amadey | ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6

Analysis

max time kernel
154s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe
Size

1.5MB
MD5

5c530a69d2bcfde958435fc9ef8b4ff0
SHA1

c486fa5f42a25c1beaddf048c690f1ffc5671653
SHA256

ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6
SHA512

0e20cfdbabf57ebb87066341a5aa3fa1f766b2364d76f25954d26ddaa8ffd0403e24671fd37c1ecb250ba47ca90f4074060aff94ec877d25159bd9718f0b74ed
SSDEEP

24576:4yLINsILDD5DYF+MmEr1CE7jYRiwWeuG2OZI7+OI8d9WvgocVE38l3DpGapDqxJS:/sHLDFA+ZErkijsYeK+/q9CtcVFT/Zqc

Score

10^/10

amadey dcrat healer redline sectoprat smokeloader @ytlogsbot breha kukish pixelscloud backdoor dropper evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

pixelscloud

85.209.176.171:80

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Extracted

Family

redline

Botnet

@ytlogsbot

185.216.70.238:37515

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023262-106.dat	healer
behavioral1/memory/1812-108-0x0000000000CA0000-0x0000000000CAA000-memory.dmp	healer
behavioral1/files/0x0007000000023262-107.dat	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 9 IoCs

resource	yara_rule
behavioral1/memory/4192-53-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/6212-346-0x00000000006D0000-0x000000000072A000-memory.dmp	family_redline
behavioral1/memory/6508-318-0x00000000004D0000-0x00000000004EE000-memory.dmp	family_redline
behavioral1/memory/2224-444-0x0000000000420000-0x000000000047A000-memory.dmp	family_redline
behavioral1/memory/6532-458-0x0000000002090000-0x00000000020EA000-memory.dmp	family_redline
behavioral1/memory/7068-485-0x0000000000840000-0x0000000000998000-memory.dmp	family_redline
behavioral1/memory/856-522-0x0000000000580000-0x00000000005BE000-memory.dmp	family_redline
behavioral1/memory/5312-541-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/7068-559-0x0000000000840000-0x0000000000998000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/6508-318-0x00000000004D0000-0x00000000004EE000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	5tf4zf1.exe

Executes dropped EXE 19 IoCs

pid	Process
4144	DC6Xb46.exe
3408	jU5su03.exe
416	Cp9qT02.exe
4152	1Nr58WN5.exe
456	2iH7830.exe
1608	3hm89kI.exe
1020	4Rc550jM.exe
3364	5tf4zf1.exe
3468	A2E2.exe
4456	B5B0.exe
1580	Se1bB7fd.exe
3664	DD2F.exe
1812	52A.exe
2644	EK3jJ1jf.exe
4248	CompPkgSrv.exe
2620	bt0zI9qS.exe
3216	oG0Ng2Po.exe
4244	1kM88QF8.exe
3712	explothe.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	EK3jJ1jf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	jU5su03.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Cp9qT02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Se1bB7fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	bt0zI9qS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\""	oG0Ng2Po.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	DC6Xb46.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	A2E2.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4152 set thread context of 3808	4152	1Nr58WN5.exe	90
PID 456 set thread context of 4428	456	2iH7830.exe	102
PID 1608 set thread context of 3028	1608	3hm89kI.exe	110
PID 1020 set thread context of 4192	1020	4Rc550jM.exe	120
PID 4456 set thread context of 2380	4456	B5B0.exe	133
PID 3664 set thread context of 1596	3664	DD2F.exe	157

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
3756	4152	WerFault.exe	89
3388	456	WerFault.exe	97
3876	4428	WerFault.exe	102
4524	1608	WerFault.exe	107
1456	1020	WerFault.exe	113
3912	4456	WerFault.exe	128
4928	3664	WerFault.exe	137
3244	4244	WerFault.exe	151
6988	6372	WerFault.exe	193

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3808	AppLaunch.exe
3808	AppLaunch.exe
3028	AppLaunch.exe
3028	AppLaunch.exe
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found
3164	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3164	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3028	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	AppLaunch.exe
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found
Token: SeShutdownPrivilege	3164	Process not Found
Token: SeCreatePagefilePrivilege	3164	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4144	3644	ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe	86
PID 3644 wrote to memory of 4144	3644	ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe	86
PID 3644 wrote to memory of 4144	3644	ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe	86
PID 4144 wrote to memory of 3408	4144	DC6Xb46.exe	87
PID 4144 wrote to memory of 3408	4144	DC6Xb46.exe	87
PID 4144 wrote to memory of 3408	4144	DC6Xb46.exe	87
PID 3408 wrote to memory of 416	3408	jU5su03.exe	88
PID 3408 wrote to memory of 416	3408	jU5su03.exe	88
PID 3408 wrote to memory of 416	3408	jU5su03.exe	88
PID 416 wrote to memory of 4152	416	Cp9qT02.exe	89
PID 416 wrote to memory of 4152	416	Cp9qT02.exe	89
PID 416 wrote to memory of 4152	416	Cp9qT02.exe	89
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 4152 wrote to memory of 3808	4152	1Nr58WN5.exe	90
PID 416 wrote to memory of 456	416	Cp9qT02.exe	97
PID 416 wrote to memory of 456	416	Cp9qT02.exe	97
PID 416 wrote to memory of 456	416	Cp9qT02.exe	97
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 456 wrote to memory of 4428	456	2iH7830.exe	102
PID 3408 wrote to memory of 1608	3408	jU5su03.exe	107
PID 3408 wrote to memory of 1608	3408	jU5su03.exe	107
PID 3408 wrote to memory of 1608	3408	jU5su03.exe	107
PID 1608 wrote to memory of 3028	1608	3hm89kI.exe	110
PID 1608 wrote to memory of 3028	1608	3hm89kI.exe	110
PID 1608 wrote to memory of 3028	1608	3hm89kI.exe	110
PID 1608 wrote to memory of 3028	1608	3hm89kI.exe	110
PID 1608 wrote to memory of 3028	1608	3hm89kI.exe	110
PID 1608 wrote to memory of 3028	1608	3hm89kI.exe	110
PID 4144 wrote to memory of 1020	4144	DC6Xb46.exe	113
PID 4144 wrote to memory of 1020	4144	DC6Xb46.exe	113
PID 4144 wrote to memory of 1020	4144	DC6Xb46.exe	113
PID 1020 wrote to memory of 2644	1020	4Rc550jM.exe	119
PID 1020 wrote to memory of 2644	1020	4Rc550jM.exe	119
PID 1020 wrote to memory of 2644	1020	4Rc550jM.exe	119
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 1020 wrote to memory of 4192	1020	4Rc550jM.exe	120
PID 3644 wrote to memory of 3364	3644	ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe	123
PID 3644 wrote to memory of 3364	3644	ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe	123
PID 3644 wrote to memory of 3364	3644	ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe	123
PID 3364 wrote to memory of 4928	3364	5tf4zf1.exe	124
PID 3364 wrote to memory of 4928	3364	5tf4zf1.exe	124
PID 3164 wrote to memory of 3468	3164	Process not Found	127
PID 3164 wrote to memory of 3468	3164	Process not Found	127
PID 3164 wrote to memory of 3468	3164	Process not Found	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe
"C:\Users\Admin\AppData\Local\Temp\ff344f4bbd49a783ee20ded81492c1f8d2fe4a8d7ada866ccaf707c3663dd8b6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DC6Xb46.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DC6Xb46.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jU5su03.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jU5su03.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Cp9qT02.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Cp9qT02.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:416
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nr58WN5.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nr58WN5.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4152
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 592
        6⤵
        Program crash
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2iH7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2iH7830.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:456
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 540
        7⤵
        Program crash
        
