amadey | b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b

Analysis

max time kernel
52s
max time network
155s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
03/11/2023, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe
Size

892KB
MD5

06cd9405b8efc3e476d281acce2d93b7
SHA1

1870834e581c69c2acff4eae0fc260d87d9b4457
SHA256

b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b
SHA512

c6ce823e09628c6e8e743d81c833688a4fa09e54a4918d5f2fb76554b521a56d36f789da0239ed65802496dff05afa0e9d98e094ef423d0ffced16ac0b5cf1aa
SSDEEP

12288:4rB5eeKmdYPenb2U7vqx0T+vFEnrv9TpxfoxhOuuSVKcwJ:iBK+YPenb2U7vqevnrvPFk

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

plost

77.91.124.86:19084

Extracted

Family

redline

Botnet

kedru

77.91.124.86:19084

Extracted

Family

redline

Botnet

pixelnew2.0

194.49.94.11:80

Extracted

Family

redline

Botnet

@ytlogsbot

194.169.175.235:42691

Extracted

Family

smokeloader

Botnet

up3

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Detected google phishing page
phishing google
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 2 IoCs

resource	yara_rule
behavioral1/memory/5636-821-0x0000000002DB0000-0x000000000369B000-memory.dmp	family_glupteba
behavioral1/memory/5636-827-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 13 IoCs

resource	yara_rule
behavioral1/files/0x000800000001ab9e-60.dat	family_redline
behavioral1/files/0x000800000001ab9e-61.dat	family_redline
behavioral1/memory/4192-64-0x0000000000520000-0x000000000055C000-memory.dmp	family_redline
behavioral1/files/0x000600000001ac03-75.dat	family_redline
behavioral1/files/0x000600000001ac03-73.dat	family_redline
behavioral1/memory/3520-81-0x0000000000470000-0x00000000004AC000-memory.dmp	family_redline
behavioral1/memory/5480-528-0x00000000020E0000-0x000000000213A000-memory.dmp	family_redline
behavioral1/memory/5480-526-0x0000000000400000-0x0000000000480000-memory.dmp	family_redline
behavioral1/files/0x000700000001acd2-573.dat	family_redline
behavioral1/memory/5724-574-0x0000000000800000-0x000000000083E000-memory.dmp	family_redline
behavioral1/memory/6024-581-0x0000000000D30000-0x0000000000D4E000-memory.dmp	family_redline
behavioral1/files/0x000700000001acd2-580.dat	family_redline
behavioral1/memory/5724-781-0x0000000000400000-0x0000000000461000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000700000001acd2-573.dat	family_sectoprat
behavioral1/memory/6024-581-0x0000000000D30000-0x0000000000D4E000-memory.dmp	family_sectoprat
behavioral1/files/0x000700000001acd2-580.dat	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
6116	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 22 IoCs

pid	Process
528	1623.exe
2092	xJ7Mv1cr.exe
3400	pk7RT2tq.exe
2100	mr5tG8PB.exe
3320	1903.exe
5092	HU7WF9zq.exe
4628	1md47NB5.exe
4192	1A6C.exe
3520	2Rt830py.exe
5784	rundll32.exe
5480	614A.exe
5868	InstallSetup5.exe
4104	toolspub2.exe
5288	Broom.exe
5636	31839b57a4f11171d6abc8bbc4451ee4.exe
5604	kos4.exe
5724	69A8.exe
6016	latestX.exe
6024	6FA4.exe
5416	7A34.exe
6172	LzmwAqmV.exe
6308	is-PE0R5.tmp

Loads dropped DLL 5 IoCs

pid	Process
5480	614A.exe
5480	614A.exe
5724	69A8.exe
5724	69A8.exe
6308	is-PE0R5.tmp

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	mr5tG8PB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	HU7WF9zq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1623.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	xJ7Mv1cr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	pk7RT2tq.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4392 set thread context of 968	4392	b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe	71
PID 4628 set thread context of 4288	4628	1md47NB5.exe	83

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3560	sc.exe
596	sc.exe
6468	sc.exe
6220	sc.exe
1796	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4212	4288	WerFault.exe	83
6140	5480	WerFault.exe	100
5696	5724	WerFault.exe	108

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
7000	schtasks.exe
7020	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7cf4ee210f0eda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3d3e5a220f0eda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f9637d200f0eda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\steampowered.com\NumberOfSubd = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 85b92e280f0eda01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f4c760200f0eda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1534848907-968546671-3000393597-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\steampowered.com\ = "0"	MicrosoftEdgeCP.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
968	AppLaunch.exe
968	AppLaunch.exe
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found
3336	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3336	Process not Found

Suspicious behavior: MapViewOfSection 13 IoCs

pid	Process
968	AppLaunch.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeDebugPrivilege	3960	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3960	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3960	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3960	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeDebugPrivilege	5604	kos4.exe
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeDebugPrivilege	6024	6FA4.exe
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found
Token: SeShutdownPrivilege	3336	Process not Found
Token: SeCreatePagefilePrivilege	3336	Process not Found

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2716	MicrosoftEdge.exe
3108	MicrosoftEdgeCP.exe
3960	MicrosoftEdgeCP.exe
3108	MicrosoftEdgeCP.exe
5288	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 968	4392	b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe	71
PID 4392 wrote to memory of 968	4392	b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe	71
PID 4392 wrote to memory of 968	4392	b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe	71
PID 4392 wrote to memory of 968	4392	b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe	71
PID 4392 wrote to memory of 968	4392	b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe	71
PID 4392 wrote to memory of 968	4392	b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe	71
PID 3336 wrote to memory of 528	3336	Process not Found	72
PID 3336 wrote to memory of 528	3336	Process not Found	72
PID 3336 wrote to memory of 528	3336	Process not Found	72
PID 528 wrote to memory of 2092	528	1623.exe	73
PID 528 wrote to memory of 2092	528	1623.exe	73
PID 528 wrote to memory of 2092	528	1623.exe	73
PID 2092 wrote to memory of 3400	2092	xJ7Mv1cr.exe	74
PID 2092 wrote to memory of 3400	2092	xJ7Mv1cr.exe	74
PID 2092 wrote to memory of 3400	2092	xJ7Mv1cr.exe	74
PID 3336 wrote to memory of 3008	3336	Process not Found	75
PID 3336 wrote to memory of 3008	3336	Process not Found	75
PID 3400 wrote to memory of 2100	3400	pk7RT2tq.exe	77
PID 3400 wrote to memory of 2100	3400	pk7RT2tq.exe	77
PID 3400 wrote to memory of 2100	3400	pk7RT2tq.exe	77
PID 3336 wrote to memory of 3320	3336	Process not Found	78
PID 3336 wrote to memory of 3320	3336	Process not Found	78
PID 3336 wrote to memory of 3320	3336	Process not Found	78
PID 2100 wrote to memory of 5092	2100	mr5tG8PB.exe	79
PID 2100 wrote to memory of 5092	2100	mr5tG8PB.exe	79
PID 2100 wrote to memory of 5092	2100	mr5tG8PB.exe	79
PID 5092 wrote to memory of 4628	5092	HU7WF9zq.exe	80
PID 5092 wrote to memory of 4628	5092	HU7WF9zq.exe	80
PID 5092 wrote to memory of 4628	5092	HU7WF9zq.exe	80
PID 3336 wrote to memory of 4192	3336	Process not Found	81
PID 3336 wrote to memory of 4192	3336	Process not Found	81
PID 3336 wrote to memory of 4192	3336	Process not Found	81
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 4628 wrote to memory of 4288	4628	1md47NB5.exe	83
PID 5092 wrote to memory of 3520	5092	HU7WF9zq.exe	85
PID 5092 wrote to memory of 3520	5092	HU7WF9zq.exe	85
PID 5092 wrote to memory of 3520	5092	HU7WF9zq.exe	85
PID 3108 wrote to memory of 2988	3108	MicrosoftEdgeCP.exe	90
PID 3108 wrote to memory of 2988	3108	MicrosoftEdgeCP.exe	90
PID 3108 wrote to memory of 2988	3108	MicrosoftEdgeCP.exe	90
PID 3336 wrote to memory of 5784	3336	Process not Found	132
PID 3336 wrote to memory of 5784	3336	Process not Found	132
PID 3336 wrote to memory of 5784	3336	Process not Found	132
PID 3108 wrote to memory of 4580	3108	MicrosoftEdgeCP.exe	93
PID 3336 wrote to memory of 5480	3336	Process not Found	100
PID 3336 wrote to memory of 5480	3336	Process not Found	100
PID 3336 wrote to memory of 5480	3336	Process not Found	100
PID 3108 wrote to memory of 4580	3108	MicrosoftEdgeCP.exe	93
PID 5784 wrote to memory of 5868	5784	rundll32.exe	102
PID 5784 wrote to memory of 5868	5784	rundll32.exe	102
PID 5784 wrote to memory of 5868	5784	rundll32.exe	102
PID 5784 wrote to memory of 4104	5784	rundll32.exe	110
PID 5784 wrote to memory of 4104	5784	rundll32.exe	110
PID 5784 wrote to memory of 4104	5784	rundll32.exe	110
PID 5868 wrote to memory of 5288	5868	InstallSetup5.exe	103
PID 5868 wrote to memory of 5288	5868	InstallSetup5.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe
"C:\Users\Admin\AppData\Local\Temp\b2a2674f56d4bce1f6576bfed878c7435e068bb6e06e1f7909fbbe5b4be9470b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:968

