amadey | 5afa96ab0d4360792441d6252c72f3e1c1584f12d3a23160da75819990be2884

Analysis

max time kernel
116s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2023 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe
Size

1.0MB
MD5

eb716a8973ab9a2394f113be0ae13120
SHA1

dd0766b8062ad1358276c5b25099f993950d0f3e
SHA256

5afa96ab0d4360792441d6252c72f3e1c1584f12d3a23160da75819990be2884
SHA512

8589989df40bed30e6e936195ed222a98d004d924132677572393c9b6fce5b0542cecefb6c2cc3849a5bdc44c7cbe96872177c7ed1cbcb69140b0bc553a2421f
SSDEEP

24576:+y31tSdbUFFcnMvbc+Zp+BCFla8UFI8Kp:NlrFFcnM7f+BClUO8K

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

redline

Botnet

plost

77.91.124.86:19084

Extracted

Family

redline

Botnet

kedru

77.91.124.86:19084

Extracted

Family

redline

Botnet

pixelnew2.0

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

195.10.205.17:8122

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

DcRat 4 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeschtasks.exeschtasks.exeNEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe

pid	process
6668	schtasks.exe
760	schtasks.exe
5420	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/6232-1088-0x0000000002DE0000-0x00000000036CB000-memory.dmp	family_glupteba
behavioral1/memory/6232-1165-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/6232-1188-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/6232-1283-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/6232-1422-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/5860-1709-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/644-42-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\38F0.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\38F0.exe	family_redline
behavioral1/memory/4572-108-0x0000000000FB0000-0x0000000000FEC000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2La264aw.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2La264aw.exe	family_redline
behavioral1/memory/704-128-0x00000000001D0000-0x000000000020C000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\86F4.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\86F4.exe	family_redline
behavioral1/memory/2976-340-0x00000000005E0000-0x00000000005FE000-memory.dmp	family_redline
behavioral1/memory/4812-359-0x00000000005E0000-0x000000000063A000-memory.dmp	family_redline
behavioral1/memory/4812-471-0x0000000000400000-0x0000000000480000-memory.dmp	family_redline
behavioral1/memory/5972-1584-0x0000000000560000-0x000000000059C000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\86F4.exe	family_sectoprat
C:\Users\Admin\AppData\Local\Temp\86F4.exe	family_sectoprat
behavioral1/memory/2976-340-0x00000000005E0000-0x00000000005FE000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

latestX.exe

description	pid	process	target process
PID 6420 created 3148	6420	latestX.exe	Explorer.EXE
PID 6420 created 3148	6420	latestX.exe	Explorer.EXE
PID 6420 created 3148	6420	latestX.exe	Explorer.EXE
PID 6420 created 3148	6420	latestX.exe	Explorer.EXE
PID 6420 created 3148	6420	latestX.exe	Explorer.EXE

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

231 6460 rundll32.exe
254 6376 rundll32.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

6348 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
231	6460	rundll32.exe
254	6376	rundll32.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

pid	process
6348	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8D0F.exeUtsysc.exekos4.exe6205.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	8D0F.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	Utsysc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	kos4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	6205.exe

Executes dropped EXE 35 IoCs

Processes:

GK6mr22.exeEu1LB04.exe1js24KF3.exe2Yy0261.exe3dJ29Ej.exe4OZ818HH.exe360F.exeAN3jW6Zq.exeWc4Vv5zZ.exeea2Vy9AH.exe3805.exeef6OF8Gr.exe38F0.exe1os31GD9.exe2La264aw.exe6205.exe80D8.exe86F4.exe8D0F.exeInstallSetup5.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exeBroom.exekos4.exeUtsysc.exelatestX.exeLzmwAqmV.exeis-P9P6E.tmpBBuster.exeBBuster.exetoolspub2.exeUtsysc.exe1914.exe31839b57a4f11171d6abc8bbc4451ee4.exeupdater.exe

pid	process
3900	GK6mr22.exe
2428	Eu1LB04.exe
1152	1js24KF3.exe
3416	2Yy0261.exe
4608	3dJ29Ej.exe
1992	4OZ818HH.exe
1500	360F.exe
3292	AN3jW6Zq.exe
2920	Wc4Vv5zZ.exe
4480	ea2Vy9AH.exe
4120	3805.exe
3168	ef6OF8Gr.exe
4572	38F0.exe
3968	1os31GD9.exe
704	2La264aw.exe
4888	6205.exe
4812	80D8.exe
2976	86F4.exe
2204	8D0F.exe
4588	InstallSetup5.exe
3604	toolspub2.exe
6232	31839b57a4f11171d6abc8bbc4451ee4.exe
6240	Broom.exe
6324	kos4.exe
6380	Utsysc.exe
6420	latestX.exe
6580	LzmwAqmV.exe
6696	is-P9P6E.tmp
3332	BBuster.exe
6672	BBuster.exe
6220	toolspub2.exe
860	Utsysc.exe
1392	1914.exe
5860	31839b57a4f11171d6abc8bbc4451ee4.exe
6464	updater.exe

