861c6cea9b75ae59254a1fa42d265f121c2ba54d0f12bdfd6b03580cf5a4a8e037fd0331732bddd95d09e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
227KB

MD5
69d468f64dc451287c4d2af9e7e1e649

SHA1
7799b32a7a3c0e8679dade16ff97e60324e8b93c

SHA256
e88701f5f2bc931ade631c04c5d2d50e21ba0e64217c022d75b9c38fb132f451

SHA512
b8dc99a347a6d4fb7492830221bc89384f44f0f13cb17ef884e6b27e8fa7da5c7dda74bd276f9a3a6ff87373d01a11ed13243cb670cf372955270a558bc6f2bd

Download Submit
memory/352-440-0x000002204BBB0000-0x000002204BBB1000-memory.dmp

Filesize
4KB

Download
memory/352-439-0x000002204BBA0000-0x000002204BBA1000-memory.dmp

Filesize
4KB

Download
memory/352-107-0x0000022043E40000-0x0000022043E42000-memory.dmp

Filesize
8KB

Download
memory/352-88-0x0000022045280000-0x0000022045290000-memory.dmp

Filesize
64KB

Download
memory/352-72-0x0000022044B20000-0x0000022044B30000-memory.dmp

Filesize
64KB

Download
memory/1712-260-0x000000000C050000-0x000000000C15A000-memory.dmp

Filesize
1.0MB

Download
memory/1712-224-0x000000000BF30000-0x000000000BF40000-memory.dmp

Filesize
64KB

Download
memory/1712-256-0x000000000CD90000-0x000000000D396000-memory.dmp

Filesize
6.0MB

Download
memory/1712-262-0x000000000BF60000-0x000000000BF72000-memory.dmp

Filesize
72KB

Download
memory/1712-514-0x0000000072BD0000-0x00000000732BE000-memory.dmp

Filesize
6.9MB

Download
memory/1712-266-0x000000000BFC0000-0x000000000BFFE000-memory.dmp

Filesize
248KB

Download
memory/1712-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1712-168-0x0000000072BD0000-0x00000000732BE000-memory.dmp

Filesize
6.9MB

Download
memory/1712-292-0x000000000C000000-0x000000000C04B000-memory.dmp

Filesize
300KB

Download
memory/1712-229-0x0000000009980000-0x000000000998A000-memory.dmp

Filesize
40KB

Download
memory/1712-183-0x000000000C280000-0x000000000C77E000-memory.dmp

Filesize
5.0MB

Download
memory/1712-192-0x000000000BD80000-0x000000000BE12000-memory.dmp

Filesize
584KB

Download
memory/1712-554-0x000000000BF30000-0x000000000BF40000-memory.dmp

Filesize
64KB

Download
memory/2288-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2288-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2288-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2544-64-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2544-69-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2544-66-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3240-4-0x0000000000760000-0x0000000000776000-memory.dmp

Filesize
88KB

Download
memory/3284-65-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3284-63-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3284-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3284-68-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3284-71-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4116-129-0x00007FFC1D570000-0x00007FFC1DF5C000-memory.dmp

Filesize
9.9MB

Download
memory/4116-124-0x0000000000450000-0x000000000045A000-memory.dmp

Filesize
40KB

Download
memory/4116-552-0x00007FFC1D570000-0x00007FFC1DF5C000-memory.dmp

Filesize
9.9MB

Download
memory/4116-511-0x00007FFC1D570000-0x00007FFC1DF5C000-memory.dmp

Filesize
9.9MB

Download
memory/4420-459-0x00000000001F0000-0x00000000003EC000-memory.dmp

Filesize
2.0MB

Download
memory/4420-492-0x00000000001F0000-0x00000000003EC000-memory.dmp

Filesize
2.0MB

Download
memory/4420-508-0x00000000001F0000-0x00000000003EC000-memory.dmp

Filesize
2.0MB

Download
memory/4532-427-0x000002AB1E990000-0x000002AB1E992000-memory.dmp

Filesize
8KB

Download
memory/4532-413-0x000002AB1E6C0000-0x000002AB1E6C2000-memory.dmp

Filesize
8KB

Download
memory/4532-472-0x000002AB1F1F0000-0x000002AB1F1F2000-memory.dmp

Filesize
8KB

Download
memory/4532-276-0x000002AB1EB00000-0x000002AB1EC00000-memory.dmp

Filesize
1024KB

Download
memory/4532-467-0x000002AB1F1E0000-0x000002AB1F1E2000-memory.dmp

Filesize
8KB

Download
memory/4532-293-0x000002AB1E860000-0x000002AB1E880000-memory.dmp

Filesize
128KB

Download
memory/4532-227-0x000002AB1EC00000-0x000002AB1ED00000-memory.dmp

Filesize
1024KB

Download
memory/4532-463-0x000002AB1E9F0000-0x000002AB1E9F2000-memory.dmp

Filesize
8KB

Download
memory/4532-461-0x000002AB1E770000-0x000002AB1E772000-memory.dmp

Filesize
8KB

Download
memory/4532-457-0x000002AB1E750000-0x000002AB1E752000-memory.dmp

Filesize
8KB

Download
memory/4532-435-0x000002AB1E700000-0x000002AB1E702000-memory.dmp

Filesize
8KB

Download
memory/4532-235-0x000002AB1E860000-0x000002AB1E880000-memory.dmp

Filesize
128KB

Download
memory/4532-356-0x000002AB1F0E0000-0x000002AB1F1E0000-memory.dmp

Filesize
1024KB

Download
memory/4532-423-0x000002AB1E950000-0x000002AB1E952000-memory.dmp

Filesize
8KB

Download
memory/4532-417-0x000002AB1FCA0000-0x000002AB1FDA0000-memory.dmp

Filesize
1024KB

Download
memory/4532-479-0x000002AB20A00000-0x000002AB20B00000-memory.dmp

Filesize
1024KB

Download
memory/4552-622-0x000000000C580000-0x000000000C5E6000-memory.dmp

Filesize
408KB

Download
memory/4552-523-0x000000000BCA0000-0x000000000BCB0000-memory.dmp

Filesize
64KB

Download
memory/4552-517-0x0000000072BD0000-0x00000000732BE000-memory.dmp

Filesize
6.9MB

Download
memory/4552-512-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4552-625-0x0000000072BD0000-0x00000000732BE000-memory.dmp

Filesize
6.9MB

Download
memory/4552-633-0x000000000D4D0000-0x000000000D692000-memory.dmp

Filesize
1.8MB

Download
memory/4552-632-0x000000000BCA0000-0x000000000BCB0000-memory.dmp

Filesize
64KB

Download
memory/4552-634-0x000000000DBD0000-0x000000000E0FC000-memory.dmp

Filesize
5.2MB

Download
memory/4552-993-0x000000000D430000-0x000000000D480000-memory.dmp

Filesize
320KB

Download
memory/5480-599-0x0000000003470000-0x00000000035E1000-memory.dmp

Filesize
1.4MB

Download
memory/5480-600-0x00000000035F0000-0x0000000003721000-memory.dmp

Filesize
1.2MB

Download
memory/5480-553-0x00007FF6B7E70000-0x00007FF6B7EDA000-memory.dmp

Filesize
424KB

Download
memory/5480-1004-0x00000000035F0000-0x0000000003721000-memory.dmp

Filesize
1.2MB

Download