C:\Users\Admin\AppData\Local\Temp\1623.exe
C:\Users\Admin\AppData\Local\Temp\1623.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xJ7Mv1cr.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xJ7Mv1cr.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pk7RT2tq.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pk7RT2tq.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mr5tG8PB.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mr5tG8PB.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HU7WF9zq.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HU7WF9zq.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1md47NB5.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1md47NB5.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 568
        8⤵
        Program crash
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Rt830py.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Rt830py.exe
        6⤵
        Executes dropped EXE
        
        PID:3520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\17AB.bat" "
1⤵
- Checks computer location settings
PID:3008

C:\Users\Admin\AppData\Local\Temp\1903.exe
C:\Users\Admin\AppData\Local\Temp\1903.exe
1⤵
- Executes dropped EXE
PID:3320

C:\Users\Admin\AppData\Local\Temp\1A6C.exe
C:\Users\Admin\AppData\Local\Temp\1A6C.exe
1⤵
- Executes dropped EXE
PID:4192

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3056

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:316

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2536

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2796

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3860

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5248

C:\Users\Admin\AppData\Local\Temp\5330.exe
C:\Users\Admin\AppData\Local\Temp\5330.exe
1⤵
PID:5784
- C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Broom.exe
    C:\Users\Admin\AppData\Local\Temp\Broom.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5288
- C:\Users\Admin\AppData\Local\Temp\kos4.exe
  "C:\Users\Admin\AppData\Local\Temp\kos4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5604
- - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
    "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
    3⤵
    - Executes dropped EXE
    PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\is-V5HAP.tmp\is-PE0R5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-V5HAP.tmp\is-PE0R5.tmp" /SL4 $1056C "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe" 5313270 114176
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6308
    - - C:\Program Files (x86)\IBuster\IBuster.exe
        
        "C:\Program Files (x86)\IBuster\IBuster.exe" -i
        5⤵
        
        PID:6812
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 3
        5⤵
        
        PID:6800
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 3
        6⤵
        
        PID:7120
    - - C:\Program Files (x86)\IBuster\IBuster.exe
        
        "C:\Program Files (x86)\IBuster\IBuster.exe" -s
        5⤵
        
        PID:7084
- C:\Users\Admin\AppData\Local\Temp\latestX.exe
  "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
  2⤵
  - Executes dropped EXE
  PID:6016
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  - Executes dropped EXE
  PID:5636
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:6364
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:2484
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:6076
  - - C:\Windows\System32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:6444
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:6116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:7164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:6480
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:5236
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5884
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:7000
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:6304
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:6540
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:6612
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:6496
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    PID:6188

C:\Users\Admin\AppData\Local\Temp\614A.exe
C:\Users\Admin\AppData\Local\Temp\614A.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 888
  2⤵
  - Program crash
  PID:6140

C:\Users\Admin\AppData\Local\Temp\69A8.exe
C:\Users\Admin\AppData\Local\Temp\69A8.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5724 -s 888
  2⤵
  - Program crash
  PID:5696

C:\Users\Admin\AppData\Local\Temp\6FA4.exe
C:\Users\Admin\AppData\Local\Temp\6FA4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6024

C:\Users\Admin\AppData\Local\Temp\7A34.exe
C:\Users\Admin\AppData\Local\Temp\7A34.exe
1⤵
- Executes dropped EXE
PID:5416
- C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
  "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"
  2⤵
  PID:6680
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:7020
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit
    3⤵
    PID:7052
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:6804
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "Utsysc.exe" /P "Admin:N"
      4⤵
      PID:6496
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "Utsysc.exe" /P "Admin:R" /E
      4⤵
      PID:6268
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:6568
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\e8b5234212" /P "Admin:N"
      4⤵
      PID:6720
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\e8b5234212" /P "Admin:R" /E
      4⤵
      PID:6916
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
      4⤵
      PID:6240
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:6548
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main
    3⤵
    PID:7068

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5304

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:2708

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6500

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
1⤵
PID:5400

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6420

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7024

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
1⤵
PID:5080
- C:\Windows\System32\sc.exe
  sc stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3560
- C:\Windows\System32\sc.exe
  sc stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:596
- C:\Windows\System32\sc.exe
  sc stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6468
- C:\Windows\System32\sc.exe
  sc stop bits
  2⤵
  - Launches sc.exe
  PID:6220
- C:\Windows\System32\sc.exe
  sc stop dosvc
  2⤵
  - Launches sc.exe
  PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
1⤵
PID:3820

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
1⤵
PID:6892
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-ac 0
  2⤵
  PID:4508
- C:\Windows\System32\powercfg.exe
  powercfg /x -hibernate-timeout-dc 0
  2⤵
  PID:6184
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-ac 0
  2⤵
  PID:1796
- C:\Windows\System32\powercfg.exe
  powercfg /x -standby-timeout-dc 0
  2⤵
  PID:6476

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:7136

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
1⤵
PID:6724

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:5096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3316

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6736

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:1404

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6532

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
1⤵
PID:7096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
1⤵
PID:6740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\IBuster\IBuster.exe

