amadey | 434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0

Analysis

max time kernel
302s
max time network
305s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
01-11-2023 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe
Size

891KB
MD5

c7777a4ef12242c83ba24df7cf60ec56
SHA1

558422b9167d4a0c28a373e6050bd55b4bcb910f
SHA256

434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0
SHA512

f7549a22949684a76e1d9cfdd9774bb668fc34a05c9fa25a89f402f576225b73c7edad5aa067093c6136d3a0da04c6af5094d3c71a5f77f43aa05281412c1b1d
SSDEEP

12288:7q4PKC97rmNwdUUEE+qwUWlOlPmODW9KDFhXyzqu2yQyv0:/R5mNwdUUEE+BWlLC9KDF

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Extracted

Family

redline

Botnet

pixelnew

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5844-623-0x0000000000480000-0x0000000000860000-memory.dmp	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\6B12.exe	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\6B12.exe	family_zgrat_v1

Detected google phishing page
phishing google
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5568-689-0x0000000002F10000-0x00000000037FB000-memory.dmp	family_glupteba
behavioral2/memory/5568-784-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

CC1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	CC1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	CC1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	CC1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	CC1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	CC1.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 11 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\B58.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\B58.exe	family_redline
behavioral2/memory/3920-77-0x0000000000A00000-0x0000000000A3E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe	family_redline
behavioral2/memory/5024-121-0x0000000000180000-0x00000000001BE000-memory.dmp	family_redline
behavioral2/memory/3000-139-0x0000000000580000-0x00000000005DA000-memory.dmp	family_redline
behavioral2/memory/3000-301-0x0000000000400000-0x0000000000480000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\7536.exe	family_redline
behavioral2/memory/6424-799-0x00000000004C0000-0x00000000004DE000-memory.dmp	family_redline
behavioral2/memory/5248-948-0x0000000000400000-0x0000000000461000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7536.exe	family_sectoprat
behavioral2/memory/6424-799-0x00000000004C0000-0x00000000004DE000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

Processes:

latestX.exeupdater.exe

description	pid	process	target process
PID 5688 created 3308	5688	latestX.exe	Explorer.EXE
PID 5688 created 3308	5688	latestX.exe	Explorer.EXE
PID 5688 created 3308	5688	latestX.exe	Explorer.EXE
PID 5688 created 3308	5688	latestX.exe	Explorer.EXE
PID 5688 created 3308	5688	latestX.exe	Explorer.EXE
PID 6268 created 3308	6268	updater.exe	Explorer.EXE
PID 6268 created 3308	6268	updater.exe	Explorer.EXE
PID 6268 created 3308	6268	updater.exe	Explorer.EXE
PID 6268 created 3308	6268	updater.exe	Explorer.EXE
PID 6268 created 3308	6268	updater.exe	Explorer.EXE
PID 6268 created 3308	6268	updater.exe	Explorer.EXE

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

201 5916 rundll32.exe
204 4356 rundll32.exe
Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

latestX.exeupdater.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
File created C:\Windows\System32\drivers\etc\hosts updater.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

1160 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
201	5916	rundll32.exe
204	4356	rundll32.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

pid	process
1160	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmd.exe7295.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Control Panel\International\Geo\Nation	7295.exe

Executes dropped EXE 48 IoCs

Processes:

829.exe924.exeIN8gZ5gn.exexU8mT4YJ.exeFb6jM0Il.exenk2Rg5kr.exeB58.exe1dI10GX0.exeCC1.exeE0A.exe2iI657iQ.exeexplothe.exe184C.exe516E.exe55D4.exeInstallSetup5.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exekos4.exelatestX.exeLzmwAqmV.exe6B12.exeLzmwAqmV.tmp7295.exesc.exechcfrbrsc.exeTrustedInstaller.exetoolspub2.exeSRadioStation.exeMicrosoftEdgeCP.exe8EEA.exeUtsysc.exe31839b57a4f11171d6abc8bbc4451ee4.exesc.exeUtsysc.exeupdater.execsrss.exeinjector.exesc.exesc.exewindefender.exewindefender.exeexplothe.exeUtsysc.exef801950a962ddba14caaa44bf084b55c.exeexplothe.exeUtsysc.exe

pid	process
4136	829.exe
4568	924.exe
1004	IN8gZ5gn.exe
96	xU8mT4YJ.exe
5092	Fb6jM0Il.exe
3028	nk2Rg5kr.exe
3920	B58.exe
3528	1dI10GX0.exe
2208	CC1.exe
5068	E0A.exe
5024	2iI657iQ.exe
3464	explothe.exe
3000	184C.exe
5512	516E.exe
5648	55D4.exe
4920	InstallSetup5.exe
6008	toolspub2.exe
5568	31839b57a4f11171d6abc8bbc4451ee4.exe
5776	kos4.exe
5688	latestX.exe
5904	LzmwAqmV.exe
5844	6B12.exe
4796	LzmwAqmV.tmp
6172	7295.exe
5720	sc.exe
5840	chcfrbr
6552	sc.exe
6424	TrustedInstaller.exe
6712	toolspub2.exe
6872	SRadioStation.exe
5248	MicrosoftEdgeCP.exe
6944	8EEA.exe
7028	Utsysc.exe
6772	31839b57a4f11171d6abc8bbc4451ee4.exe
1592	sc.exe
2960	Utsysc.exe
6268	updater.exe
6056	csrss.exe
2756	injector.exe
6464	sc.exe
1360	sc.exe
1852	windefender.exe
4516	windefender.exe
7108	explothe.exe
5604	Utsysc.exe
6604	f801950a962ddba14caaa44bf084b55c.exe
4080	explothe.exe
6268	Utsysc.exe

Loads dropped DLL 6 IoCs

Processes:

LzmwAqmV.tmp6B12.exerundll32.exerundll32.exerundll32.exerundll32.exe

pid process

4796 LzmwAqmV.tmp
5844 6B12.exe
204 rundll32.exe
4356 rundll32.exe
5916 rundll32.exe
5728 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 51.159.66.125

pid	process
4796	LzmwAqmV.tmp
5844	6B12.exe
204	rundll32.exe
4356	rundll32.exe
5916	rundll32.exe
5728	rundll32.exe

description	ioc
Destination IP	51.159.66.125

Windows security modification 2 TTPs 9 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exeCC1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	CC1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	CC1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	31839b57a4f11171d6abc8bbc4451ee4.exe

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

7295.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7295.exe
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7295.exe
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7295.exe
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7295.exe
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7295.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

xU8mT4YJ.exeFb6jM0Il.exenk2Rg5kr.exe55D4.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exe829.exeIN8gZ5gn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	xU8mT4YJ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Fb6jM0Il.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	nk2Rg5kr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\55D4.exe'\""	55D4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	829.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	IN8gZ5gn.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

131 api.ipify.org
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

flow	ioc
131	api.ipify.org

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 10 IoCs

Processes:

powershell.exeConhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	Conhost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe1dI10GX0.exetoolspub2.exe6B12.exeupdater.exe

description	pid	process	target process
PID 2980 set thread context of 3796	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 3528 set thread context of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 6008 set thread context of 6712	6008	toolspub2.exe	toolspub2.exe
PID 5844 set thread context of 6232	5844	6B12.exe	RegAsm.exe
PID 6268 set thread context of 5912	6268	updater.exe	conhost.exe
PID 6268 set thread context of 6560	6268	updater.exe	explorer.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 20 IoCs

Processes:

LzmwAqmV.tmpupdater.exelatestX.exe

description	ioc	process
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-S1PM3.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-CBIQ6.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-KCBK8.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-1PDJT.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-PAM5Q.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-A37CE.tmp	LzmwAqmV.tmp
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-MKDV1.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-ML3UU.tmp	LzmwAqmV.tmp
File opened for modification	C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat	LzmwAqmV.tmp
File opened for modification	C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe	LzmwAqmV.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-SIA02.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-9RFSA.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-J591N.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-RFM1L.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-MJ0L5.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-GQ2V2.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-RL98E.tmp	LzmwAqmV.tmp

Drops file in Windows directory 23 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdgeCP.exe31839b57a4f11171d6abc8bbc4451ee4.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.execsrss.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\windefender.exe	csrss.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

6552 sc.exe
2408 sc.exe
5800 sc.exe
6044 sc.exe
6464 sc.exe
1360 sc.exe
5720 sc.exe
1592 sc.exe
2464 sc.exe
7012 sc.exe
6752 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3776 4720 WerFault.exe AppLaunch.exe
6832 6232 WerFault.exe RegAsm.exe

pid	process
6552	sc.exe
2408	sc.exe
5800	sc.exe
6044	sc.exe
6464	sc.exe
1360	sc.exe
5720	sc.exe
1592	sc.exe
2464	sc.exe
7012	sc.exe
6752	sc.exe

pid	pid_target	process	target process
3776	4720	WerFault.exe	AppLaunch.exe
6832	6232	WerFault.exe	RegAsm.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

AppLaunch.exetoolspub2.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2416 schtasks.exe
6224 schtasks.exe
5408 schtasks.exe
6988 schtasks.exe

pid	process
2416	schtasks.exe
6224	schtasks.exe
5408	schtasks.exe
6988	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exeConhost.exepowershell.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exenetsh.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time"	windefender.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\epicgames.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\paypalobjects.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\epicgames.com\Total = "15"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.epicgames.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\newassets.hcaptcha.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8dca81f27e0cda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.paypalobjects.com	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\steampowered.com\NumberOfS = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\epicgames.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\store.steampowered.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\recaptcha.net\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\c.paypal.com	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 80299e41b10cda01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\steampowered.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\steampowered.com\NumberOfSubd = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.epicgames.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.recaptcha.net\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3775e2d37e0cda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\recaptcha.net\NumberOfSubdoma = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\recaptcha.net\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exeExplorer.EXE

pid	process
3796	AppLaunch.exe
3796	AppLaunch.exe
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3308 Explorer.EXE
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

600

pid	process
3308	Explorer.EXE

pid	process
600

Suspicious behavior: MapViewOfSection 37 IoCs

Processes:

AppLaunch.exeMicrosoftEdgeCP.exetoolspub2.exe

pid	process
3796	AppLaunch.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
6712	toolspub2.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXECC1.exeMicrosoftEdgeCP.exe184C.exeMicrosoftEdgeCP.exekos4.exe

description	pid	process
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	2208	CC1.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	4252	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4252	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4252	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4252	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3000	184C.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	5956	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	5776	kos4.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

LzmwAqmV.tmp8EEA.exe

pid process

4796 LzmwAqmV.tmp
6944 8EEA.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeBroom.exe

pid process

3324 MicrosoftEdge.exe
4280 MicrosoftEdgeCP.exe
4252 MicrosoftEdgeCP.exe
4280 MicrosoftEdgeCP.exe
3788 Broom.exe

pid	process
4796	LzmwAqmV.tmp
6944	8EEA.exe

pid	process
3324	MicrosoftEdge.exe
4280	MicrosoftEdgeCP.exe
4252	MicrosoftEdgeCP.exe
4280	MicrosoftEdgeCP.exe
3788	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exeExplorer.EXE829.exeIN8gZ5gn.exexU8mT4YJ.exeFb6jM0Il.exenk2Rg5kr.exe1dI10GX0.exeE0A.exeexplothe.exe

description	pid	process	target process
PID 2980 wrote to memory of 3648	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3648	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3648	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3912	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3912	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3912	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3796	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3796	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3796	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3796	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3796	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 2980 wrote to memory of 3796	2980	434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe	AppLaunch.exe
PID 3308 wrote to memory of 4136	3308	Explorer.EXE	829.exe
PID 3308 wrote to memory of 4136	3308	Explorer.EXE	829.exe
PID 3308 wrote to memory of 4136	3308	Explorer.EXE	829.exe
PID 3308 wrote to memory of 4568	3308	Explorer.EXE	924.exe
PID 3308 wrote to memory of 4568	3308	Explorer.EXE	924.exe
PID 3308 wrote to memory of 4568	3308	Explorer.EXE	924.exe
PID 4136 wrote to memory of 1004	4136	829.exe	IN8gZ5gn.exe
PID 4136 wrote to memory of 1004	4136	829.exe	IN8gZ5gn.exe
PID 4136 wrote to memory of 1004	4136	829.exe	IN8gZ5gn.exe
PID 1004 wrote to memory of 96	1004	IN8gZ5gn.exe	xU8mT4YJ.exe
PID 1004 wrote to memory of 96	1004	IN8gZ5gn.exe	xU8mT4YJ.exe
PID 1004 wrote to memory of 96	1004	IN8gZ5gn.exe	xU8mT4YJ.exe
PID 3308 wrote to memory of 2492	3308	Explorer.EXE	cmd.exe
PID 3308 wrote to memory of 2492	3308	Explorer.EXE	cmd.exe
PID 96 wrote to memory of 5092	96	xU8mT4YJ.exe	Fb6jM0Il.exe
PID 96 wrote to memory of 5092	96	xU8mT4YJ.exe	Fb6jM0Il.exe
PID 96 wrote to memory of 5092	96	xU8mT4YJ.exe	Fb6jM0Il.exe
PID 3308 wrote to memory of 3920	3308	Explorer.EXE	B58.exe
PID 3308 wrote to memory of 3920	3308	Explorer.EXE	B58.exe
PID 3308 wrote to memory of 3920	3308	Explorer.EXE	B58.exe
PID 5092 wrote to memory of 3028	5092	Fb6jM0Il.exe	nk2Rg5kr.exe
PID 5092 wrote to memory of 3028	5092	Fb6jM0Il.exe	nk2Rg5kr.exe
PID 5092 wrote to memory of 3028	5092	Fb6jM0Il.exe	nk2Rg5kr.exe
PID 3028 wrote to memory of 3528	3028	nk2Rg5kr.exe	1dI10GX0.exe
PID 3028 wrote to memory of 3528	3028	nk2Rg5kr.exe	1dI10GX0.exe
PID 3028 wrote to memory of 3528	3028	nk2Rg5kr.exe	1dI10GX0.exe
PID 3308 wrote to memory of 2208	3308	Explorer.EXE	CC1.exe
PID 3308 wrote to memory of 2208	3308	Explorer.EXE	CC1.exe
PID 3308 wrote to memory of 2208	3308	Explorer.EXE	CC1.exe
PID 3308 wrote to memory of 5068	3308	Explorer.EXE	E0A.exe
PID 3308 wrote to memory of 5068	3308	Explorer.EXE	E0A.exe
PID 3308 wrote to memory of 5068	3308	Explorer.EXE	E0A.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3528 wrote to memory of 4720	3528	1dI10GX0.exe	AppLaunch.exe
PID 3028 wrote to memory of 5024	3028	nk2Rg5kr.exe	2iI657iQ.exe
PID 3028 wrote to memory of 5024	3028	nk2Rg5kr.exe	2iI657iQ.exe
PID 3028 wrote to memory of 5024	3028	nk2Rg5kr.exe	2iI657iQ.exe
PID 5068 wrote to memory of 3464	5068	E0A.exe	explothe.exe
PID 5068 wrote to memory of 3464	5068	E0A.exe	explothe.exe
PID 5068 wrote to memory of 3464	5068	E0A.exe	explothe.exe
PID 3308 wrote to memory of 3000	3308	Explorer.EXE	184C.exe
PID 3308 wrote to memory of 3000	3308	Explorer.EXE	184C.exe
PID 3308 wrote to memory of 3000	3308	Explorer.EXE	184C.exe
PID 3464 wrote to memory of 2416	3464	explothe.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