        PID:3876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 148
        6⤵
        Program crash
        
        PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3hm89kI.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3hm89kI.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Checks SCSI registry key(s)
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        
        PID:3028
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 148
        5⤵
        Program crash
        
        PID:4524
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Rc550jM.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Rc550jM.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2644
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 572
      4⤵
      Program crash
      PID:1456
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5tf4zf1.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5tf4zf1.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\625F.tmp\6260.tmp\6261.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5tf4zf1.exe"
    3⤵
    PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x80,0x170,0x7ffffed946f8,0x7ffffed94708,0x7ffffed94718
        5⤵
        
        PID:1456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,7776741190349212577,8597122059402731468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        
        PID:5492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,7776741190349212577,8597122059402731468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
        5⤵
        
        PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
      4⤵
      PID:3384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x108,0x16c,0x7ffffed946f8,0x7ffffed94708,0x7ffffed94718
        5⤵
        
        PID:4492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15376769379999587853,5234563025630075248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15376769379999587853,5234563025630075248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        5⤵
        
        PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4152 -ip 4152
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 456 -ip 456
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4428 -ip 4428
1⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1608 -ip 1608
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1020 -ip 1020
1⤵
PID:2900

C:\Users\Admin\AppData\Local\Temp\A2E2.exe
C:\Users\Admin\AppData\Local\Temp\A2E2.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3468
- C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Se1bB7fd.exe
  C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Se1bB7fd.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1580
- - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\EK3jJ1jf.exe
    C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\EK3jJ1jf.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bt0zI9qS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bt0zI9qS.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:2620

C:\Users\Admin\AppData\Local\Temp\B5B0.exe
C:\Users\Admin\AppData\Local\Temp\B5B0.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 136
  2⤵
  - Program crash
  PID:3912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C725.bat" "
1⤵
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffffed946f8,0x7ffffed94708,0x7ffffed94718
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,9345515421820769587,8818468414009086003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9345515421820769587,8818468414009086003,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffffed946f8,0x7ffffed94708,0x7ffffed94718
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 /prefetch:2
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
    3⤵
    PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:1
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2808 /prefetch:3
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
    3⤵
    PID:2744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:6200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:6796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
    3⤵
    PID:7052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
    3⤵
    PID:7036
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
    3⤵
    PID:5488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,8155336408986077218,13269628392705047572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7024 /prefetch:8
    3⤵
    PID:6664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4456 -ip 4456
1⤵
PID:4244

C:\Users\Admin\AppData\Local\Temp\DD2F.exe
C:\Users\Admin\AppData\Local\Temp\DD2F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 236
  2⤵
  - Program crash
  PID:4928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1596

C:\Users\Admin\AppData\Local\Temp\52A.exe
C:\Users\Admin\AppData\Local\Temp\52A.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Users\Admin\AppData\Local\Temp\179A.exe
C:\Users\Admin\AppData\Local\Temp\179A.exe
1⤵
PID:4248
- C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
  "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
  2⤵
  - Executes dropped EXE
  PID:3712
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
    3⤵
    PID:5136
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:6840
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:N"
      4⤵
      PID:7144
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "explothe.exe" /P "Admin:R" /E
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:6380
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:N"
      4⤵
      PID:5316
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\fefffe8cea" /P "Admin:R" /E
      4⤵
      PID:4324

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\oG0Ng2Po.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\oG0Ng2Po.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3216
- C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1kM88QF8.exe
  C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1kM88QF8.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:6372
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 540
      4⤵
      Program crash
      PID:6988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 136
    3⤵
    - Program crash
    PID:3244
- C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\2fe708zw.exe
  C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\2fe708zw.exe
  2⤵
  PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3664 -ip 3664
1⤵
PID:4148

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
1⤵
- Creates scheduled task(s)
PID:1480