Filesize
4.0MB

MD5
2201dd96559c44b5bcf419182b45800f

SHA1
b16585f3f8e5fc8c405e52f6768ede855272ccc3

SHA256
1318ef1ca3ccb22b793a427a90b18fc65d3a9d1bdb853bbc3ad0e6f2369e8396

SHA512
0f13efce28d18233c41e9dd5d308356f651d32257bf26948d0354dbe8e20f815e5e276c13765308a75db4f164ddd1a07775e1eafef1e104db6e6f48a7e299921

Download Submit
C:\Program Files (x86)\IBuster\IBuster.exe

Filesize
4.0MB

MD5
2201dd96559c44b5bcf419182b45800f

SHA1
b16585f3f8e5fc8c405e52f6768ede855272ccc3

SHA256
1318ef1ca3ccb22b793a427a90b18fc65d3a9d1bdb853bbc3ad0e6f2369e8396

SHA512
0f13efce28d18233c41e9dd5d308356f651d32257bf26948d0354dbe8e20f815e5e276c13765308a75db4f164ddd1a07775e1eafef1e104db6e6f48a7e299921

Download Submit
C:\ProgramData\CoreArchive\CoreArchive.exe

Filesize
4.0MB

MD5
2201dd96559c44b5bcf419182b45800f

SHA1
b16585f3f8e5fc8c405e52f6768ede855272ccc3

SHA256
1318ef1ca3ccb22b793a427a90b18fc65d3a9d1bdb853bbc3ad0e6f2369e8396

SHA512
0f13efce28d18233c41e9dd5d308356f651d32257bf26948d0354dbe8e20f815e5e276c13765308a75db4f164ddd1a07775e1eafef1e104db6e6f48a7e299921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F01CY8GP\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DL30P5X\chunk~f036ce556[1].css

Filesize
34KB

MD5
19a9c503e4f9eabd0eafd6773ab082c0

SHA1
d9b0ca3905ab9a0f9ea976d32a00abb7935d9913

SHA256
7ba0cc7d66172829eef8ff773c1e9c6e2fde3cfd82d9a89e1a71751957e47b0a

SHA512
0145582e8eb3adb98ad2dbc0b8e7a29c1d0525f0fd515fcf82eda7b4ce2f7f7f6aa0e81912aa98927e6d420ed110eb497c287a0ad483f8af067332920d4bde83

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DL30P5X\shared_global[1].css

Filesize
84KB

MD5
15dd9a8ffcda0554150891ba63d20d76

SHA1
bdb7de4df9a42a684fa2671516c10a5995668f85

SHA256
6f42b906118e3b3aebcc1a31c162520c95e3b649146a02efd3a0fd8fcddebb21

SHA512
2ceeb8b83590fc35e83576fe8058ddf0e7a942960b0564e9867b45677c665ac20e19c25a7a6a8d5115b60ab33b80104ea492e872cc784b424b105cc049b217e9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DL30P5X\shared_global[1].js

Filesize
149KB

MD5
dcf6f57f660ba7bf3c0de14c2f66174d

SHA1
ce084fcb16eec54ad5c4869a5d0d0c2afb4ba355

SHA256
7631736851bd8c45de3fc558156213fca631f221507ca5b48893dbe89ed3448e

SHA512
801dedc67ed9f7e0828f4340d228e26d5af32b288dc66d0a3e8d9f94f46e4b64e93b01f319a6de50fa83b2690220d07815e458a4d9941dc0099cbe45529fd86b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\2DL30P5X\tooltip[1].js

Filesize
15KB

MD5
72938851e7c2ef7b63299eba0c6752cb

SHA1
b75196bd3a6f9f4dfc1bbf5e43e96874bcd9ce4e

SHA256
e2d4e0e1d3e162fdc815f16dfff9ae9b0a967949f0f3ae371f947d730a3f0661

SHA512
2bb6c03a1335ef9514d0d172a4284d82a29d1783a72306bdcb8af3185d5cd2ff16303355aa4b05086d2fa0b5b7c7159cfa67de4a6175095ff0e68adec2a56ac1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q73N4PD5\buttons[1].css

Filesize
32KB

MD5
b91ff88510ff1d496714c07ea3f1ea20

SHA1
9c4b0ad541328d67a8cde137df3875d824891e41

SHA256
0be99fd30134de50d457729cebd0e08342777af747caf503108178cb4c375085

SHA512
e82438186bfc3e9ca690af8e099aafbfbc71c9310f9d1c8cb87ffa9e7f0f11f33982c63a2dac95c9b83fef1aaa59178b73212fc76e895d13a1ffbbe3c1adfa4c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q73N4PD5\fb[1].js

Filesize
63KB

MD5
ec6ea67601ec9c1a200df44f5adb0f09

SHA1
d3e773ab7c4633406ef97f202d1a1e94067b2f58

SHA256
b3ef5ca0d84ab27a5dce2d14e326cfa6109cb7905ebd38b11a6ae51fab450504

SHA512
442649bc816acc030a1621cbd537fd51b28b74323d6ff2af94a219ddad8224a8033c83694d2d7552c40823dbaf87ae95ac6ca23a70be5bbf72df44f5e9d29e66

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q73N4PD5\hcaptcha[1].js

Filesize
323KB

MD5
637dbb109a349e8c29fcfc615d0d518d

SHA1
e9cbf1be4e5349f9db492d0db15f3b1dc0d2bbe5

SHA256
ac4a01c00dee8ff20e6ebd5eae9d4da5b6e4af5dd649474d38d0a807b508c4da

SHA512
8d0b516264066d4d644e28cf69ad14be3ea31ad36800677fb5f8676712a33670130ba1704c8e5110171406c5365ac8c047de66c26c383979f44237088376a3c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q73N4PD5\recaptcha__en[1].js

Filesize
461KB

MD5
4efc45f285352a5b252b651160e1ced9

SHA1
c7ba19e7058ec22c8d0f7283ab6b722bb7a135d7

SHA256
253627a82794506a7d660ee232c06a88d2eaafb6174532f8c390bb69ade6636a

SHA512
cfc7aae449b15a8b84f117844547f7a5c2f2dd4a79e8b543305ae83b79195c5a6f6d0ccf6f2888c665002b125d9569cd5c0842fdd2f61d2a2848091776263a39

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q73N4PD5\shared_responsive[1].css

Filesize
18KB

MD5
2ab2918d06c27cd874de4857d3558626

SHA1
363be3b96ec2d4430f6d578168c68286cb54b465

SHA256
4afb3e37bfdd549cc16ef5321faf3f0a3bf6e84c79fc4408bc6f157280636453

SHA512
3af59e0b16ef9d39c2f1c5ccdbd5c9ea35bd78571fde1b5bf01e51a675d5554e03225a2d7c04ed67e22569e9f43b16788105a0bf591ebba28ef917c961cc59e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\Q73N4PD5\shared_responsive_adapter[1].js

Filesize
24KB

MD5
a52bc800ab6e9df5a05a5153eea29ffb

SHA1
8661643fcbc7498dd7317d100ec62d1c1c6886ff

SHA256
57cfaf9b92c98541f769090cd0229a30013cea7cfafc18519ca654bfae29e14e

SHA512
1bcacd0ec7c3d633d6296fff3325802d6352805f0d2cf1eea39237424229ecffad6cb2aee4248e28b1eca02ff0646b58240851a246bbcf0aa1083830d5d9081e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\OG0WKPG6\www.epicgames[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\PFQ30G08\www.paypal[1].xml