7295.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7295.exe

outlook_win_path 1 IoCs

Processes:

7295.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	7295.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3308

C:\Users\Admin\AppData\Local\Temp\434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe
"C:\Users\Admin\AppData\Local\Temp\434078bad22fb3c42164eecfcb00d594610c68f30c3741d7801c58abfbfdeec0.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:3648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:3912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3796

C:\Users\Admin\AppData\Local\Temp\829.exe
C:\Users\Admin\AppData\Local\Temp\829.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4136

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:96

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5092

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3028

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 572
9⤵
- Program crash
PID:3776

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe
7⤵
- Executes dropped EXE
PID:5024

C:\Users\Admin\AppData\Local\Temp\924.exe
C:\Users\Admin\AppData\Local\Temp\924.exe
2⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A6D.bat" "
2⤵
- Checks computer location settings
PID:2492

C:\Users\Admin\AppData\Local\Temp\B58.exe
C:\Users\Admin\AppData\Local\Temp\B58.exe
2⤵
- Executes dropped EXE
PID:3920

C:\Users\Admin\AppData\Local\Temp\CC1.exe
C:\Users\Admin\AppData\Local\Temp\CC1.exe
2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Users\Admin\AppData\Local\Temp\E0A.exe
C:\Users\Admin\AppData\Local\Temp\E0A.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
4⤵
- Creates scheduled task(s)
PID:2416

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
4⤵
PID:4204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2620

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
5⤵
PID:2880

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
5⤵
PID:2828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:796

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
5⤵
PID:3944

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
5⤵
PID:952

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:5728

C:\Users\Admin\AppData\Local\Temp\184C.exe
C:\Users\Admin\AppData\Local\Temp\184C.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Users\Admin\AppData\Local\Temp\516E.exe
C:\Users\Admin\AppData\Local\Temp\516E.exe
2⤵
- Executes dropped EXE
PID:5512

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
3⤵
- Executes dropped EXE
PID:4920

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
4⤵
- Suspicious use of SetWindowsHookEx
PID:3788

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6008

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6712

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
PID:5568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:6820

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6772

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
PID:6732

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:6040

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:6820

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1160

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:7108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6204

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:6056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6196

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:5408

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:6208

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6588

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
- Executes dropped EXE
PID:2756

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:6988

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
- Executes dropped EXE
PID:1852

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:7108

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:4944

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Executes dropped EXE
- Launches sc.exe
PID:1592

C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
6⤵
- Executes dropped EXE
PID:6604

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn "csrss" /f
7⤵
PID:596

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn "ScheduledUpdate" /f
7⤵
PID:6084

C:\Users\Admin\AppData\Local\Temp\kos4.exe
"C:\Users\Admin\AppData\Local\Temp\kos4.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5776

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
4⤵
- Executes dropped EXE
PID:5904

C:\Users\Admin\AppData\Local\Temp\is-703AL.tmp\LzmwAqmV.tmp
"C:\Users\Admin\AppData\Local\Temp\is-703AL.tmp\LzmwAqmV.tmp" /SL5="$304EA,2889973,140800,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:4796

C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
"C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -i
6⤵
PID:6552

C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
"C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -s
6⤵
- Executes dropped EXE
PID:6872

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 31
6⤵
PID:6508

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:5688

C:\Users\Admin\AppData\Local\Temp\55D4.exe
C:\Users\Admin\AppData\Local\Temp\55D4.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5648

C:\Users\Admin\AppData\Local\Temp\6B12.exe
C:\Users\Admin\AppData\Local\Temp\6B12.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:5844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:6232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 580
4⤵
- Program crash
PID:6832

C:\Users\Admin\AppData\Local\Temp\7295.exe
C:\Users\Admin\AppData\Local\Temp\7295.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:6172

C:\Users\Admin\AppData\Local\Temp\7536.exe
C:\Users\Admin\AppData\Local\Temp\7536.exe
2⤵
PID:6424

C:\Users\Admin\AppData\Local\Temp\815C.exe
C:\Users\Admin\AppData\Local\Temp\815C.exe
2⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\8EEA.exe
C:\Users\Admin\AppData\Local\Temp\8EEA.exe
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:6944

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
"C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"
3⤵
- Executes dropped EXE
PID:7028

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F
4⤵
- Creates scheduled task(s)
PID:6224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "Admin:N"&&CACLS "..\ea7c8244c8" /P "Admin:R" /E&&Exit
4⤵
PID:6908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:6244

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:N"
5⤵
PID:7164

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:R" /E
5⤵
PID:5600

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ea7c8244c8" /P "Admin:N"
5⤵
PID:4904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4564

C:\Windows\SysWOW64\cacls.exe
CACLS "..\ea7c8244c8" /P "Admin:R" /E
5⤵
PID:6564

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main
4⤵
- Loads dropped DLL
PID:204

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4356

C:\Windows\system32\netsh.exe
netsh wlan show profiles
6⤵
PID:4532

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:6572

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:5572

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Executes dropped EXE
- Launches sc.exe
PID:6552

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2408

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:5800

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Executes dropped EXE
- Launches sc.exe
PID:5720

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:6044

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:3436

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:7048

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:5872

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:5660

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:5564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:5924

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:1396

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5532

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:5636

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Executes dropped EXE
- Launches sc.exe
PID:6464

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Executes dropped EXE
- Launches sc.exe
PID:1360

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:2464

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:7012

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:6752

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:5600

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:6032

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:6460

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:6260

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:7116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4080

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:5912

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:6560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3324

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1848

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4252

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:4116

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:220

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5080

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2332

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2200

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5196

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5956

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
PID:5720

C:\Users\Admin\AppData\Roaming\chcfrbr
C:\Users\Admin\AppData\Roaming\chcfrbr
1⤵
- Executes dropped EXE
PID:5840

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 31
1⤵
PID:7008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5892

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:916

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
PID:6424

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6072

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
PID:1592

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
1⤵
- Executes dropped EXE
PID:2960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4468

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
PID:6224

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:6268

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3304

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6708

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:5248

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
PID:6464

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
1⤵
PID:1360

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4516

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:7108

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
1⤵
- Executes dropped EXE
PID:5604

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4080

C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe
1⤵
- Executes dropped EXE
PID:6268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
4af1e45b3a6e7f3528377bd11bd83a36

SHA1
67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

SHA256
3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

SHA512
6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

Download Submit
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
4af1e45b3a6e7f3528377bd11bd83a36

SHA1
67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

SHA256
3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

SHA512
6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

Download Submit
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
4af1e45b3a6e7f3528377bd11bd83a36

SHA1
67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

SHA256
3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

SHA512
6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TCMH1DO0\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5XBNPZLG\shared_global[1].js

Filesize
149KB

MD5
dcf6f57f660ba7bf3c0de14c2f66174d

SHA1
ce084fcb16eec54ad5c4869a5d0d0c2afb4ba355

SHA256
7631736851bd8c45de3fc558156213fca631f221507ca5b48893dbe89ed3448e

SHA512
801dedc67ed9f7e0828f4340d228e26d5af32b288dc66d0a3e8d9f94f46e4b64e93b01f319a6de50fa83b2690220d07815e458a4d9941dc0099cbe45529fd86b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5XBNPZLG\shared_responsive[1].css