C:\Users\Admin\AppData\Local\Temp\3044.exe
C:\Users\Admin\AppData\Local\Temp\3044.exe
1⤵
PID:5216
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  PID:6428
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:6596
- C:\Users\Admin\AppData\Local\Temp\kos1.exe
  "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
  2⤵
  PID:6696
- - C:\Users\Admin\AppData\Local\Temp\set16.exe
    "C:\Users\Admin\AppData\Local\Temp\set16.exe"
    3⤵
    PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\is-0M4MC.tmp\is-L2AS0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-0M4MC.tmp\is-L2AS0.tmp" /SL4 $80216 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
      4⤵
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\kos.exe
    "C:\Users\Admin\AppData\Local\Temp\kos.exe"
    3⤵
    PID:6740
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  PID:6920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
- Executes dropped EXE
PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Users\Admin\AppData\Local\Temp\3EAC.exe
C:\Users\Admin\AppData\Local\Temp\3EAC.exe
1⤵
PID:6212

C:\Users\Admin\AppData\Local\Temp\42A5.exe
C:\Users\Admin\AppData\Local\Temp\42A5.exe
1⤵
PID:6508

C:\Users\Admin\AppData\Local\Temp\5851.exe
C:\Users\Admin\AppData\Local\Temp\5851.exe
1⤵
PID:7068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4244 -ip 4244
1⤵
PID:5496

C:\Users\Admin\AppData\Local\Temp\6448.exe
C:\Users\Admin\AppData\Local\Temp\6448.exe
1⤵
PID:6532

C:\Users\Admin\AppData\Local\Temp\6A93.exe
C:\Users\Admin\AppData\Local\Temp\6A93.exe
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 6372 -ip 6372
1⤵
PID:5612

C:\Users\Admin\AppData\Local\Temp\73EA.exe
C:\Users\Admin\AppData\Local\Temp\73EA.exe
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6532 -ip 6532
1⤵
PID:6952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0987267c265b2de204ac19d29250d6cd

SHA1
247b7b1e917d9ad2aa903a497758ae75ae145692

SHA256
474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264

SHA512
3b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0987267c265b2de204ac19d29250d6cd

SHA1
247b7b1e917d9ad2aa903a497758ae75ae145692

SHA256
474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264

SHA512
3b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0987267c265b2de204ac19d29250d6cd

SHA1
247b7b1e917d9ad2aa903a497758ae75ae145692

SHA256
474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264

SHA512
3b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f95638730ec51abd55794c140ca826c9

SHA1
77c415e2599fbdfe16530c2ab533fd6b193e82ef

SHA256
106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3

SHA512
0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f25b0d1-8f58-498c-b415-2ed5d21c89e8.tmp

Filesize
5KB

MD5
da93c496127c174e5b60c8b61d5bee56

SHA1
e8f337ab207d1b6e68141ac2d2adb8878952de2c

SHA256
2cfcd8e2d98d755ae081022e2c2869454894cee64786da93854751886a496a39

SHA512
07e9c0f1092d5ff8399e4230cace426573dbcb36d8e55630c6840187524298885cacf247719baea847626eca54be82a798da87150abb1db89c9f9f120aca71aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b04a4b0f4c1bc3e81ca7e20b4e14b9a

SHA1
ba92cd6fb485ab7aa2f77c4cbb6156ba019ccb64

SHA256
7289659f002463ec6addcdd740cc7f5d58ebea4dfd10dfb5289d4c3bd2a32e13

SHA512
3eefd5927ebc9389b4b065d2270e93d36e498dd5176307795e6b579c45852cccb521f6e39a928c980772681fd4f1cdb1787d7d213e3aa1d7b03dd2fc5446945e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4d9a283de6f6c835c2652e7165d51fc

SHA1
7ad8b7754ea9c10f0a61c4e3c6904a03e7f5d8f3

SHA256
009dbc710cdc92fa1d1e18cfa6f7af02ddf9fa7ffb31a0ad5fa55e69ffddb698

SHA512
d783781c82fbfebfbe1596c71eeb71060d976eab44295c610a91c777f88dbd215ceef00869c0274835353ddaafd4c1a97aa75ce3b39261e5c11f97f938b9b84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
4a078fb8a7c67594a6c2aa724e2ac684

SHA1
92bc5b49985c8588c60f6f85c50a516fae0332f4

SHA256
c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee

SHA512
188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
b184df7bde5fcaa9023d3668f107fb3f

SHA1
7c7f438b9cc10aa500e2bf924a2d86bf5fb6a00c

SHA256
e5f332db9ffefbe41aeee26cc2de946aaadd459895a2362879ce0d55cd36920a

SHA512
e13e1306d4c7dcf4027089ac92aa6d8109c49dd8ed7f62c89b3de640f02f701816b46caeefaa4f45ea934fd4d58c2c599a786bc95914df9cc788949029b03b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59a1c4.TMP

Filesize
872B

MD5
1f656cbad7f2e83cb0816fdc2ef08aea

SHA1
d70938fb1987537d542f4a9a794216ee4b86f3a7

SHA256
0cdd5277c0b0fd097482c51f55f8332b130351370ce25031fc78b48a2124c6d3

SHA512
0dd62b8a47aaa5e2c4e9c0a27cbdd451596beb7ba977164148d346bd1c1e181f7c0e3c1ac78a798e5e12695dad2acaa891510da064ec8b4644e5a7122d1352b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a8be91d1e59471df64a8a739a1a7a07

SHA1
f65235e04302a86e65e2b8b2cceda312940549ae

SHA256
dd402fcd2290c5408f780245128c45ceae619facc4498339b1d526dad8f7906e

SHA512
09e1fce7654c2b9fc3cd968ba5d752bac00541948836a061f0aee27caabea9e1d0a0b4c72d1371d43a95b08f9d05280637862b0e0610469bee58cd17962b8f01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
60a49699568deb4a77953a8cab22b460