Filesize
17B

MD5
3ff4d575d1d04c3b54f67a6310f2fc95

SHA1
1308937c1a46e6c331d5456bcd4b2182dc444040

SHA256
021a5868b6c9e8beba07848ba30586c693f87ac02ee2ccaa0f26b7163c0c6b44

SHA512
2b26501c4bf86ed66e941735c49ac445d683ad49ed94c5d87cc96228081ae2c8f4a8f44a2a5276b9f4b0962decfce6b9eeee38e42262ce8d865d5df0df7ec3d6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3X0Z6DT5\epic-favicon-96x96[1].png

Filesize
5KB

MD5
c94a0e93b5daa0eec052b89000774086

SHA1
cb4acc8cfedd95353aa8defde0a82b100ab27f72

SHA256
3f51f3fb508f0d0361b722345974969576daef2c7d3db8f97c4ca8e1ff1a1775

SHA512
f676705e63f89d76520637b788f3bac96d177d1be7f9762aeb8d5d1554afd7666cbd6ef22ce08f581eb59bd383dd1971896231264bc3eaabf21135c967930240

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3X0Z6DT5\favicon[1].ico

Filesize
1KB

MD5
630d203cdeba06df4c0e289c8c8094f6

SHA1
eee14e8a36b0512c12ba26c0516b4553618dea36

SHA256
bbce71345828a27c5572637dbe88a3dd1e065266066600c8a841985588bf2902

SHA512
09f4e204960f4717848bf970ac4305f10201115e45dd5fe0196a6346628f0011e7bc17d73ec946b68731a5e179108fd39958cecf41125f44094f63fe5f2aeb2c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\3X0Z6DT5\favicon[2].ico

Filesize
37KB

MD5
231913fdebabcbe65f4b0052372bde56

SHA1
553909d080e4f210b64dc73292f3a111d5a0781f

SHA256
9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

SHA512
7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\MYO2Z55L\pp_favicon_x[1].ico

Filesize
5KB

MD5
e1528b5176081f0ed963ec8397bc8fd3

SHA1
ff60afd001e924511e9b6f12c57b6bf26821fc1e

SHA256
1690c4e20869c3763b7fc111e2f94035b0a7ee830311dd680ac91421daad3667

SHA512
acf71864e2844907752901eeeaf5c5648d9f6acf3b73a2fb91e580bee67a04ffe83bc2c984a9464732123bc43a3594007691653271ba94f95f7e1179f4146212

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XK28DGHQ\B8BxsscfVBr[1].ico

Filesize
1KB

MD5
e508eca3eafcc1fc2d7f19bafb29e06b

SHA1
a62fc3c2a027870d99aedc241e7d5babba9a891f

SHA256
e6d1d77403cd9f14fd2377d07e84350cfe768e3353e402bf42ebdc8593a58c9a

SHA512
49e3f31fd73e52ba274db9c7d306cc188e09c3ae683827f420fbb17534d197a503460e7ec2f1af46065f8d0b33f37400659bfa2ae165e502f97a8150e184a38c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XK28DGHQ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\ImageStore\e3q0n0q\imagestore.dat

Filesize
48KB

MD5
6f51c2beb0b4dbe56754164205f27ed6

SHA1
3cd360e9619e44d7c213bfa3a9b2797c80f6d013

SHA256
3b0d07c58a782dd3d7ade718598eb99accd996803fdceac889f097e89a7ebf54

SHA512
583f7de4fb1971b976f753e21a30b109638a9380a32fe0a127409376605966f52e6fa4a8b494e939f1b3bda155858dc96fbabe083a64766f0a159255abe1442f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\2BQ262TW.cookie

Filesize
851B

MD5
80bcf4a64b67573c0f422d5ec870dfd8

SHA1
db0ee43f612240b00d69c9e4465d0591b23dcbb2

SHA256
4109c0444694fefd218631cdceee8e812a3956e83734c0db5be2439d22f2a1df

SHA512
5fcca9da8c5f305abb2f05ce43782ea688824a650c51aff7d8b9cef432b9b575b49cbd31d5d74f39e1f0397f32d6e94ddbe1c6b7e33384196284b8f7416cb145

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\93848EK6.cookie

Filesize
94B

MD5
41239f5027416e0ac160ed8465c9fbe2

SHA1
2f8848f443c172ddd5c7f5120ce3a75f03e8cf9c

SHA256
48f5cfef8444f2583c2c55ce4fca02d9c9b268f643a16c873cf2caeba8311429

SHA512
f148ddc4fcf3ad0e3d6b25ac2df83c6b69a0cc8e7babe958c185d3cbcf5ad866c6a69ee6a9070221283b01eb8731faa439af5619d278b6a5bca65b13a4c0ac3d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\LRJ64OVO.cookie

Filesize
91B

MD5
9ddaeed5494a9adcf8bd0ee73dfec2c1

SHA1
449554876193bf2bd8cfa9d86b7e1e0e6d6cbd98

SHA256
e62ed6b1b04bf5dce4d5537bc553376d22cf3e7483a5b76751458bc83b049c21

SHA512
b051118d8eaa1a90551d2e9341f3a71965e8137d968f3f9f036b3b4a993d78e01c90d16bfc33d784dcdb2b70963f35889543a5ed32498c8da0ea5d7b8b90cccb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\NAU398DO.cookie

Filesize
260B

MD5
89e99c550a31e36f9f9b11901f4d839e

SHA1
30597b8363e82c928bc90eaca6dfafaf25a3dc5a

SHA256
3b03a4bb93503caffdefd7ee326598bed07212de64fe5700db90d6b9b8ebc86b

SHA512
3ec96873810cada21a23d8b9af05ee7cffb07a82486c0c9f5517f1a5e41b1421292ab801645189fd15f794573b92de49c618d2c1cfe7f99f0585aa0d13567327

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
20124c9d7b60e11cb56e74cd79463e60

SHA1
dcd0538e962c617467c50534dc4c4d03ffd685c3

SHA256
05fc27c91932efdb7fd891548a3f648250fadb97653d143c62a0f92bc94057b6

SHA512
e6c73afa8f4dfa05c0df7d631fb6836672e5d46cf982734a0c71d5a857b0aacd7559ad23654587dfc7e835bf4399bd1b6feb3a139a39d3e6f46467437d8a5bf6

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
1KB

MD5
045ea4f79192167bbd138e879e2f18ea

SHA1
799c175423bb8f24be61914be961101738865d75

SHA256
2434b103594bf394105a763f43f40c204f5c5d8ed909aa4e3c6e09297f2b1524

SHA512
e087fe11bd280f878674a320c3b01faac5359255359d6a2511c4f4db65e88eca4f9ec8f00fedb6e6b0cea3de1bb159431e9b36c27bcf46d0becc43c86e333a8f

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
ac89a852c2aaa3d389b2d2dd312ad367

SHA1
8f421dd6493c61dbda6b839e2debb7b50a20c930

SHA256
0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

SHA512
c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
cd65ab5ef002bd55af9f11785dd4feb1