Filesize
18KB

MD5
086f049ba7be3b3ab7551f792e4cbce1

SHA1
292c885b0515d7f2f96615284a7c1a4b8a48294a

SHA256
b38fc1074ef68863c2841111b9e20d98ea0305c1e39308dc7ad3a6f3fd39117a

SHA512
645f23b5598d0c38286c2a68268cb0bc60db9f6de7620297f94ba14afe218d18359d124ebb1518d31cd8960baed7870af8fd6960902b1c9496d945247fbb2d78

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\5XBNPZLG\tooltip[1].js

Filesize
15KB

MD5
72938851e7c2ef7b63299eba0c6752cb

SHA1
b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e

SHA256
e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661

SHA512
2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NV3HY8GI\chunk~9229560c0[1].css

Filesize
34KB

MD5
19a9c503e4f9eabd0eafd6773ab082c0

SHA1
d9b0ca3905ab9a0f9ea976d32a00abb7935d9913

SHA256
7ba0cc7d66172829eef8ff773c1e9c6e2fde3cfd82d9a89e1a71751957e47b0a

SHA512
0145582e8eb3adb98ad2dbc0b8e7a29c1d0525f0fd515fcf82eda7b4ce2f7f7f6aa0e81912aa98927e6d420ed110eb497c287a0ad483f8af067332920d4bde83

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NV3HY8GI\recaptcha__en[1].js

Filesize
461KB

MD5
4efc45f285352a5b252b651160e1ced9

SHA1
c7ba19e7058ec22c8d0f7283ab6b722bb7a135d7

SHA256
253627a82794506a7d660ee232c06a88d2eaafb6174532f8c390bb69ade6636a

SHA512
cfc7aae449b15a8b84f117844547f7a5c2f2dd4a79e8b543305ae83b79195c5a6f6d0ccf6f2888c665002b125d9569cd5c0842fdd2f61d2a2848091776263a39

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PQJRU1BR\buttons[2].css

Filesize
32KB

MD5
84524a43a1d5ec8293a89bb6999e2f70

SHA1
ea924893c61b252ce6cdb36cdefae34475d4078c

SHA256
8163d25cb71da281079b36fcde6d9f6846ff1e9d70112bbe328cae5ffb05f2bc

SHA512
2bf17794d327b4a9bdbae446dd086354b6b98ac044a8ee0b85bd72c3ab22d93b43f3542df03d64f997d1df6fc6cac5c5e258c4ec82b998f3a40b50c2fde99b5a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PQJRU1BR\hcaptcha[1].js

Filesize
323KB

MD5
5334810719a3cb091a735803ffbbffc9

SHA1
bc703f1c9b3ad56dd7659928b0c7e93b09b52709

SHA256
bc8bb611de4a8fde99c8ca3393b429f6421f98f6fca51aacf3b2bbfea75159fe

SHA512
e4adc37b1466620edf653ac6f09c25341f1eda1e7bae612c0321f14191d496dcca40a48811fc4d383bf7ac16d7e22ec108a411bd1faebba165eda396ec3d32ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\PQJRU1BR\shared_global[1].css

Filesize
84KB

MD5
f56f4b1c9791efbf5e870a2bd1f3a9ed

SHA1
b6002562e55d7f7ca3bb3b36766c3360aeb5eb48

SHA256
aa8ba06f64d8021223ae50fa90435f78ebbb5c5bf37e6ee61322f4e0a756bea2

SHA512
f6acb17dba8f13aed76ec6a95edaa07d8d805786a7846ef72b2dded615f745a80534d270d6589fd0d6f2eaeeeae717b3126f5124575faf435ccc609a822e059a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\X3VB1WID\shared_responsive_adapter[1].js

Filesize
24KB

MD5
a52bc800ab6e9df5a05a5153eea29ffb

SHA1
8661643fcbc7498dd7317d100ec62d1c1c6886ff

SHA256
57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e

SHA512
1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\IB6SQ2CA\www.epicgames[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\XG6VE5DG\www.recaptcha[1].xml

Filesize
99B

MD5
ee7d63aa451a6e005699f7ca52daf78c

SHA1
7a5dda3b2b5babac51f14c56b483b16889005744

SHA256
756a3b98943eec7b71a74eb00c68db49e4124cd2305e462401e2539bf7314612

SHA512
5ddfec01d72e43af54e4d43fb2a85f6f156862207b4ca12b7a3267cae49d5e65477172bf80f930dea09d984c7b9ac11b231e17313fd6c52e78d1a2b6a50e895f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\YPU0A362\c.paypal[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\0NVZUYZ3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\1YF5OZZ9\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\1YF5OZZ9\favicon[1].ico

Filesize
1KB

MD5
630d203cdeba06df4c0e289c8c8094f6

SHA1
eee14e8a36b0512c12ba26c0516b4553618dea36

SHA256
bbce71345828a27c5572637dbe88a3dd1e065266066600c8a841985588bf2902

SHA512
09f4e204960f4717848bf970ac4305f10201115e45dd5fe0196a6346628f0011e7bc17d73ec946b68731a5e179108fd39958cecf41125f44094f63fe5f2aeb2c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3X23MP23\favicon[2].ico

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3X23MP23\pp_favicon_x[1].ico

Filesize
5KB

MD5
e1528b5176081f0ed963ec8397bc8fd3

SHA1
ff60afd001e924511e9b6f12c57b6bf26821fc1e

SHA256
1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667

SHA512
acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\MOLXJL8K\epic-favicon-96x96[1].png

Filesize
5KB

MD5
c94a0e93b5daa0eec052b89000774086

SHA1
cb4acc8cfedd95353aa8defde0a82b100ab27f72

SHA256
3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775

SHA512
f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\275yvei\imagestore.dat

Filesize
84KB

MD5
f7434ebcf427db51e75f1860af750a70

SHA1
d66f9d2f000ae26e9f33a8142590802f30ebaa93

SHA256
eba9cede3b07ca108df6b9d8982e4f03f60014e143fcc11abd18b29333258c3c

SHA512
b47d78b4bd9ef4be2cc595406d6cb23f2932dd682c68bce158596d9bdc203e94779322afb3a0addaaf7163ede3a02523cd7ab42e4e88281bc8a06c6520d9e3d3

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\0LK2NKIT.cookie

Filesize
132B

MD5
e437735aa01d2f7d69a607ba7a962b30

SHA1
2387f2f6692e59398a9c371b6297dc0ed2de76cf

SHA256
68a6770b51bc6be16b37c45641dc65a82d199a8f2d7c305575c592ba373723a3

SHA512
060bb6e5c740112a5653b40d743b80f26523da0a71d5da3048060a363c4622f32b95a7bf7aa799d9ca924327e25c9848580324e6829f53d5735539b76aab2826

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1556fc38a0db5b0c05c4277a624515de

SHA1
ce49652166b3bd3820b2cdbe7cfbba78eabbf9f0

SHA256
da82afcf50861e89ff8bff80ee852bb4c937b8b39ee2d8b10bff462afe3d0372

SHA512
552f08e28cf217126f97338798f8036dc49501f7f09421afe975632faf2b78db3a3d3831f98b7f030285e960b6faa5c5bb41a339c4e6fa1473d3b3479bbaf1e0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
947e4f16c47960895dfe4e8dbbad83c0

SHA1
f18925076e744dd1813c544ca0d2c6fae401e176

SHA256
3dc6830b4d1ff3a78c8458643c104682c4905c3da982051de5c8958246ff5673

SHA512
fc22715fa70a4815bc7b880116fdb540223707bd92d80cea5cd92f1a4e41906f0e294764f7907d87410fa9c855ee5e3965493a1b8aefd7e3b1fdc5fb3c6c4864

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
3a40f4e714b12a17e81e5416f4274a3b