Loads dropped DLL 6 IoCs

Processes:

80D8.exeis-P9P6E.tmprundll32.exerundll32.exerundll32.exe

pid process

4812 80D8.exe
4812 80D8.exe
6696 is-P9P6E.tmp
6368 rundll32.exe
6376 rundll32.exe
6460 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4812	80D8.exe
4812	80D8.exe
6696	is-P9P6E.tmp
6368	rundll32.exe
6376	rundll32.exe
6460	rundll32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exeGK6mr22.exeEu1LB04.exe360F.exeAN3jW6Zq.exeWc4Vv5zZ.exeea2Vy9AH.exeef6OF8Gr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	GK6mr22.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Eu1LB04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	360F.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	AN3jW6Zq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Wc4Vv5zZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	ea2Vy9AH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	ef6OF8Gr.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

1js24KF3.exe2Yy0261.exe4OZ818HH.exe1os31GD9.exetoolspub2.exe1914.exe

description	pid	process	target process
PID 1152 set thread context of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 3416 set thread context of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 1992 set thread context of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 3968 set thread context of 4592	3968	1os31GD9.exe	AppLaunch.exe
PID 3604 set thread context of 6220	3604	toolspub2.exe	toolspub2.exe
PID 1392 set thread context of 5972	1392	1914.exe	jsc.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 35 IoCs

Processes:

latestX.exeis-P9P6E.tmp

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files (x86)\BBuster\unins000.dat	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\is-ERCQV.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-IOS7H.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-0LIIU.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\is-CSIM7.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-3CGET.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-UV3V3.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-3GK4N.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-IHM6O.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-CPBML.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-5840U.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Help\is-JF9F2.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-4URGJ.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-N8IM4.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-0HG4L.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-B678R.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-H0RV0.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-8TQC4.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-AU3PH.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-KLVV6.tmp	is-P9P6E.tmp
File opened for modification	C:\Program Files (x86)\BBuster\BBuster.exe	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-SSP8B.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-Q1UJ1.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-PF856.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-MOEED.tmp	is-P9P6E.tmp
File opened for modification	C:\Program Files (x86)\BBuster\unins000.dat	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Online\is-3BVUC.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Online\is-84KCK.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Plugins\is-BL53G.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-PDKSQ.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-MHK68.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-UT2UR.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-3M80M.tmp	is-P9P6E.tmp
File created	C:\Program Files (x86)\BBuster\Lang\is-Q03TB.tmp	is-P9P6E.tmp

Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

7088 sc.exe
6164 sc.exe
6352 sc.exe
4304 sc.exe
1644 sc.exe
6960 sc.exe
4192 sc.exe
4708 sc.exe
6988 sc.exe
6772 sc.exe
7100 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3204 4704 WerFault.exe AppLaunch.exe
492 4592 WerFault.exe AppLaunch.exe
1728 4812 WerFault.exe 80D8.exe

pid	process
7088	sc.exe
6164	sc.exe
6352	sc.exe
4304	sc.exe
1644	sc.exe
6960	sc.exe
4192	sc.exe
4708	sc.exe
6988	sc.exe
6772	sc.exe
7100	sc.exe

pid	pid_target	process	target process
3204	4704	WerFault.exe	AppLaunch.exe
492	4592	WerFault.exe	AppLaunch.exe
1728	4812	WerFault.exe	80D8.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3dJ29Ej.exetoolspub2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dJ29Ej.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dJ29Ej.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dJ29Ej.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

6668 schtasks.exe
760 schtasks.exe
5420 schtasks.exe

pid	process
6668	schtasks.exe
760	schtasks.exe
5420	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3dJ29Ej.exeAppLaunch.exeExplorer.EXE

pid	process
4608	3dJ29Ej.exe
4608	3dJ29Ej.exe
2176	AppLaunch.exe
2176	AppLaunch.exe
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3148 Explorer.EXE
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3dJ29Ej.exetoolspub2.exe

pid process

4608 3dJ29Ej.exe
6220 toolspub2.exe

pid	process
3148	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

msedge.exe

pid	process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AppLaunch.exeExplorer.EXE86F4.exekos4.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	2176	AppLaunch.exe
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeDebugPrivilege	2976	86F4.exe
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeDebugPrivilege	6324	kos4.exe
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: 33	6712	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6712	AUDIODG.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe8D0F.exe

pid	process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
2204	8D0F.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