SHA1
7cf1339bfba069f36820a3832c5e651585492f23

SHA256
2d31e6fa45e597d6799e7c6fad7370578b234ebef1f9393cc22580111820cffa

SHA512
395ec08f2e802142fb5de724eec0ca55a673bb68a875e39df54eb49bb592c4642c2feaab7771e5449e92837d79066551acac4b039459712eb800decd358dba52

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
0d86340c79ec5a2b30ad0cf504d9ad1f

SHA1
d09d796d0001794dee6e78ae615fa25b49b22bda

SHA256
34f1600534686e5d69c0ae65026d36922350f052c0370e81e2ed6b3ef9da3141

SHA512
9045d973eebbd558e62edbf7f33221111cccec52c74f9e51ee5af4827b321d6246236fc3f5d3d3d86974224458501495bf8ecf29ff5da388dc0cdd7790807c81

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Filesize
408B

MD5
5a04f53348190b77f9385f95e58d2488

SHA1
4550042bdbe186dccb856a4bfd2d7debc0c605a0

SHA256
687e8c902f2eefea0c49b93c19207abf685a9d7f131eb7eca5f1a69e02f29497

SHA512
0aa741c790c347001a237ef80a8795be3902d2b82b10600d07cdc5cfb5d328e91c871e8c9fb8da05d1aac67326c5a7fa8175a218fb76bf9a3c9c64ddbd6000fe

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
c6af6d557e148517bb7d9883d39dbec9

SHA1
5a3f29d075a4d9dc6fd0a4f5f0d5234e8cbdd440

SHA256
908449850eb9052a26358c54cd9f70725197a572e269ae1dce8f8d73c0f2ea1c

SHA512
f2ac1355b73a3034bb02fc42b7911df56678a6818efb98d7c60e7430f9c5402bea45ce6f44e030ed458fa5b5cc233f87327946b0a425b61a0fabc408a40ac0c4

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
19a00b15645ddf42eaeb126f091f0d51

SHA1
1f7093ca60da0d565f8066023ee340a5bffb70ec

SHA256
6c8e88d39bd11c625c96e4f8914f618d2047c60023699c8b765cee252fa7da2f

SHA512
b2bb5d1f2f122d7b3b2ec1f0f2402e1767ebc703364692e6caf50eb34000e3c431a4b0719c341f6632e5fc9a1f22e973aa6aef9796bbf2cf5fc6685f2fd6cdf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1623.exe

Filesize
1.5MB

MD5
bb8eccee38769c87c852cd9a6d0e3945

SHA1
f43be0806cbcd90f9c79cfd4eda6e43dabb73751

SHA256
f23b8ad620a6ed1806bba93b2b19bbaf6f4c0e1507f131eade424350e5871f54

SHA512
495bc72f958f9024b5d06410ede3a9eca20e2799ee05cdfe52ab9e18c79fb31b07ddd7de58972427073f42206c3172224d0cb79cfb5b8809cf24cb313d6c46eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1623.exe

Filesize
1.5MB

MD5
bb8eccee38769c87c852cd9a6d0e3945

SHA1
f43be0806cbcd90f9c79cfd4eda6e43dabb73751

SHA256
f23b8ad620a6ed1806bba93b2b19bbaf6f4c0e1507f131eade424350e5871f54

SHA512
495bc72f958f9024b5d06410ede3a9eca20e2799ee05cdfe52ab9e18c79fb31b07ddd7de58972427073f42206c3172224d0cb79cfb5b8809cf24cb313d6c46eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\17AB.bat

Filesize
342B

MD5
e79bae3b03e1bff746f952a0366e73ba

SHA1
5f547786c869ce7abc049869182283fa09f38b1d

SHA256
900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63

SHA512
c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

Download Submit
C:\Users\Admin\AppData\Local\Temp\1903.exe

Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1903.exe

Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1A6C.exe

Filesize
219KB

MD5
1aba285cb98a366dc4be21585eecd62a

SHA1
c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b

SHA256
ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8

SHA512
9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

Download Submit
C:\Users\Admin\AppData\Local\Temp\1A6C.exe

Filesize
219KB

MD5
1aba285cb98a366dc4be21585eecd62a

SHA1
c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b

SHA256
ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8

SHA512
9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
89ecc6e0f4f435c613bce8b5f59c2a0a

SHA1
6ecae8292b1ad3aa55f6ac04c01a518d9edade12

SHA256
567660410d0103eb3b704426be08e1b90b24d3c2a047fc9b232bf7cb9e72eb53

SHA512
fe0638c8635cdd98f8f6c166c93ea8f6607e0145516636356a3af0f57db542ff05226bba14460721785782ecb610eac69d73ad026e8057a140c47d57c581b82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
89ecc6e0f4f435c613bce8b5f59c2a0a

SHA1
6ecae8292b1ad3aa55f6ac04c01a518d9edade12

SHA256
567660410d0103eb3b704426be08e1b90b24d3c2a047fc9b232bf7cb9e72eb53

SHA512
fe0638c8635cdd98f8f6c166c93ea8f6607e0145516636356a3af0f57db542ff05226bba14460721785782ecb610eac69d73ad026e8057a140c47d57c581b82a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5330.exe

Filesize
12.5MB

MD5
0bddfbdc76418c7fc877a5a11013dfee

SHA1
b9752934bfbd8101dcd94e3546d158bf538d1d02

SHA256
54349953542084ceceb6de40c4edc6124bf69ccad39051a62d8e2be651acb9dc

SHA512
f488363e0a8c075e257bb93e8a2e8a49cd90f31ed808098058d81a78ca937358c822bc68a4a6159cdebeae78ff67d8dbb556ff6927565259cdfd8620cedbdb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\5330.exe

Filesize
12.5MB

MD5
0bddfbdc76418c7fc877a5a11013dfee

SHA1
b9752934bfbd8101dcd94e3546d158bf538d1d02

SHA256
54349953542084ceceb6de40c4edc6124bf69ccad39051a62d8e2be651acb9dc

SHA512
f488363e0a8c075e257bb93e8a2e8a49cd90f31ed808098058d81a78ca937358c822bc68a4a6159cdebeae78ff67d8dbb556ff6927565259cdfd8620cedbdb08

Download Submit
C:\Users\Admin\AppData\Local\Temp\534848907968

Filesize
86KB

MD5
62bdca658898a4ec7d406d07f58813c2

SHA1
4ca8198b4afb576e2e062e2eae1d511629e87c03

SHA256
e64f8c43d1ac329225f7dbe633726cdf3d285c7ed2d78df334986df840ca3352

SHA512
36fc607ae819f0d82de405cf88bee04bb4498e0850cdfa709de52e2e6b7a69e187558d23d964b5caaf631d8c7c88bd8c347aaf99fcd2c8ab4660457ee93878b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\614A.exe

Filesize
499KB

MD5
ed1e95debacead7bec24779f6549744a

SHA1
d1becd6ca86765f9e82c40d8f698c07854b32a45

SHA256
e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651

SHA512
32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\614A.exe

Filesize
499KB

MD5
ed1e95debacead7bec24779f6549744a

SHA1
d1becd6ca86765f9e82c40d8f698c07854b32a45

SHA256
e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651

SHA512
32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\69A8.exe

Filesize
378KB

MD5
1eaba90935d3a7527d556866647b55e1

SHA1
56a5ca57b3eac1f9859fb117f7de341da8bc3638

SHA256
294a60b31d75b260b6f2f8a14291173fd652578e7037d7b02bb42d884ff55314

SHA512
a1897a437d0a7fa5431854cb03db9cbb4e819429c50c05a3008225c89ff9cf6b24c09b64f2e99a0e3da3df02d25cadb7e71db97deec558bb47ac9d6b94285e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\69A8.exe