SHA1
93aef1a485143a56520d250b4682ff83cda3e651

SHA256
f1c72c3599a519891f9a8c98b1367c46f4d8f835b20506ceda1e2e8ce637aeaa

SHA512
1905587aab6516665c3fbb5b3e5f0956d249c20d04f8a01c0a105c7fa401821fac1d0acad49b66c459cd34a1cb21a8b78d15a602b08effe2c2ea91d5f36d4de0

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
fd04580264fb5ea759d259dedcfe1865

SHA1
71921bb966f33390cc139cf88e8ac8952403a63c

SHA256
517418b37e31340728d5e679dd9100aae99fbeb133426769afd95b87608f60e9

SHA512
a0904a86472cafc77b6b817fbcfc3fa5db0c458fcc3357d96186148f8ead650a20b4e263b30340be4c295249f4684642807029474261e7dfb64775c7e9150c8f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
9a5db00453532f84e5b6a188a4556e6f

SHA1
d70e1f377e71aa1179f58561c8e9946a5391fc3e

SHA256
567a0e1df132dff9dc0aeba93e3f7afc18d745d53f02016bebd009de365e9dd0

SHA512
e0864de93ed2b228c4c9808000b063d31ce22f4baffa48fdbba9cf6dffd9ad44653bc398693f0a0b5063ba632b4ac9a30df6b38d614f0fb1fa34af8db21bf692

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
370adf5c73e53f6681dee0441313cbee

SHA1
5a92dfdc7f9d3d221c230012331ce6e74d432e13

SHA256
9f640a98d8750b20222a876cf3627877c5a48102c48d691a4093bd3df48ba7aa

SHA512
ef60142747ab2764250daf7a8b31f1a47ce350a60c6816fa7112d2d88c9ff10066b32ed0f1a67cdaa602f2555a46fe7764fb2503ab4ebbcee68d1e4eb9aa6f90

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
4d1acff890d86bbd5c640115721af8b6

SHA1
85386deca88ac85b4873dc96efa4ef4ed0f8b380

SHA256
3afddde6392e8022af33ca25dbdad760c2f0e5e0ce410f5d7d0c5249fffd12e6

SHA512
a7b490e65b550f7a60befab3c53522b20d5be170ac3df8480fe8fb4ac41beb4a1c618b95dcc8cbec9a2db0fbc930d60d83dfcc15f2e6cd3a356caeee28515e59

Download Submit
C:\Users\Admin\AppData\Local\Temp\184C.exe

Filesize
500KB

MD5
99267c8824d4b28161a2ecec030ec588

SHA1
e478b1ab1733c6116edd204a3cf2c2ee7db49b4a

SHA256
6f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0

SHA512
7be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\184C.exe

Filesize
500KB

MD5
99267c8824d4b28161a2ecec030ec588

SHA1
e478b1ab1733c6116edd204a3cf2c2ee7db49b4a

SHA256
6f12232e159de661dadd56f6f17a36a0d4e6ae24eba5c06f54fd2f7a8763feb0

SHA512
7be5fa7fdc2ffc9c753ce7a75fddf1ae54dd6eca79c6140eb0ce3cdcf663af7f4846d6ae051283a36ab4e47a96d9b7905e1b55a2d236c5234ecf850caed09df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9879861f3899a47f923cb13ca048dcc1

SHA1
2c24fd7dec7e0c69b35a9c75d59c7c3db51f7980

SHA256
9f7ffdf942954fc527e1b68b996f3ed6ebbb4bd5a8e0ab9387167cd5fae47513

SHA512
6f51d51eaa653c7ec92de89baaeb402fb33ced558df060e3075498047a75e32396aa00d3bcc89f3cd4d4378ece96d75a54b7d9f4f6aaf459356325434698caa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9879861f3899a47f923cb13ca048dcc1

SHA1
2c24fd7dec7e0c69b35a9c75d59c7c3db51f7980

SHA256
9f7ffdf942954fc527e1b68b996f3ed6ebbb4bd5a8e0ab9387167cd5fae47513

SHA512
6f51d51eaa653c7ec92de89baaeb402fb33ced558df060e3075498047a75e32396aa00d3bcc89f3cd4d4378ece96d75a54b7d9f4f6aaf459356325434698caa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\516E.exe

Filesize
12.5MB

MD5
d6d713eb220a65a83a980e692036f54d

SHA1
47d93124d294d3c288cf97b6ac1d8c536ec97025

SHA256
56ae58cbc108cb9d2237a4aff5509a0fd5862d4cf4bab8adfde9a4c49c5e9392

SHA512
2296d3803f7b20cdc2113f8c305486cd9f79c1b35ef91aab4b39fca827edb6cdd1943a14800366fcacbae8dd0d0ba9a69677938dd48156a19fdad646dbf319b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\516E.exe

Filesize
12.5MB

MD5
d6d713eb220a65a83a980e692036f54d

SHA1
47d93124d294d3c288cf97b6ac1d8c536ec97025

SHA256
56ae58cbc108cb9d2237a4aff5509a0fd5862d4cf4bab8adfde9a4c49c5e9392

SHA512
2296d3803f7b20cdc2113f8c305486cd9f79c1b35ef91aab4b39fca827edb6cdd1943a14800366fcacbae8dd0d0ba9a69677938dd48156a19fdad646dbf319b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\55D4.exe

Filesize
10KB

MD5
395e28e36c665acf5f85f7c4c6363296

SHA1
cd96607e18326979de9de8d6f5bab2d4b176f9fb

SHA256
46af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa

SHA512
3d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de

Download Submit
C:\Users\Admin\AppData\Local\Temp\55D4.exe

Filesize
10KB

MD5
395e28e36c665acf5f85f7c4c6363296

SHA1
cd96607e18326979de9de8d6f5bab2d4b176f9fb

SHA256
46af9af74a5525e6315bf690c664a1ad46452fef15b7f3aecb6216ad448befaa

SHA512
3d22e98b356986af498ea2937aa388aeb1ac6edfeca784aae7f6628a029287c3daebcc6ab5f8e0ef7f9d546397c8fd406a8cdaf0b46dcc4f8716a69d6fb873de

Download Submit
C:\Users\Admin\AppData\Local\Temp\596510554136

Filesize
84KB

MD5
2a55b6a49be2f43a17e3a1c8176cc0a2

SHA1
7e11dfedc4e6ca74d6108e64d538f7e947e23cfd

SHA256
5774ff91b4d2a1a2e490a9086b0da5da3350ffde8f8ef20bda639522e56a43cd

SHA512
cecbc8db39464346248779385e13abd67f2c890b82cc1ee609f78fa1368d7ef8f746a5f626cd2fdd5a809a0b8c326e667659c8c043c3abc23df30ce8a92b3268

Download Submit
C:\Users\Admin\AppData\Local\Temp\596510554136

Filesize
86KB

MD5
a7ade65b1f46e8b2e541a4c9f38c12a2

SHA1
e8400e1c5ca18aa2f29d3d5b8d5c5ab4f845a729

SHA256
69d556f8486777ad66b992f6765dd96283769bbbe6483a80d619c2234072cf2a

SHA512
8152d2286862cfeccca03c4f0238d63f44bbc77a51c46fef637f1f7e07e2f33238ac744b2e3888c6017f9b6b44bfbc050256eab043b511238171aff56e8ef4ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\596510554136

Filesize
85KB

MD5
bcab24b550d178d601fea15eb7ead4ee

SHA1
f4d0f7ebdc01ccc1425b6ba2c1f59354e97c43a6

SHA256
9850b1ca414c45b28edb35ac0ee1d4513f84803044342aa9601c097e7cebca21

SHA512
9695999f9f63e1bafdfdb40f6a0c97e4338fd704acc48102ab261c8412acb5587772571078081076fd49ecca0b15954c7844b4c8b6b448ec477cb5093230289b