SHA1
8cf55380319d9cc5e5fb4e616f2b3dc9a12e1c8f

SHA256
f08147f48cde658d2d4fb39ad73eb938a8543e43a678201048c298a787f02d80

SHA512
77a0099778b1e041b0473fb332e9b54ba797d83a072be4834d36959b192fdaf31ce6724cba05ebb906d9345e2bf9d2c19451b545ab768c856118fb7a2699c1e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
974b702e4428f26c5c56acde36e3fdbc

SHA1
10dadaf016231583f4abddae70686debad05aa58

SHA256
2474462b5e342cfe791bd19810dd86e6730a6055d07c99343d2001542f72dfc0

SHA512
f934a2de3f76bf6fc0c11442c145f9dec6e22a7e245d4447bd8ab6db6b674eee28a4bc5e10897a2b3ac0e5d8ec3f893708b5a7c3195749f880b14395c66f47c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
28f4463f1bbe6afce46a213a17af21af

SHA1
97a7c9b54a9272b8a96e7ef9cf73525aa2b8a9e2

SHA256
129e7555297b6934768f4b63a0505afbb6a52039e4d8f1ea4f6cb85d9774265e

SHA512
c566b1dfac0e633f0963009e871e90199e128df82ec4201efface2b41c7f8b58cfe7f64bd0f6b3ea64f0410e0dfd23198150fa97c08de7e85ffff10f105502cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
a5b0140cbaa7c040a0345f202c7bc30e

SHA1
c65b55c43ff298a5af84b0de9344651d5ac6e841

SHA256
c45c5ec840d2e9a16dfa7b41cc10efdb96b832530865ceb883a5cd7aefa8359d

SHA512
9be5a1946daea4f835b9c21fc3499dfec821420e07f84ee234f89daec9ce8825b61e0eec1976d61006411c01257aceb2478e045ae4336d123cdfddc52a15f7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
a5b0140cbaa7c040a0345f202c7bc30e

SHA1
c65b55c43ff298a5af84b0de9344651d5ac6e841

SHA256
c45c5ec840d2e9a16dfa7b41cc10efdb96b832530865ceb883a5cd7aefa8359d

SHA512
9be5a1946daea4f835b9c21fc3499dfec821420e07f84ee234f89daec9ce8825b61e0eec1976d61006411c01257aceb2478e045ae4336d123cdfddc52a15f7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
57e03395c5fac26bc90475352c345927

SHA1
5da24bfa143a1ba4b890d9569d9fac9a66e85839

SHA256
176cff5592e3951b919ae4568bbb114a90c9a62cfd46361fb2137e2235b06a02

SHA512
6388a6bc9e4125a5b432272894eb17e3b08bdb2e8501402403b4e0f58412319d8d8e3e3f2478b6b7c6610eae05b39bb19f2c0c2afbd1b155c31269100a6abc7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
57e03395c5fac26bc90475352c345927

SHA1
5da24bfa143a1ba4b890d9569d9fac9a66e85839

SHA256
176cff5592e3951b919ae4568bbb114a90c9a62cfd46361fb2137e2235b06a02

SHA512
6388a6bc9e4125a5b432272894eb17e3b08bdb2e8501402403b4e0f58412319d8d8e3e3f2478b6b7c6610eae05b39bb19f2c0c2afbd1b155c31269100a6abc7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\179A.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\179A.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\3044.exe

Filesize
11.4MB

MD5
ba6037d5a28efd179ec2baee494d8910

SHA1
f34fe42c9814756ebe0c6eb9331361538b72196d

SHA256
ddc3ba21d70f788998930254d4a47ee0ce69f494b6f96d804ed55de8123e4bba

SHA512
d7e74df178ce2d57416111f6b14f5ecc5b02015e075c274ab3181a3bc20f56a3cbf14b941ad200467f4802cabbe275cec0f2ff1ff6bea486a4221dd2be1014ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\3044.exe

Filesize
11.4MB

MD5
ba6037d5a28efd179ec2baee494d8910

SHA1
f34fe42c9814756ebe0c6eb9331361538b72196d

SHA256
ddc3ba21d70f788998930254d4a47ee0ce69f494b6f96d804ed55de8123e4bba

SHA512
d7e74df178ce2d57416111f6b14f5ecc5b02015e075c274ab3181a3bc20f56a3cbf14b941ad200467f4802cabbe275cec0f2ff1ff6bea486a4221dd2be1014ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
918a8d3d6e2cfd655a8245a3efd41d8c

SHA1
9918bf34f0995e19f116e5927917f0f758191a41

SHA256
981c16d9dfbd8547e98b48d6d65f067929f8d659996ccec3365a65062034a3be

SHA512
9c14e3153fe6928bbdd1bbd5dd864bfdf5ff0413accfcb6422785b85e32f21e43a8fd4e162283c618c2a2322f83d0d29488c7a88e02ef5ddafc73d3a75d8b643

Download Submit
C:\Users\Admin\AppData\Local\Temp\52A.exe

Filesize
21KB

MD5
57543bf9a439bf01773d3d508a221fda

SHA1
5728a0b9f1856aa5183d15ba00774428be720c35

SHA256
70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e

SHA512
28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

Download Submit
C:\Users\Admin\AppData\Local\Temp\52A.exe

Filesize
21KB

MD5
57543bf9a439bf01773d3d508a221fda

SHA1
5728a0b9f1856aa5183d15ba00774428be720c35

SHA256
70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e

SHA512
28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

Download Submit
C:\Users\Admin\AppData\Local\Temp\625F.tmp\6260.tmp\6261.bat

Filesize
88B

MD5
0ec04fde104330459c151848382806e8

SHA1
3b0b78d467f2db035a03e378f7b3a3823fa3d156

SHA256
1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f

SHA512
8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\A2E2.exe

Filesize
1.5MB

MD5
5be8e0be864b1596f0785325d16162b6

SHA1
dd090489d45a2621c033f48a174182956f5e1dde

SHA256
dc0e09ebf141b8463dafb0d203de13142b48c548c67d080b652d975058f0e6b3

SHA512
0172738de9bab1d4bbe8ed3c398b73de66404f3aadd58e12724d63b44d59eed4f558284f71f3215f83c19f987c9e195acfe0a0f5fe0827bc05283a16adccffb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\A2E2.exe