Filesize
378KB

MD5
1eaba90935d3a7527d556866647b55e1

SHA1
56a5ca57b3eac1f9859fb117f7de341da8bc3638

SHA256
294a60b31d75b260b6f2f8a14291173fd652578e7037d7b02bb42d884ff55314

SHA512
a1897a437d0a7fa5431854cb03db9cbb4e819429c50c05a3008225c89ff9cf6b24c09b64f2e99a0e3da3df02d25cadb7e71db97deec558bb47ac9d6b94285e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\6FA4.exe

Filesize
95KB

MD5
0592c6d7674c77b053080c5b6e79fdcb

SHA1
693339ede19093e2b4593fda93be0b140be69141

SHA256
fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14

SHA512
37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6FA4.exe

Filesize
95KB

MD5
0592c6d7674c77b053080c5b6e79fdcb

SHA1
693339ede19093e2b4593fda93be0b140be69141

SHA256
fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14

SHA512
37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7A34.exe

Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7A34.exe

Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Broom.exe

Filesize
5.3MB

MD5
00e93456aa5bcf9f60f84b0c0760a212

SHA1
6096890893116e75bd46fea0b8c3921ceb33f57d

SHA256
ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504

SHA512
abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xJ7Mv1cr.exe

Filesize
1.3MB

MD5
fd265778c40d216d138681c7cb1a7b6e

SHA1
b1c829bcdf44db3c136f83b7abc56a789987653c

SHA256
bbb257e0578ccf67af57b14f211efd26693de29580369cce7d75e593e8d166ca

SHA512
95e01159d0daf4c96449f70258a370567c4be61edfc5126be0829edd5279809bbbe3522bebe3103b3eb97c2e6ca236bdefee113302333d22341d7e04a5272738

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xJ7Mv1cr.exe

Filesize
1.3MB

MD5
fd265778c40d216d138681c7cb1a7b6e

SHA1
b1c829bcdf44db3c136f83b7abc56a789987653c

SHA256
bbb257e0578ccf67af57b14f211efd26693de29580369cce7d75e593e8d166ca

SHA512
95e01159d0daf4c96449f70258a370567c4be61edfc5126be0829edd5279809bbbe3522bebe3103b3eb97c2e6ca236bdefee113302333d22341d7e04a5272738

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pk7RT2tq.exe

Filesize
1.1MB

MD5
dc179a8185d333c8bd051f61d0b887b5

SHA1
ca45af09cfe6629a982b8a36a8a3dddc2ba301c9

SHA256
56a7cded50b23bd0751cafbb5fc79f5ec8261eff73662e5b2ffbee31f10c36e6

SHA512
52ec7d62a0f6d16d4f18f36b380e440578cd5cc68fba809064922ae215c427d391e4201ec006eca19a7c4214cd3c436750f4d241ce27a3e65326a30634ede129

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pk7RT2tq.exe

Filesize
1.1MB

MD5
dc179a8185d333c8bd051f61d0b887b5

SHA1
ca45af09cfe6629a982b8a36a8a3dddc2ba301c9

SHA256
56a7cded50b23bd0751cafbb5fc79f5ec8261eff73662e5b2ffbee31f10c36e6

SHA512
52ec7d62a0f6d16d4f18f36b380e440578cd5cc68fba809064922ae215c427d391e4201ec006eca19a7c4214cd3c436750f4d241ce27a3e65326a30634ede129

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mr5tG8PB.exe

Filesize
753KB

MD5
7f769f8789d1d135707c8e936229a4b7

SHA1
899002dca08e3399fddccf927c6a4ec36aeeff82

SHA256
e179e3b3d5cdf8489174119e427dbf6bb323e02c1e8f2746bf1052a93a231bc5

SHA512
4b3f73cda312bf73f00fc63a31ab7f5c63246658b6b15163320e7767230b885347a6daf787e181db7a9eb73be44bd078f423898f859638b46f7b419679839708

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mr5tG8PB.exe

Filesize
753KB

MD5
7f769f8789d1d135707c8e936229a4b7

SHA1
899002dca08e3399fddccf927c6a4ec36aeeff82

SHA256
e179e3b3d5cdf8489174119e427dbf6bb323e02c1e8f2746bf1052a93a231bc5

SHA512
4b3f73cda312bf73f00fc63a31ab7f5c63246658b6b15163320e7767230b885347a6daf787e181db7a9eb73be44bd078f423898f859638b46f7b419679839708

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HU7WF9zq.exe

Filesize
558KB

MD5
a186c808135bc25918d40e3a66240554

SHA1
ab2608cba4d8eab1c433f6f3ba63f29bbc8c782e

SHA256
421b82dcf38235336a6c5e633789584df770f7f3d4b1cba99cd404276198e5c2

SHA512
bb2600f93e8ab3599a1a6e72f3fd42c286e6a97e1f1f73fa9ad4b306e36241c7fbf63506dba9ecd9377fbc1efe611d1d84ed20fbc1b2334cf7ef36ea0a83ca78

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\HU7WF9zq.exe

Filesize
558KB

MD5
a186c808135bc25918d40e3a66240554

SHA1
ab2608cba4d8eab1c433f6f3ba63f29bbc8c782e

SHA256
421b82dcf38235336a6c5e633789584df770f7f3d4b1cba99cd404276198e5c2

SHA512
bb2600f93e8ab3599a1a6e72f3fd42c286e6a97e1f1f73fa9ad4b306e36241c7fbf63506dba9ecd9377fbc1efe611d1d84ed20fbc1b2334cf7ef36ea0a83ca78

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1md47NB5.exe

Filesize
1.0MB

MD5
97cec40934711a65b954bdd785d86d67

SHA1
fc93a4a82d471991063e273e852b0cb76360bd53

SHA256
e51074d90c3ff68b4bf8cf19c98fc4af97dd207982d6170031e1cbc187e90198

SHA512
9d8df0c7a68c9dd5c889a8cd4b6591070f1cf0e8ee2cdce0f5bfb1b8a73836cfe84e52bc52da5d014591716470e29a14e183a680fe59b6778d9e4e5c3517f951

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1md47NB5.exe

Filesize
1.0MB

MD5
97cec40934711a65b954bdd785d86d67

SHA1
fc93a4a82d471991063e273e852b0cb76360bd53

SHA256
e51074d90c3ff68b4bf8cf19c98fc4af97dd207982d6170031e1cbc187e90198

SHA512
9d8df0c7a68c9dd5c889a8cd4b6591070f1cf0e8ee2cdce0f5bfb1b8a73836cfe84e52bc52da5d014591716470e29a14e183a680fe59b6778d9e4e5c3517f951

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Rt830py.exe

Filesize
219KB

MD5
701ee306ef2c79984555976e89e0c8e3

SHA1
32933296410a1c70a7c88ee7cac2c6c65ceda999

SHA256
c74a6f280275d8ada0452600075a01eec14079410117c3eac55800e59afcf8d3

SHA512
2521e7ab8046b8f472d757ad96307ea4cb761bfd7e7bf2227ebce97e0f44ca3dc1435f040c89111379d1024dcbcf0ae7fa974cdc89c9ea73efcee4b8b2d0fb5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Rt830py.exe