Download Submit
C:\Users\Admin\AppData\Local\Temp\6B12.exe

Filesize
3.9MB

MD5
e2ff8a34d2fcc417c41c822e4f3ea271

SHA1
926eaf9dd645e164e9f06ddcba567568b3b8bb1b

SHA256
4f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0

SHA512
823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\6B12.exe

Filesize
3.9MB

MD5
e2ff8a34d2fcc417c41c822e4f3ea271

SHA1
926eaf9dd645e164e9f06ddcba567568b3b8bb1b

SHA256
4f26511d40ad3d781ff1bd4c643f9418b3fd0c4da6b769a1ff9ae4d07d8892d0

SHA512
823d99704b761218b3de8f6b107378b529e7f718557b9e2b57ffb497310c4eccfc35c402bad28cdc2758ef254e55a936949c24468f07fc21e7e3efc0671beec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7295.exe

Filesize
1.1MB

MD5
993c85b5b1c94bfa3b7f45117f567d09

SHA1
cb704e8d65621437f15a21be41c1169987b913de

SHA256
cb6c640fbc6289b261bca0ee881bfcc8c4df2e89baaab7a4fed4e0e3b0dc9d37

SHA512
182d6cb6f3e6618375e8e793c6ce5d3c73da8183d4acad8bad60f35242c264260423e22a68ea64022c9c0c61b226edc4dd3791e6947e42c418355baa623e1f24

Download Submit
C:\Users\Admin\AppData\Local\Temp\7295.exe

Filesize
1.1MB

MD5
993c85b5b1c94bfa3b7f45117f567d09

SHA1
cb704e8d65621437f15a21be41c1169987b913de

SHA256
cb6c640fbc6289b261bca0ee881bfcc8c4df2e89baaab7a4fed4e0e3b0dc9d37

SHA512
182d6cb6f3e6618375e8e793c6ce5d3c73da8183d4acad8bad60f35242c264260423e22a68ea64022c9c0c61b226edc4dd3791e6947e42c418355baa623e1f24

Download Submit
C:\Users\Admin\AppData\Local\Temp\7536.exe

Filesize
95KB

MD5
463d1200107d98891f04dbbeece19716

SHA1
03a4071c18909714676b4c85e2b960782a0e7d29

SHA256
e38d2e806efa284c129eca4aff2e81c6cc43f969c5603c2d48efda1a333746e6

SHA512
7b257d1f9bc8bef6879f70786eb5580241c1c0e77a458a6d28eaf8ab1571a054ffaf60f9e485ee9890e14abbc7fb9e9e84627dd9c9a224b24c5cd6041a9d4922

Download Submit
C:\Users\Admin\AppData\Local\Temp\829.exe

Filesize
1.4MB

MD5
39f3058fb49612f68b87d17eabb77047

SHA1
797c61719127b2963a944f260c383c8db0b2fd98

SHA256
da3909df314616742246a7504698232b9842273aa085b7c1eea1b54b17b9ca4f

SHA512
2f3c742dbf27a2a520b9c389f60b6e8dd8cee79bb649045a7d6b5e25c1411303904a73ff32667a8bd1508c9dcfd4af7120ce0162aeb95647e1221508436c61c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\829.exe

Filesize
1.4MB

MD5
39f3058fb49612f68b87d17eabb77047

SHA1
797c61719127b2963a944f260c383c8db0b2fd98

SHA256
da3909df314616742246a7504698232b9842273aa085b7c1eea1b54b17b9ca4f

SHA512
2f3c742dbf27a2a520b9c389f60b6e8dd8cee79bb649045a7d6b5e25c1411303904a73ff32667a8bd1508c9dcfd4af7120ce0162aeb95647e1221508436c61c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\924.exe

Filesize
182KB

MD5
e561df80d8920ae9b152ddddefd13c7c

SHA1
0d020453f62d2188f7a0e55442af5d75e16e7caf

SHA256
5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea

SHA512
a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\924.exe

Filesize
182KB

MD5
e561df80d8920ae9b152ddddefd13c7c

SHA1
0d020453f62d2188f7a0e55442af5d75e16e7caf

SHA256
5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea

SHA512
a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\A6D.bat

Filesize
342B

MD5
e79bae3b03e1bff746f952a0366e73ba

SHA1
5f547786c869ce7abc049869182283fa09f38b1d

SHA256
900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63

SHA512
c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

Download Submit
C:\Users\Admin\AppData\Local\Temp\B58.exe

Filesize
221KB

MD5
73089952a99d24a37d9219c4e30decde

SHA1
8dfa37723afc72f1728ec83f676ffeac9102f8bd

SHA256
9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60

SHA512
7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\B58.exe

Filesize
221KB

MD5
73089952a99d24a37d9219c4e30decde

SHA1
8dfa37723afc72f1728ec83f676ffeac9102f8bd

SHA256
9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60

SHA512
7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC1.exe

Filesize
11KB

MD5
d2ed05fd71460e6d4c505ce87495b859

SHA1
a970dfe775c4e3f157b5b2e26b1f77da7ae6d884

SHA256
3a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f

SHA512
a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CC1.exe

Filesize
11KB

MD5
d2ed05fd71460e6d4c505ce87495b859

SHA1
a970dfe775c4e3f157b5b2e26b1f77da7ae6d884

SHA256
3a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f

SHA512
a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E0A.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\E0A.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exe

Filesize
1.3MB

MD5
373b2e27b51ff6282238ef9761f67ff7

SHA1
135f31f3498e1a9565dce1b494dfd02d228f2020

SHA256
f0b66a21b94b5e228b7fb8f10896c5bac2301daa2609bd85da784697410921e0

SHA512
4e0989bab1264683c0796a0759bd32c9e42c31f8fd7bcf2db0e09cec5d0483f9701214c518d3b13effb61e8e61c049cb339d83c655664743f0d8668cb4f726fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exe

Filesize
1.3MB

MD5
373b2e27b51ff6282238ef9761f67ff7

SHA1
135f31f3498e1a9565dce1b494dfd02d228f2020

SHA256
f0b66a21b94b5e228b7fb8f10896c5bac2301daa2609bd85da784697410921e0

SHA512
4e0989bab1264683c0796a0759bd32c9e42c31f8fd7bcf2db0e09cec5d0483f9701214c518d3b13effb61e8e61c049cb339d83c655664743f0d8668cb4f726fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exe

Filesize
1.1MB

MD5
e2fac46557c196eaa454c436b2212532

SHA1
f07c2b07f75059801095b97236665b677e1ea4f6

SHA256
0d4ab871a8879a6d4412000f2fe45a889e213c60da5073006fa6b1cbd199dcd2

SHA512
cf0bc76d8b4c1929c22b6f0dd30456b338a7c50c29c28e7c12f21b7289a99559eaaa2a0c3d524196862eb99205cd4fc2263f611bc19d7ba30d3d240230ab5e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exe

Filesize
1.1MB

MD5
e2fac46557c196eaa454c436b2212532

SHA1
f07c2b07f75059801095b97236665b677e1ea4f6

SHA256
0d4ab871a8879a6d4412000f2fe45a889e213c60da5073006fa6b1cbd199dcd2

SHA512
cf0bc76d8b4c1929c22b6f0dd30456b338a7c50c29c28e7c12f21b7289a99559eaaa2a0c3d524196862eb99205cd4fc2263f611bc19d7ba30d3d240230ab5e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exe