Filesize
1.5MB

MD5
5be8e0be864b1596f0785325d16162b6

SHA1
dd090489d45a2621c033f48a174182956f5e1dde

SHA256
dc0e09ebf141b8463dafb0d203de13142b48c548c67d080b652d975058f0e6b3

SHA512
0172738de9bab1d4bbe8ed3c398b73de66404f3aadd58e12724d63b44d59eed4f558284f71f3215f83c19f987c9e195acfe0a0f5fe0827bc05283a16adccffb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5B0.exe

Filesize
1.1MB

MD5
75dcafe21382b6abec2fdd51d3893d78

SHA1
41c9b42f664c248243b7f20bc2b86a93c23bebeb

SHA256
49e0d6647b9fbf2e9c6926734504e3e2a5f8c0cd5ddda1470aa63c0496d26b90

SHA512
34c5c792229d51c75928197f346b1192dd3c8a81580acbd457dceb4f34b70ed2c2f4501682ab94bd5b1c10270e08b47698bdf6f9d52972daa11641d167adf4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5B0.exe

Filesize
1.1MB

MD5
75dcafe21382b6abec2fdd51d3893d78

SHA1
41c9b42f664c248243b7f20bc2b86a93c23bebeb

SHA256
49e0d6647b9fbf2e9c6926734504e3e2a5f8c0cd5ddda1470aa63c0496d26b90

SHA512
34c5c792229d51c75928197f346b1192dd3c8a81580acbd457dceb4f34b70ed2c2f4501682ab94bd5b1c10270e08b47698bdf6f9d52972daa11641d167adf4fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\C725.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\DD2F.exe

Filesize
1.2MB

MD5
0235c707f333e8b0c693e1915ebb3fc3

SHA1
47e304cbe75b8f64d1d3fb0c3f72e49847b27fc4

SHA256
977e0625408ec0bd175e25c8b012fe071fbafbd83fd8cb34e0c163bd636d16d5

SHA512
e25fea0463f4eee13d899b120cadb2a323ac2ca6250e37fd78f8b1220de4d63077f75aa3ae35f29125f61cf6c5c35be4bef2bf866c2b6267a29935c650e86ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\DD2F.exe

Filesize
1.2MB

MD5
0235c707f333e8b0c693e1915ebb3fc3

SHA1
47e304cbe75b8f64d1d3fb0c3f72e49847b27fc4

SHA256
977e0625408ec0bd175e25c8b012fe071fbafbd83fd8cb34e0c163bd636d16d5

SHA512
e25fea0463f4eee13d899b120cadb2a323ac2ca6250e37fd78f8b1220de4d63077f75aa3ae35f29125f61cf6c5c35be4bef2bf866c2b6267a29935c650e86ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5tf4zf1.exe

Filesize
98KB

MD5
e96f910c1bea3affef5339567e17d8c4

SHA1
667d5699cb0451872db83682f9774006bf4244af

SHA256
58f09013a05e452b7b8b1c1d640ed118c76d1cfabbadd63b70f5ee4da288583b

SHA512
f36157af58acda71ce95ae2434cc6aaa10e7f1acdc9c32591bd3a8d81a30e4726590ce6337cf3077c251c8da86764ae0fd661b73d12402a63dedf7d6702a34e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5tf4zf1.exe

Filesize
98KB

MD5
e96f910c1bea3affef5339567e17d8c4

SHA1
667d5699cb0451872db83682f9774006bf4244af

SHA256
58f09013a05e452b7b8b1c1d640ed118c76d1cfabbadd63b70f5ee4da288583b

SHA512
f36157af58acda71ce95ae2434cc6aaa10e7f1acdc9c32591bd3a8d81a30e4726590ce6337cf3077c251c8da86764ae0fd661b73d12402a63dedf7d6702a34e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DC6Xb46.exe

Filesize
1.3MB

MD5
b0c5d7c929aed8e2fb48ff34bb8d8782

SHA1
01ddca164f5ef39f4429535df401e2df056ecb53

SHA256
404227fa172af4f17e13a28e2240eb26b19e4cb9ec9d95f65db3c65bd6c73a6e

SHA512
9c49a68006ccf208a493257387be425b4e2da84965033cc4430bce62c157e247e39618b8eb86e76eaadff173fa40361c5bf2e6f7a08aa41223ea457c8516b912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DC6Xb46.exe

Filesize
1.3MB

MD5
b0c5d7c929aed8e2fb48ff34bb8d8782

SHA1
01ddca164f5ef39f4429535df401e2df056ecb53

SHA256
404227fa172af4f17e13a28e2240eb26b19e4cb9ec9d95f65db3c65bd6c73a6e

SHA512
9c49a68006ccf208a493257387be425b4e2da84965033cc4430bce62c157e247e39618b8eb86e76eaadff173fa40361c5bf2e6f7a08aa41223ea457c8516b912

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Rc550jM.exe

Filesize
1.2MB

MD5
c6df776b0c74140d11d998a118c78a36

SHA1
973d86b7046c608fdf08c3793088c04d05f6119a

SHA256
f62e38e46e0727c01af04fffb9f840ac8cb3e021a28aa16406f5911fc59ec875

SHA512
0c9a7585d73c15f30584ac38971638878fb6ab3d6a182deb11a3515699bd4c969b326ed06e1ea0cf4692f3703289c00ad732963031cda34b9dfe3d05fa2cb3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Rc550jM.exe