Filesize
219KB

MD5
701ee306ef2c79984555976e89e0c8e3

SHA1
32933296410a1c70a7c88ee7cac2c6c65ceda999

SHA256
c74a6f280275d8ada0452600075a01eec14079410117c3eac55800e59afcf8d3

SHA512
2521e7ab8046b8f472d757ad96307ea4cb761bfd7e7bf2227ebce97e0f44ca3dc1435f040c89111379d1024dcbcf0ae7fa974cdc89c9ea73efcee4b8b2d0fb5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.5MB

MD5
032a919dff4e6ba21c24d11a423b112c

SHA1
cbaa859c0afa6b4c0d2a288728e653e324e80e90

SHA256
12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553

SHA512
0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.5MB

MD5
032a919dff4e6ba21c24d11a423b112c

SHA1
cbaa859c0afa6b4c0d2a288728e653e324e80e90

SHA256
12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553

SHA512
0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
5.4MB

MD5
dc530971a92a454a7db0ab8758e013bb

SHA1
60c23e3140035817f2a24f9f32e4a6fa1042f8cd

SHA256
1ae3036014ff08735c25fc6efbba2e60f806a5ae1b9f80b521a367267f68b1a7

SHA512
3bdeb0fb914c3c42838c36f2f367397a84825f2ca621b099425b8056a5e2e90f32d1bfcc17638cd85bfa4d5f936316eb38501925bbe4a7464968301291a135f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
5.4MB

MD5
dc530971a92a454a7db0ab8758e013bb

SHA1
60c23e3140035817f2a24f9f32e4a6fa1042f8cd

SHA256
1ae3036014ff08735c25fc6efbba2e60f806a5ae1b9f80b521a367267f68b1a7

SHA512
3bdeb0fb914c3c42838c36f2f367397a84825f2ca621b099425b8056a5e2e90f32d1bfcc17638cd85bfa4d5f936316eb38501925bbe4a7464968301291a135f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1noejth.vjw.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe

Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V5HAP.tmp\is-PE0R5.tmp

Filesize
643KB

MD5
a991510c12f20ccf8a5231a32a7958c3

SHA1
122724d1a4fdea39af3aa427e4941158d7e91dfa

SHA256
0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

SHA512
8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V5HAP.tmp\is-PE0R5.tmp

Filesize
643KB

MD5
a991510c12f20ccf8a5231a32a7958c3

SHA1
122724d1a4fdea39af3aa427e4941158d7e91dfa

SHA256
0c3ab280e156e9ff6a325267bc5d721f71dcb12490a53a03a033d932272f9198

SHA512
8f387a6189f6fa51f84004706589ed1706dfd08dfc38c1f8ce3ce010f37efac085fd241396ab69bc25c86174a4637492163bf3cb26f88639551dc9fa0c52eafa

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe

Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe

Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C4C.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C61.tmp

Filesize
92KB

MD5
843933002e97a0ed13a5842ff69162e7

SHA1
78c28c8cf61ad98c9dce2855d27af25c2cb0254c

SHA256
1976c8cf1ab2fd32680f25be2b7b5d7c8ae5780948024cafbbdde28e25cdf31c

SHA512
77c82c3cc8dc7dccb2e59670b35539fda008ed002624125126558116697f07862cdce4489e581b6a2bf5e61bc5f0fd93d8adcd2370556dd053649c4ab2b0ebdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C9C.tmp

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
239KB

MD5
cbc7a8ce71264b2c2c8568fd6ff6d93d

SHA1
16e53a3a1789b42dce33e1fb9d5b6476cc76dcf5

SHA256
10b9e6d04ea861b41718bc6ec5822e33500c7008c9f00c8c75d429d340068fc0

SHA512
c1a7040de751719d8dc335cca8d7c34411898d5b0c321668abdd059862dd566b4b58bdb9f997407d09dd7f7fb3a21a5061b4c1e4e45b57e7dccde6a7cc29759e

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
239KB

MD5
cbc7a8ce71264b2c2c8568fd6ff6d93d

SHA1
16e53a3a1789b42dce33e1fb9d5b6476cc76dcf5

SHA256
10b9e6d04ea861b41718bc6ec5822e33500c7008c9f00c8c75d429d340068fc0

SHA512
c1a7040de751719d8dc335cca8d7c34411898d5b0c321668abdd059862dd566b4b58bdb9f997407d09dd7f7fb3a21a5061b4c1e4e45b57e7dccde6a7cc29759e

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll

Filesize
102KB

MD5
8da053f9830880089891b615436ae761

SHA1
47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4

SHA256
d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374

SHA512
69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll

Filesize
1.2MB

MD5
0111e5a2a49918b9c34cbfbf6380f3f3

SHA1
81fc519232c0286f5319b35078ac3bb381311bd4

SHA256
4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c

SHA512
a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5

Download Submit
C:\Users\Admin\AppData\Roaming\wdcwuae

Filesize
239KB

MD5
cbc7a8ce71264b2c2c8568fd6ff6d93d

SHA1
16e53a3a1789b42dce33e1fb9d5b6476cc76dcf5

SHA256
10b9e6d04ea861b41718bc6ec5822e33500c7008c9f00c8c75d429d340068fc0

SHA512
c1a7040de751719d8dc335cca8d7c34411898d5b0c321668abdd059862dd566b4b58bdb9f997407d09dd7f7fb3a21a5061b4c1e4e45b57e7dccde6a7cc29759e

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
89ecc6e0f4f435c613bce8b5f59c2a0a

SHA1
6ecae8292b1ad3aa55f6ac04c01a518d9edade12

SHA256
567660410d0103eb3b704426be08e1b90b24d3c2a047fc9b232bf7cb9e72eb53

SHA512
fe0638c8635cdd98f8f6c166c93ea8f6607e0145516636356a3af0f57db542ff05226bba14460721785782ecb610eac69d73ad026e8057a140c47d57c581b82a

Download Submit
\Users\Admin\AppData\Local\Temp\614A.exe

Filesize
499KB

MD5
ed1e95debacead7bec24779f6549744a

SHA1
d1becd6ca86765f9e82c40d8f698c07854b32a45

SHA256
e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651

SHA512
32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

Download Submit
\Users\Admin\AppData\Local\Temp\614A.exe

Filesize
499KB

MD5
ed1e95debacead7bec24779f6549744a

SHA1
d1becd6ca86765f9e82c40d8f698c07854b32a45

SHA256
e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651

SHA512
32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

Download Submit
\Users\Admin\AppData\Local\Temp\69A8.exe

Filesize
378KB

MD5
1eaba90935d3a7527d556866647b55e1

SHA1
56a5ca57b3eac1f9859fb117f7de341da8bc3638

SHA256
294a60b31d75b260b6f2f8a14291173fd652578e7037d7b02bb42d884ff55314

SHA512
a1897a437d0a7fa5431854cb03db9cbb4e819429c50c05a3008225c89ff9cf6b24c09b64f2e99a0e3da3df02d25cadb7e71db97deec558bb47ac9d6b94285e6c