Filesize
756KB

MD5
a5da3f4f02b15dffdabe506377155371

SHA1
c8e6221d041422aa09f235323b4a5aa3db817176

SHA256
0e902c5c8391f35729cfee22111cd6a5d9974ec25d38bd0bdf4981ca14ebc28c

SHA512
f6ab21f36bb04f53d1e084f5afcc899b3e966ae7eebd7ff1a0038e6f2a839c5bc20cc8195b65bfb93d671ef2c8428847a005acd0de4d69b0ae89843358536389

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exe

Filesize
756KB

MD5
a5da3f4f02b15dffdabe506377155371

SHA1
c8e6221d041422aa09f235323b4a5aa3db817176

SHA256
0e902c5c8391f35729cfee22111cd6a5d9974ec25d38bd0bdf4981ca14ebc28c

SHA512
f6ab21f36bb04f53d1e084f5afcc899b3e966ae7eebd7ff1a0038e6f2a839c5bc20cc8195b65bfb93d671ef2c8428847a005acd0de4d69b0ae89843358536389

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exe

Filesize
560KB

MD5
e2c7d40ba3245029e62f638e16089723

SHA1
fe0b14fe28c4253e0bd09c584281cb2b53a62432

SHA256
d4dec21e5844e6252f1fcee1dcf1905bd483b87a8540acd9912d64c0b82961a1

SHA512
f821623ebf7dbb13c71e2fc388dea188bda09773ee8e9708a1a9082ff8384e50cf90b56752c4f0c557f8f266b55ec5339048f88d7616b632cd64c7446b4422b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nk2Rg5kr.exe

Filesize
560KB

MD5
e2c7d40ba3245029e62f638e16089723

SHA1
fe0b14fe28c4253e0bd09c584281cb2b53a62432

SHA256
d4dec21e5844e6252f1fcee1dcf1905bd483b87a8540acd9912d64c0b82961a1

SHA512
f821623ebf7dbb13c71e2fc388dea188bda09773ee8e9708a1a9082ff8384e50cf90b56752c4f0c557f8f266b55ec5339048f88d7616b632cd64c7446b4422b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exe

Filesize
1.0MB

MD5
0337f3deb946caf6178d99f587fc1e30

SHA1
da6fb18c6f37032f2e7605ea1a5fef11dcd81d91

SHA256
ef47b32b52b7842a8661cf03473b788a29dbc134618d88f6f749a7c991181945

SHA512
26ff7cbd9a31eeee496c5c5aacf0fd6ac662f40d29d87da66ad61a884c49a9018f578073e1f3e26cc01ab192e4a2971a035af5baf7e6323120fcc80f458720fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1dI10GX0.exe

Filesize
1.0MB

MD5
0337f3deb946caf6178d99f587fc1e30

SHA1
da6fb18c6f37032f2e7605ea1a5fef11dcd81d91

SHA256
ef47b32b52b7842a8661cf03473b788a29dbc134618d88f6f749a7c991181945

SHA512
26ff7cbd9a31eeee496c5c5aacf0fd6ac662f40d29d87da66ad61a884c49a9018f578073e1f3e26cc01ab192e4a2971a035af5baf7e6323120fcc80f458720fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe

Filesize
222KB

MD5
8dc096f1eae6d5b26a44a1efc24b77dc

SHA1
8039c322376dbe065ea6f74fb9a8d0f555bed69b

SHA256
d142e604422aa906057b8b23456e31e97b438798f35db8c7025991484cb15706

SHA512
8646732475606c04d8c5f0e272660b257b67a895f42720a3e35d7a4687cb94c270f14a20f6b7ac8ec8b33e3c65c6a6d28f8f492ecf60adc01f36424758ff9cf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2iI657iQ.exe

Filesize
222KB

MD5
8dc096f1eae6d5b26a44a1efc24b77dc

SHA1
8039c322376dbe065ea6f74fb9a8d0f555bed69b

SHA256
d142e604422aa906057b8b23456e31e97b438798f35db8c7025991484cb15706

SHA512
8646732475606c04d8c5f0e272660b257b67a895f42720a3e35d7a4687cb94c270f14a20f6b7ac8ec8b33e3c65c6a6d28f8f492ecf60adc01f36424758ff9cf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.5MB

MD5
d04b3ad7f47bdbd80c23a91436096fc6

SHA1
dfe98b3bbcac34e4f55d8e1f30503f1caba7f099

SHA256
994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757

SHA512
0777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
3.1MB

MD5
13dd37354f3096962dd08eec98d4c8df

SHA1
14feeccf9375d23fe0dbffe029be1de2a5ed4ad4

SHA256
48b46a25c614bd0acd9ac5bb05d3900e162ea0b66933eb9a51c264c3c76aa0f0

SHA512
c0e96569b9ac6948e7bb1ec150ab5237dd9086aabafbcb49347c111d77ccf3ae8af50168029004f33acecc5e468b812a6e2460482b24b05e9bafc7109980e6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
3.1MB

MD5
13dd37354f3096962dd08eec98d4c8df

SHA1
14feeccf9375d23fe0dbffe029be1de2a5ed4ad4

SHA256
48b46a25c614bd0acd9ac5bb05d3900e162ea0b66933eb9a51c264c3c76aa0f0

SHA512
c0e96569b9ac6948e7bb1ec150ab5237dd9086aabafbcb49347c111d77ccf3ae8af50168029004f33acecc5e468b812a6e2460482b24b05e9bafc7109980e6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qm1q3h2x.w45.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe

Filesize
307KB

MD5
b6d627dcf04d04889b1f01a14ec12405

SHA1
f7292c3d6f2003947cc5455b41df5f8fbd14df14

SHA256
9da10d7b75c589f06f1758ed8e3c0335b9a738d0ad1317c48e380bca768bdddf

SHA512
1eef46fcb568049edad6a6dac0ce6532185f15d2b4f9939853226a4f24e0732f637951c98f580efdb98ef396d3f4d9846bccffa22c0309b455432c98292af937

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-703AL.tmp\LzmwAqmV.tmp

Filesize
765KB

MD5
341906c92fadb3f43dfdbbf75672e2ad

SHA1
01e846f2371b38783213847406b65da7b578067f

SHA256
730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

SHA512
b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-703AL.tmp\LzmwAqmV.tmp

Filesize
765KB

MD5
341906c92fadb3f43dfdbbf75672e2ad

SHA1
01e846f2371b38783213847406b65da7b578067f

SHA256
730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

SHA512
b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe

Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe

Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC57F.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC5D3.tmp

Filesize
92KB

MD5
5be96e311859379e2bf53d4ca9b3292c

SHA1
7da91b40529fcba8bc68442aa06ea9491fdbb824

SHA256
c46a65bf3fc90038a2d876d103dbe658259594e90fddc223951cddb9ac9af99c

SHA512
a39d3c2c45deb0509ffeab971b096a90748f0fa6e3f1bacea6f8c9dfcae985ad1b45d5d48306ce06d065e92063e8156fea44c0a87e9ca99bae6838fd53edb057

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC65C.tmp

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
a5b509a3fb95cc3c8d89cd39fc2a30fb

SHA1
5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

SHA256
5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

SHA512
3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

Download Submit
C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dll

Filesize
102KB

MD5
ceffd8c6661b875b67ca5e4540950d8b

SHA1
91b53b79c98f22d0b8e204e11671d78efca48682

SHA256
da0bf5520986c2fb92fa9658ee2fcbb07ee531e09f901f299722c0d14e994ed2

SHA512
6f78e3479c7b80cee0c2cea33a5b3e06c65b3e85a558f2df4b72211f714b81a2549daed0bc7ffe1456867b447ede9caeec73a6c4d2b345aad664d501212d07d4