Filesize
1.2MB

MD5
c6df776b0c74140d11d998a118c78a36

SHA1
973d86b7046c608fdf08c3793088c04d05f6119a

SHA256
f62e38e46e0727c01af04fffb9f840ac8cb3e021a28aa16406f5911fc59ec875

SHA512
0c9a7585d73c15f30584ac38971638878fb6ab3d6a182deb11a3515699bd4c969b326ed06e1ea0cf4692f3703289c00ad732963031cda34b9dfe3d05fa2cb3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jU5su03.exe

Filesize
932KB

MD5
c61a6920daec1b726eef0abe11683ccd

SHA1
f5f99d212b8deb54c1c580e6d66481859ca4af65

SHA256
7c770fbdd07e5c08cddbe9a2495184bd9fd3a5ddec0b2d14fc33743f43c702ae

SHA512
8479618501eb4617606be6c90f70c39a90638faa8ea57e76c579d7c5908d028663c5fcd41fe35dc7f1e780d24f4d6f84c6ee55e5c647075a2a51346182e30238

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jU5su03.exe

Filesize
932KB

MD5
c61a6920daec1b726eef0abe11683ccd

SHA1
f5f99d212b8deb54c1c580e6d66481859ca4af65

SHA256
7c770fbdd07e5c08cddbe9a2495184bd9fd3a5ddec0b2d14fc33743f43c702ae

SHA512
8479618501eb4617606be6c90f70c39a90638faa8ea57e76c579d7c5908d028663c5fcd41fe35dc7f1e780d24f4d6f84c6ee55e5c647075a2a51346182e30238

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3hm89kI.exe

Filesize
965KB

MD5
298cb2cb465086bf5d2d2a02ca36acb3

SHA1
56dd26a82e3d73d668dc0b2efeecab2b0b4d0cf1

SHA256
992cf6ea5fa876979775fa493dbaf4cd4bfc92ff31c2c910b881cb3222e82041

SHA512
541d9ab06d53b54f74e172bc938d7c24b253f4ed0172a1a6498218a4dd7ac7ec28eb72fa6989cd35428cb45c905b5507b137f948d32e114b8192f0545331343e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3hm89kI.exe

Filesize
965KB

MD5
298cb2cb465086bf5d2d2a02ca36acb3

SHA1
56dd26a82e3d73d668dc0b2efeecab2b0b4d0cf1

SHA256
992cf6ea5fa876979775fa493dbaf4cd4bfc92ff31c2c910b881cb3222e82041

SHA512
541d9ab06d53b54f74e172bc938d7c24b253f4ed0172a1a6498218a4dd7ac7ec28eb72fa6989cd35428cb45c905b5507b137f948d32e114b8192f0545331343e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\6IY94Vf.exe

Filesize
98KB

MD5
540f862ffdaaf2f26ced5f553c59b8e9

SHA1
94543956672331fd8068a362ad7f191bb9bba127

SHA256
a6eaad6a65f3619473885aa752fc3ca42b5104e0704742c3ade9e31b4c6fb9df

SHA512
d9c22dfc7d8a17b354225f8477a7aa9568f7ce2616c8286470255084b312f9ca2dbc26dcd5b3edc0d2a2c13a8cf8c37f4203cb6e7d17b227b9d0c7f9bea84bde

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Cp9qT02.exe

Filesize
549KB

MD5
621398e405bf667249d3b4fee44d309a

SHA1
981a91f88a9808096d4d363b86a9d116f597397f

SHA256
735eeb6bc81797d69fd4ddadc4ab859c1c77dba1b05fb7207d9f4018d111708c

SHA512
1fd54be69e766aac7de681b3d67b45383793d9d3e560706936ac1c1b407fe40f4f809758af113cec9d4e2bc0b9359ca514e438c4375ee54662641a21302e13c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Cp9qT02.exe

Filesize
549KB

MD5
621398e405bf667249d3b4fee44d309a

SHA1
981a91f88a9808096d4d363b86a9d116f597397f

SHA256
735eeb6bc81797d69fd4ddadc4ab859c1c77dba1b05fb7207d9f4018d111708c

SHA512
1fd54be69e766aac7de681b3d67b45383793d9d3e560706936ac1c1b407fe40f4f809758af113cec9d4e2bc0b9359ca514e438c4375ee54662641a21302e13c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Se1bB7fd.exe

Filesize
1.4MB

MD5
b08bc40cb0672b3925a41cc1add3ca0f

SHA1
ca26389af7b04ed8a0df0d340ef4204a6cea1595

SHA256
a92a37f24a016d43e701dd6ef13bafbaf95ed1b671712e5606aa1929b10232c2

SHA512
e0b5915962e9a760ebd37802982ee16c1556e182e22dae01ab73529a202807ae1d5be9523807ace72126e9af85220e7f970cb8af77b0800448533b447ff59234

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Se1bB7fd.exe

Filesize
1.4MB

MD5
b08bc40cb0672b3925a41cc1add3ca0f

SHA1
ca26389af7b04ed8a0df0d340ef4204a6cea1595

SHA256
a92a37f24a016d43e701dd6ef13bafbaf95ed1b671712e5606aa1929b10232c2

SHA512
e0b5915962e9a760ebd37802982ee16c1556e182e22dae01ab73529a202807ae1d5be9523807ace72126e9af85220e7f970cb8af77b0800448533b447ff59234

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nr58WN5.exe

Filesize
232KB

MD5
3ff825411b1fe07e712a5dcae34f80eb

SHA1
e3e4358cabfa74d6e36e26754b01ed78434a6877

SHA256
69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

SHA512
325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nr58WN5.exe

Filesize
232KB

MD5
3ff825411b1fe07e712a5dcae34f80eb

SHA1
e3e4358cabfa74d6e36e26754b01ed78434a6877

SHA256
69bba958a5dcd8650921b25d978c4847819eb83adc143ba2bd396811d7d73739

SHA512
325c098b5a0a0ffee16a6074616126f9f4c7930b74507d38c63a294f659ab26fe1674af85a8ff495bd268aa821cc9d85f80f11ab1e7f828015920220e456ab81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2iH7830.exe