Download Submit
\Users\Admin\AppData\Local\Temp\69A8.exe

Filesize
378KB

MD5
1eaba90935d3a7527d556866647b55e1

SHA1
56a5ca57b3eac1f9859fb117f7de341da8bc3638

SHA256
294a60b31d75b260b6f2f8a14291173fd652578e7037d7b02bb42d884ff55314

SHA512
a1897a437d0a7fa5431854cb03db9cbb4e819429c50c05a3008225c89ff9cf6b24c09b64f2e99a0e3da3df02d25cadb7e71db97deec558bb47ac9d6b94285e6c

Download Submit
\Users\Admin\AppData\Local\Temp\is-132JD.tmp\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/316-506-0x0000027F75190000-0x0000027F751B0000-memory.dmp

Filesize
128KB

Download
memory/316-518-0x0000027F75660000-0x0000027F75760000-memory.dmp

Filesize
1024KB

Download
memory/316-343-0x0000027F73DE0000-0x0000027F73E00000-memory.dmp

Filesize
128KB

Download
memory/316-504-0x0000027F75170000-0x0000027F75190000-memory.dmp

Filesize
128KB

Download
memory/968-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/968-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/968-3-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2716-97-0x00000278BB040000-0x00000278BB050000-memory.dmp

Filesize
64KB

Download
memory/2716-119-0x00000278BAB70000-0x00000278BAB72000-memory.dmp

Filesize
8KB

Download
memory/2716-439-0x00000278C19B0000-0x00000278C19B1000-memory.dmp

Filesize
4KB

Download
memory/2716-422-0x00000278C19A0000-0x00000278C19A1000-memory.dmp

Filesize
4KB

Download
memory/2716-68-0x00000278BA820000-0x00000278BA830000-memory.dmp

Filesize
64KB

Download
memory/2988-441-0x000002801AE00000-0x000002801AF00000-memory.dmp

Filesize
1024KB

Download
memory/2988-210-0x0000028019BD0000-0x0000028019BD2000-memory.dmp

Filesize
8KB

Download
memory/2988-192-0x0000028009660000-0x0000028009662000-memory.dmp

Filesize
8KB

Download
memory/2988-592-0x0000028019F00000-0x000002801A000000-memory.dmp

Filesize
1024KB

Download
memory/2988-207-0x0000028019AE0000-0x0000028019AE2000-memory.dmp

Filesize
8KB

Download
memory/2988-434-0x000002801A300000-0x000002801A320000-memory.dmp

Filesize
128KB

Download
memory/3336-4-0x00000000010C0000-0x00000000010D6000-memory.dmp

Filesize
88KB

Download
memory/3520-241-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/3520-81-0x0000000000470000-0x00000000004AC000-memory.dmp

Filesize
240KB

Download
memory/3520-79-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/3520-120-0x00000000073D0000-0x000000000740E000-memory.dmp

Filesize
248KB

Download
memory/4104-795-0x00000000007F0000-0x00000000007F9000-memory.dmp

Filesize
36KB

Download
memory/4104-793-0x00000000008F9000-0x000000000090C000-memory.dmp

Filesize
76KB

Download
memory/4192-83-0x00000000076C0000-0x0000000007BBE000-memory.dmp

Filesize
5.0MB

Download
memory/4192-63-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/4192-115-0x00000000074D0000-0x00000000074E2000-memory.dmp

Filesize
72KB

Download
memory/4192-121-0x0000000007570000-0x00000000075BB000-memory.dmp

Filesize
300KB

Download
memory/4192-257-0x0000000007430000-0x0000000007440000-memory.dmp

Filesize
64KB

Download
memory/4192-85-0x00000000072A0000-0x0000000007332000-memory.dmp

Filesize
584KB

Download
memory/4192-114-0x0000000007BC0000-0x0000000007CCA000-memory.dmp

Filesize
1.0MB

Download
memory/4192-112-0x00000000081D0000-0x00000000087D6000-memory.dmp

Filesize
6.0MB

Download
memory/4192-94-0x0000000007280000-0x000000000728A000-memory.dmp

Filesize
40KB

Download
memory/4192-64-0x0000000000520000-0x000000000055C000-memory.dmp

Filesize
240KB

Download
memory/4192-215-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/4192-90-0x0000000007430000-0x0000000007440000-memory.dmp

Filesize
64KB

Download
memory/4288-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4580-444-0x000002A7536C0000-0x000002A7536C2000-memory.dmp

Filesize
8KB

Download
memory/4580-470-0x000002A7536F0000-0x000002A7536F2000-memory.dmp

Filesize
8KB

Download
memory/5288-754-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/5288-545-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/5480-526-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/5480-562-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/5480-528-0x00000000020E0000-0x000000000213A000-memory.dmp

Filesize
360KB

Download
memory/5604-565-0x000000001B910000-0x000000001B920000-memory.dmp

Filesize
64KB

Download
memory/5604-560-0x00007FFFC6720000-0x00007FFFC710C000-memory.dmp

Filesize
9.9MB

Download
memory/5604-621-0x00007FFFC6720000-0x00007FFFC710C000-memory.dmp

Filesize
9.9MB

Download
memory/5604-547-0x0000000000C20000-0x0000000000C28000-memory.dmp

Filesize
32KB

Download
memory/5636-827-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/5636-821-0x0000000002DB0000-0x000000000369B000-memory.dmp

Filesize
8.9MB

Download
memory/5636-820-0x00000000028B0000-0x0000000002CAA000-memory.dmp

Filesize
4.0MB

Download
memory/5636-1577-0x00000000028B0000-0x0000000002CAA000-memory.dmp

Filesize
4.0MB

Download
memory/5724-781-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/5724-578-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/5724-574-0x0000000000800000-0x000000000083E000-memory.dmp

Filesize
248KB

Download
memory/5724-570-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/5724-787-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/5784-389-0x0000000000F00000-0x0000000001B90000-memory.dmp

Filesize
12.6MB

Download
memory/5784-383-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/5784-564-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/6024-819-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/6024-581-0x0000000000D30000-0x0000000000D4E000-memory.dmp

Filesize
120KB

Download
memory/6024-1312-0x0000000006F10000-0x0000000006F86000-memory.dmp

Filesize
472KB

Download
memory/6024-1331-0x0000000007820000-0x000000000783E000-memory.dmp

Filesize
120KB

Download
memory/6024-850-0x00000000071D0000-0x00000000076FC000-memory.dmp

Filesize
5.2MB

Download
memory/6024-822-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/6024-589-0x0000000005650000-0x0000000005660000-memory.dmp

Filesize
64KB

Download
memory/6024-849-0x0000000006AD0000-0x0000000006C92000-memory.dmp

Filesize
1.8MB

Download
memory/6024-1517-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/6024-587-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/6024-921-0x0000000006CA0000-0x0000000006D06000-memory.dmp

Filesize
408KB

Download
memory/6172-620-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/6172-947-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/6188-959-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6188-812-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6308-652-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/6364-1587-0x00000000072B0000-0x00000000078D8000-memory.dmp

Filesize
6.2MB

Download
memory/6364-1585-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/6364-1582-0x0000000073230000-0x000000007391E000-memory.dmp

Filesize
6.9MB

Download
memory/6364-1575-0x0000000006C40000-0x0000000006C76000-memory.dmp

Filesize
216KB

Download
memory/6812-757-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/6812-762-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/7084-791-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/7084-1447-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/7084-1376-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download