6240 Broom.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3148 Explorer.EXE

pid	process
6240	Broom.exe

pid	process
3148	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exeGK6mr22.exeEu1LB04.exe1js24KF3.exe2Yy0261.exe4OZ818HH.exeExplorer.EXE360F.exeAN3jW6Zq.exeWc4Vv5zZ.exe

description	pid	process	target process
PID 2432 wrote to memory of 3900	2432	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe	GK6mr22.exe
PID 2432 wrote to memory of 3900	2432	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe	GK6mr22.exe
PID 2432 wrote to memory of 3900	2432	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe	GK6mr22.exe
PID 3900 wrote to memory of 2428	3900	GK6mr22.exe	Eu1LB04.exe
PID 3900 wrote to memory of 2428	3900	GK6mr22.exe	Eu1LB04.exe
PID 3900 wrote to memory of 2428	3900	GK6mr22.exe	Eu1LB04.exe
PID 2428 wrote to memory of 1152	2428	Eu1LB04.exe	1js24KF3.exe
PID 2428 wrote to memory of 1152	2428	Eu1LB04.exe	1js24KF3.exe
PID 2428 wrote to memory of 1152	2428	Eu1LB04.exe	1js24KF3.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 1152 wrote to memory of 2176	1152	1js24KF3.exe	AppLaunch.exe
PID 2428 wrote to memory of 3416	2428	Eu1LB04.exe	2Yy0261.exe
PID 2428 wrote to memory of 3416	2428	Eu1LB04.exe	2Yy0261.exe
PID 2428 wrote to memory of 3416	2428	Eu1LB04.exe	2Yy0261.exe
PID 3416 wrote to memory of 4368	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4368	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4368	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3416 wrote to memory of 4704	3416	2Yy0261.exe	AppLaunch.exe
PID 3900 wrote to memory of 4608	3900	GK6mr22.exe	3dJ29Ej.exe
PID 3900 wrote to memory of 4608	3900	GK6mr22.exe	3dJ29Ej.exe
PID 3900 wrote to memory of 4608	3900	GK6mr22.exe	3dJ29Ej.exe
PID 2432 wrote to memory of 1992	2432	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe	4OZ818HH.exe
PID 2432 wrote to memory of 1992	2432	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe	4OZ818HH.exe
PID 2432 wrote to memory of 1992	2432	NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe	4OZ818HH.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 1992 wrote to memory of 644	1992	4OZ818HH.exe	AppLaunch.exe
PID 3148 wrote to memory of 1500	3148	Explorer.EXE	360F.exe
PID 3148 wrote to memory of 1500	3148	Explorer.EXE	360F.exe
PID 3148 wrote to memory of 1500	3148	Explorer.EXE	360F.exe
PID 1500 wrote to memory of 3292	1500	360F.exe	AN3jW6Zq.exe
PID 1500 wrote to memory of 3292	1500	360F.exe	AN3jW6Zq.exe
PID 1500 wrote to memory of 3292	1500	360F.exe	AN3jW6Zq.exe
PID 3148 wrote to memory of 116	3148	Explorer.EXE	cmd.exe
PID 3148 wrote to memory of 116	3148	Explorer.EXE	cmd.exe
PID 3292 wrote to memory of 2920	3292	AN3jW6Zq.exe	Wc4Vv5zZ.exe
PID 3292 wrote to memory of 2920	3292	AN3jW6Zq.exe	Wc4Vv5zZ.exe
PID 3292 wrote to memory of 2920	3292	AN3jW6Zq.exe	Wc4Vv5zZ.exe
PID 2920 wrote to memory of 4480	2920	Wc4Vv5zZ.exe	ea2Vy9AH.exe
PID 2920 wrote to memory of 4480	2920	Wc4Vv5zZ.exe	ea2Vy9AH.exe
PID 2920 wrote to memory of 4480	2920	Wc4Vv5zZ.exe	ea2Vy9AH.exe
PID 3148 wrote to memory of 4120	3148	Explorer.EXE	3805.exe
PID 3148 wrote to memory of 4120	3148	Explorer.EXE	3805.exe
PID 3148 wrote to memory of 4120	3148	Explorer.EXE	3805.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3148

C:\Users\Admin\AppData\Local\Temp\NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.eb716a8973ab9a2394f113be0ae13120_JC.exe"
2⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2432

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GK6mr22.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GK6mr22.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3900

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu1LB04.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu1LB04.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2428

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1js24KF3.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1js24KF3.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Yy0261.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Yy0261.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 540
7⤵
- Program crash
PID:3204

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3dJ29Ej.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3dJ29Ej.exe
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4608

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4OZ818HH.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4OZ818HH.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:644

C:\Users\Admin\AppData\Local\Temp\360F.exe
C:\Users\Admin\AppData\Local\Temp\360F.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AN3jW6Zq.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AN3jW6Zq.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3292

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wc4Vv5zZ.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wc4Vv5zZ.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2920