Download Submit
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll

Filesize
1.1MB

MD5
1c27631e70908879e1a5a8f3686e0d46

SHA1
31da82b122b08bb2b1e6d0c904993d6d599dc93a

SHA256
478aa272d465eaa49c2f12fc141af2c0581f569ccf67f628747d90cc03a1e6a9

SHA512
7230ccad5e910f4f1aafb26642670c227a5d6e30f9c3de9a111e9c471651e54e352c56f34093667e6a51e78d01f3271c5e9d3248de5e1e82ae0e5d2aaea977dd

Download Submit
C:\Users\Admin\AppData\Roaming\chcfrbr

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Roaming\grcfrbr

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
9879861f3899a47f923cb13ca048dcc1

SHA1
2c24fd7dec7e0c69b35a9c75d59c7c3db51f7980

SHA256
9f7ffdf942954fc527e1b68b996f3ed6ebbb4bd5a8e0ab9387167cd5fae47513

SHA512
6f51d51eaa653c7ec92de89baaeb402fb33ced558df060e3075498047a75e32396aa00d3bcc89f3cd4d4378ece96d75a54b7d9f4f6aaf459356325434698caa6

Download Submit
\Users\Admin\AppData\Local\Temp\is-1FH9F.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/220-257-0x0000019A9B6A0000-0x0000019A9B6C0000-memory.dmp

Filesize
128KB

Download
memory/2208-80-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-164-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-208-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-70-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/3000-144-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-196-0x0000000008910000-0x000000000892E000-memory.dmp

Filesize
120KB

Download
memory/3000-304-0x0000000000B60000-0x0000000000BB0000-memory.dmp

Filesize
320KB

Download
memory/3000-311-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-139-0x0000000000580000-0x00000000005DA000-memory.dmp

Filesize
360KB

Download
memory/3000-202-0x0000000008C00000-0x000000000912C000-memory.dmp

Filesize
5.2MB

Download
memory/3000-201-0x0000000008A30000-0x0000000008BF2000-memory.dmp

Filesize
1.8MB

Download
memory/3000-301-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3000-194-0x0000000008870000-0x00000000088E6000-memory.dmp

Filesize
472KB

Download
memory/3000-138-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/3000-352-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/3000-152-0x0000000007FC0000-0x0000000008026000-memory.dmp

Filesize
408KB

Download
memory/3000-148-0x00000000074E0000-0x00000000074F0000-memory.dmp

Filesize
64KB

Download
memory/3308-4-0x0000000000EF0000-0x0000000000F06000-memory.dmp

Filesize
88KB

Download
memory/3324-132-0x000001EEEE610000-0x000001EEEE612000-memory.dmp

Filesize
8KB

Download
memory/3324-95-0x000001EEEE680000-0x000001EEEE690000-memory.dmp

Filesize
64KB

Download
memory/3324-67-0x000001EEEDE20000-0x000001EEEDE30000-memory.dmp

Filesize
64KB

Download
memory/3788-793-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/3788-575-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/3796-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3796-5-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3796-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3920-87-0x0000000007BF0000-0x00000000080EE000-memory.dmp

Filesize
5.0MB

Download
memory/3920-213-0x0000000007780000-0x0000000007790000-memory.dmp

Filesize
64KB

Download
memory/3920-125-0x0000000007780000-0x0000000007790000-memory.dmp

Filesize
64KB

Download
memory/3920-128-0x0000000007760000-0x000000000776A000-memory.dmp

Filesize
40KB

Download
memory/3920-72-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/3920-77-0x0000000000A00000-0x0000000000A3E000-memory.dmp

Filesize
248KB

Download
memory/3920-143-0x0000000007AC0000-0x0000000007BCA000-memory.dmp

Filesize
1.0MB

Download
memory/3920-90-0x0000000007790000-0x0000000007822000-memory.dmp

Filesize
584KB

Download
memory/3920-163-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/4116-489-0x0000028275330000-0x0000028275332000-memory.dmp

Filesize
8KB

Download
memory/4116-484-0x00000282750D0000-0x00000282750D2000-memory.dmp

Filesize
8KB

Download
memory/4116-480-0x0000028275090000-0x0000028275092000-memory.dmp

Filesize
8KB

Download
memory/4116-472-0x0000028275060000-0x0000028275062000-memory.dmp

Filesize
8KB

Download
memory/4116-463-0x0000028275280000-0x0000028275282000-memory.dmp

Filesize
8KB

Download
memory/4116-455-0x00000282750F0000-0x00000282750F2000-memory.dmp

Filesize
8KB

Download
memory/4116-448-0x0000028275040000-0x0000028275042000-memory.dmp

Filesize
8KB

Download
memory/4116-443-0x0000028275020000-0x0000028275022000-memory.dmp

Filesize
8KB

Download
memory/4116-407-0x0000028273640000-0x0000028273660000-memory.dmp

Filesize
128KB

Download
memory/4116-410-0x0000028274C90000-0x0000028274D90000-memory.dmp

Filesize
1024KB

Download
memory/4720-118-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4720-115-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4796-647-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5024-121-0x0000000000180000-0x00000000001BE000-memory.dmp

Filesize
248KB

Download
memory/5024-145-0x0000000007150000-0x0000000007162000-memory.dmp

Filesize
72KB

Download
memory/5024-147-0x00000000071F0000-0x000000000723B000-memory.dmp

Filesize
300KB

Download
memory/5024-211-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/5024-146-0x00000000071B0000-0x00000000071EE000-memory.dmp

Filesize
248KB

Download
memory/5024-120-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/5024-137-0x0000000007E30000-0x0000000008436000-memory.dmp

Filesize
6.0MB

Download
memory/5080-632-0x0000021CFF3C0000-0x0000021CFF3E0000-memory.dmp

Filesize
128KB

Download
memory/5196-696-0x0000026030AB0000-0x0000026030BB0000-memory.dmp

Filesize
1024KB

Download
memory/5196-655-0x000002602E9D0000-0x000002602E9F0000-memory.dmp

Filesize
128KB

Download
memory/5248-948-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/5512-449-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/5512-451-0x0000000000EB0000-0x0000000001B30000-memory.dmp

Filesize
12.5MB

Download
memory/5512-584-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/5568-945-0x0000000002A10000-0x0000000002E0C000-memory.dmp

Filesize
4.0MB

Download
memory/5568-689-0x0000000002F10000-0x00000000037FB000-memory.dmp

Filesize
8.9MB

Download
memory/5568-784-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/5568-654-0x0000000002A10000-0x0000000002E0C000-memory.dmp

Filesize
4.0MB

Download
memory/5776-622-0x00007FF80A4E0000-0x00007FF80AECC000-memory.dmp

Filesize
9.9MB

Download
memory/5776-530-0x0000000000B50000-0x0000000000B58000-memory.dmp

Filesize
32KB

Download
memory/5776-581-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/5776-565-0x00007FF80A4E0000-0x00007FF80AECC000-memory.dmp

Filesize
9.9MB

Download
memory/5844-628-0x00000000050E0000-0x000000000517C000-memory.dmp

Filesize
624KB

Download
memory/5844-623-0x0000000000480000-0x0000000000860000-memory.dmp

Filesize
3.9MB

Download
memory/5844-928-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/5844-624-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/5904-612-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5904-918-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/6008-730-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

Filesize
1024KB

Download
memory/6008-770-0x0000000000900000-0x0000000000909000-memory.dmp

Filesize
36KB

Download
memory/6424-804-0x0000000072730000-0x0000000072E1E000-memory.dmp

Filesize
6.9MB

Download
memory/6424-923-0x0000000002890000-0x00000000028A0000-memory.dmp

Filesize
64KB

Download
memory/6424-799-0x00000000004C0000-0x00000000004DE000-memory.dmp

Filesize
120KB

Download
memory/6552-792-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/6712-788-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6872-798-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/6872-797-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download