Filesize
1.1MB

MD5
6a54bd86f18fd28cc567adda1c17fad4

SHA1
bb27c52a73fb23a150ae5a42d6a94d159a974aac

SHA256
44f7b15be87703f2462f2b5dc0cb0bf6f7a3bb0b9c40756eeab554e0da0f0873

SHA512
05be3ccb7863086746641229d0cfa9ba3bc3541813f577daa07692b2546b4b8bdbefe693c1b71bf0c627e306545f482853dfd3380372a2c9b8d965ce8c675e73

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2iH7830.exe

Filesize
1.1MB

MD5
6a54bd86f18fd28cc567adda1c17fad4

SHA1
bb27c52a73fb23a150ae5a42d6a94d159a974aac

SHA256
44f7b15be87703f2462f2b5dc0cb0bf6f7a3bb0b9c40756eeab554e0da0f0873

SHA512
05be3ccb7863086746641229d0cfa9ba3bc3541813f577daa07692b2546b4b8bdbefe693c1b71bf0c627e306545f482853dfd3380372a2c9b8d965ce8c675e73

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\EK3jJ1jf.exe

Filesize
1.2MB

MD5
f261a839e28ce0e68ac3ea4682795317

SHA1
4a40e9f84ac96b4b6b2627ff61dd84b466284ee2

SHA256
8234850ab7345baffc81eec656a4bf228bc7bda1f7d861a8c114b70e5fad7f05

SHA512
c2bdbaec9403e58177b6ab77dfa18b82e3235f7328713fe3e0a3b0cf6001f94e8870e5f7fac430a9c5415a9f53bb3485e285bfda265f6383e20b30166cebd22e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\EK3jJ1jf.exe

Filesize
1.2MB

MD5
f261a839e28ce0e68ac3ea4682795317

SHA1
4a40e9f84ac96b4b6b2627ff61dd84b466284ee2

SHA256
8234850ab7345baffc81eec656a4bf228bc7bda1f7d861a8c114b70e5fad7f05

SHA512
c2bdbaec9403e58177b6ab77dfa18b82e3235f7328713fe3e0a3b0cf6001f94e8870e5f7fac430a9c5415a9f53bb3485e285bfda265f6383e20b30166cebd22e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\4Lc538oo.exe

Filesize
1.2MB

MD5
c6df776b0c74140d11d998a118c78a36

SHA1
973d86b7046c608fdf08c3793088c04d05f6119a

SHA256
f62e38e46e0727c01af04fffb9f840ac8cb3e021a28aa16406f5911fc59ec875

SHA512
0c9a7585d73c15f30584ac38971638878fb6ab3d6a182deb11a3515699bd4c969b326ed06e1ea0cf4692f3703289c00ad732963031cda34b9dfe3d05fa2cb3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bt0zI9qS.exe

Filesize
776KB

MD5
b37dde3e5abb43fa8aaea3f727518d9c

SHA1
c911f99f8bfcbde6e416551f5ac01b7439bb0cb6

SHA256
62d50ff255becbcf935cdecba1f44b54d2e12a505db12029fd054ccb58c59c4a

SHA512
a8da1551b05af3eed5315edd84cebee13a90ebf6d9807b7acf49e4263e03f1be30db692422bb1a172012779738ffb3fd1269675b3628f2a2ea460ed2ece1fee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\bt0zI9qS.exe

Filesize
776KB

MD5
b37dde3e5abb43fa8aaea3f727518d9c

SHA1
c911f99f8bfcbde6e416551f5ac01b7439bb0cb6

SHA256
62d50ff255becbcf935cdecba1f44b54d2e12a505db12029fd054ccb58c59c4a

SHA512
a8da1551b05af3eed5315edd84cebee13a90ebf6d9807b7acf49e4263e03f1be30db692422bb1a172012779738ffb3fd1269675b3628f2a2ea460ed2ece1fee0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\oG0Ng2Po.exe

Filesize
580KB

MD5
b760ad14002ece14158472a05d633277

SHA1
f9c99116e84223e82df607be90951ecb5787473d

SHA256
6b928410ca287c9e198a7bfe4c2300ba67aedcd908b1f1650cd18e81e1b41f69

SHA512
ec83274e44fb3ab54eedd39ef43d0d0c9897063811223592f385b934abad1f80ce53bd9ca381509f3898313535257c7d7ef19e1562be48cb813580d71efed881

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\oG0Ng2Po.exe

Filesize
580KB

MD5
b760ad14002ece14158472a05d633277

SHA1
f9c99116e84223e82df607be90951ecb5787473d

SHA256
6b928410ca287c9e198a7bfe4c2300ba67aedcd908b1f1650cd18e81e1b41f69

SHA512
ec83274e44fb3ab54eedd39ef43d0d0c9897063811223592f385b934abad1f80ce53bd9ca381509f3898313535257c7d7ef19e1562be48cb813580d71efed881

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1kM88QF8.exe

Filesize
1.1MB

MD5
8c55dadf793d28d56bdc7dedcaa6399b

SHA1
d9ed83703235e0bbda7700319a399ede65907691

SHA256
ebab1880154848f837b40eb9d61f89536391656755c5b7deb80e3532d7f89625

SHA512
90048bb39fc78763c2085fc1377d667afb9b1717ea34820952a0cd543c6967a66728cc64a4a83ce4548b8a2517e585b463ff1566b19cbd378692a5511bf98cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1kM88QF8.exe

Filesize
1.1MB

MD5
8c55dadf793d28d56bdc7dedcaa6399b

SHA1
d9ed83703235e0bbda7700319a399ede65907691

SHA256
ebab1880154848f837b40eb9d61f89536391656755c5b7deb80e3532d7f89625

SHA512
90048bb39fc78763c2085fc1377d667afb9b1717ea34820952a0cd543c6967a66728cc64a4a83ce4548b8a2517e585b463ff1566b19cbd378692a5511bf98cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
229KB

MD5
78e5bc5b95cf1717fc889f1871f5daf6

SHA1
65169a87dd4a0121cd84c9094d58686be468a74a

SHA256
7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966

SHA512
d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
213KB

MD5
92505d71d65f3fd132de5d032d371d63

SHA1
a381f472b41aab5f1241f58e522cfe73b36c7a67

SHA256
3adc2d21a85e8f73b72c75cf9450a7eb2fe843df24b827a9afe1201316d07944

SHA512
4dca261185cdaf561b42e7210e1b3dd7d2eb4832354cbadb6ebbb5da2f07fa3917ddbb1433d19c358587f63483d6e59a1891aa26fb5e33e3c04cd6a353de9cdc

Download Submit
memory/856-522-0x0000000000580000-0x00000000005BE000-memory.dmp

Filesize
248KB

Download
memory/1596-180-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/1596-177-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/1596-387-0x0000000007350000-0x0000000007360000-memory.dmp

Filesize
64KB

Download
memory/1596-327-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/1812-117-0x00007FFFFD980000-0x00007FFFFE441000-memory.dmp

Filesize
10.8MB

Download
memory/1812-283-0x00007FFFFD980000-0x00007FFFFE441000-memory.dmp

Filesize
10.8MB

Download
memory/1812-339-0x00007FFFFD980000-0x00007FFFFE441000-memory.dmp

Filesize
10.8MB

Download
memory/1812-108-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

Filesize
40KB

Download
memory/2224-429-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/2224-444-0x0000000000420000-0x000000000047A000-memory.dmp

Filesize
360KB

Download
memory/2224-452-0x0000000007500000-0x0000000007510000-memory.dmp

Filesize
64KB

Download
memory/2224-482-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/2380-92-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-91-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3028-52-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3028-43-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3028-42-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3164-49-0x00000000006D0000-0x00000000006E6000-memory.dmp

Filesize
88KB

Download
memory/3808-48-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download
memory/3808-28-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3808-29-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download
memory/3808-30-0x0000000074BB0000-0x0000000075360000-memory.dmp

Filesize
7.7MB

Download
memory/4192-113-0x00000000085D0000-0x000000000860C000-memory.dmp

Filesize
240KB

Download
memory/4192-133-0x0000000008750000-0x000000000879C000-memory.dmp

Filesize
304KB

Download
memory/4192-109-0x0000000008570000-0x0000000008582000-memory.dmp

Filesize
72KB

Download
memory/4192-69-0x0000000007A50000-0x0000000007A60000-memory.dmp

Filesize
64KB

Download
memory/4192-105-0x0000000008640000-0x000000000874A000-memory.dmp

Filesize
1.0MB

Download
memory/4192-53-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4192-64-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-55-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-63-0x0000000007C60000-0x0000000007C6A000-memory.dmp

Filesize
40KB

Download
memory/4192-62-0x0000000007A50000-0x0000000007A60000-memory.dmp

Filesize
64KB

Download
memory/4192-60-0x0000000007AA0000-0x0000000007B32000-memory.dmp

Filesize
584KB

Download
memory/4192-56-0x0000000007F60000-0x0000000008504000-memory.dmp

Filesize
5.6MB

Download
memory/4192-86-0x0000000008B30000-0x0000000009148000-memory.dmp

Filesize
6.1MB

Download
memory/4428-34-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-38-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-36-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-35-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5216-360-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/5216-246-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/5216-247-0x0000000000D40000-0x00000000018A4000-memory.dmp

Filesize
11.4MB

Download
memory/5312-541-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6212-346-0x00000000006D0000-0x000000000072A000-memory.dmp

Filesize
360KB

Download
memory/6212-540-0x0000000008240000-0x00000000082A6000-memory.dmp

Filesize
408KB

Download
memory/6212-430-0x0000000007660000-0x0000000007670000-memory.dmp

Filesize
64KB

Download
memory/6212-489-0x0000000007660000-0x0000000007670000-memory.dmp

Filesize
64KB

Download
memory/6212-391-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/6212-388-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/6212-480-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/6372-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6372-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6372-422-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6456-488-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/6456-432-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/6508-455-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/6508-461-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/6508-318-0x00000000004D0000-0x00000000004EE000-memory.dmp

Filesize
120KB

Download
memory/6508-338-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/6532-458-0x0000000002090000-0x00000000020EA000-memory.dmp

Filesize
360KB

Download
memory/6532-481-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/6532-459-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/6696-369-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/6696-454-0x00000000742F0000-0x0000000074AA0000-memory.dmp

Filesize
7.7MB

Download
memory/6696-321-0x00000000002A0000-0x0000000000414000-memory.dmp

Filesize
1.5MB

Download
memory/6740-449-0x00007FFFFDAA0000-0x00007FFFFE561000-memory.dmp

Filesize
10.8MB

Download
memory/6740-453-0x0000000002A20000-0x0000000002A30000-memory.dmp

Filesize
64KB

Download
memory/6740-448-0x0000000000920000-0x0000000000928000-memory.dmp

Filesize
32KB

Download
memory/6920-457-0x00007FF683D10000-0x00007FF6842B1000-memory.dmp

Filesize
5.6MB

Download
memory/6920-563-0x00007FF683D10000-0x00007FF6842B1000-memory.dmp

Filesize
5.6MB

Download
memory/7068-389-0x0000000000840000-0x0000000000998000-memory.dmp

Filesize
1.3MB

Download
memory/7068-485-0x0000000000840000-0x0000000000998000-memory.dmp

Filesize
1.3MB

Download
memory/7068-559-0x0000000000840000-0x0000000000998000-memory.dmp

Filesize
1.3MB

Download
memory/7068-472-0x0000000000840000-0x0000000000998000-memory.dmp

Filesize
1.3MB

Download