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ea2Vy9AH.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ea2Vy9AH.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3739.bat" "
2⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
4⤵
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 /prefetch:3
4⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
4⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
4⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
4⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
4⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
4⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
4⤵
PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
4⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
4⤵
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
4⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
4⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
4⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8072 /prefetch:8
4⤵
PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
4⤵
PID:6576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7784 /prefetch:8
4⤵
PID:6300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
4⤵
PID:6288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
4⤵
PID:7012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
4⤵
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8828 /prefetch:8
4⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8828 /prefetch:8
4⤵
PID:7148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8400 /prefetch:1
4⤵
PID:6664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
4⤵
PID:6044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7480 /prefetch:1
4⤵
PID:6832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,4534777021566803492,18147020949813444250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9144 /prefetch:1
4⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
3⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,2953093434689265308,2216155659507490065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
4⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,2953093434689265308,2216155659507490065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
4⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
3⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
3⤵
PID:5380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
3⤵
PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
3⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
3⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:5836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
3⤵
PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
4⤵
PID:6052

C:\Users\Admin\AppData\Local\Temp\3805.exe
C:\Users\Admin\AppData\Local\Temp\3805.exe
2⤵
- Executes dropped EXE
PID:4120

C:\Users\Admin\AppData\Local\Temp\38F0.exe
C:\Users\Admin\AppData\Local\Temp\38F0.exe
2⤵
- Executes dropped EXE
PID:4572

C:\Users\Admin\AppData\Local\Temp\6205.exe
C:\Users\Admin\AppData\Local\Temp\6205.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4888

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
3⤵
- Executes dropped EXE
PID:4588

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6240

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3604

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6220

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
PID:6232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:1484

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
PID:5860

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2672

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:1484

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:6348

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Modifies data under HKEY_USERS
PID:2568

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:2128

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
PID:3224

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:7008

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- DcRat
- Creates scheduled task(s)
PID:760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:4160

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:5620

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:6304

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
PID:5684

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- DcRat
- Creates scheduled task(s)
PID:5420

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
PID:1244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:5296

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:6960

C:\Users\Admin\AppData\Local\Temp\kos4.exe
"C:\Users\Admin\AppData\Local\Temp\kos4.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6324

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
4⤵
- Executes dropped EXE
PID:6580

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:6420

C:\Users\Admin\AppData\Local\Temp\80D8.exe
C:\Users\Admin\AppData\Local\Temp\80D8.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 840
3⤵
- Program crash
PID:1728

C:\Users\Admin\AppData\Local\Temp\86F4.exe
C:\Users\Admin\AppData\Local\Temp\86F4.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Users\Admin\AppData\Local\Temp\8D0F.exe
C:\Users\Admin\AppData\Local\Temp\8D0F.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2204

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
"C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:6380

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F
4⤵
- DcRat
- Creates scheduled task(s)
PID:6668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit
4⤵
PID:6720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2964

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:N"
5⤵
PID:6924

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:R" /E
5⤵
PID:7008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4428

C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:N"
5⤵
PID:6784

C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:R" /E
5⤵
PID:7164

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:6460

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
4⤵
- Loads dropped DLL
PID:6368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:5372

C:\Users\Admin\AppData\Local\Temp\1914.exe
C:\Users\Admin\AppData\Local\Temp\1914.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1392

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
3⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f48d46f8,0x7ff9f48d4708,0x7ff9f48d4718
5⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
5⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
5⤵
PID:6840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
5⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
5⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
5⤵
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
5⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
5⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
5⤵
PID:6956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
5⤵
PID:7144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
5⤵
PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
5⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15883739349166361290,7034384841934256410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
5⤵
PID:1312

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:6260

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:6772

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4192

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:4708

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:7100

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:7088

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:6612

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:4964

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4896

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:5440

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:6348

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:2128

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:6968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:6552

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:5324

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:6988

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:6164

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:6352

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4304

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1644

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:7128

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:7156

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:5032

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:6340

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:5588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:7148

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:5252

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4704 -ip 4704
1⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ef6OF8Gr.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ef6OF8Gr.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:3168

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1os31GD9.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1os31GD9.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:5012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 196
4⤵
- Program crash
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2La264aw.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2La264aw.exe
2⤵
- Executes dropped EXE
PID:704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4592 -ip 4592
1⤵
PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4812 -ip 4812
1⤵
PID:1504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6372

C:\Users\Admin\AppData\Local\Temp\is-HPM56.tmp\is-P9P6E.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HPM56.tmp\is-P9P6E.tmp" /SL4 $30252 "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe" 4635057 79360
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:6696

C:\Program Files (x86)\BBuster\BBuster.exe
"C:\Program Files (x86)\BBuster\BBuster.exe" -i
2⤵
- Executes dropped EXE
PID:3332

C:\Program Files (x86)\BBuster\BBuster.exe
"C:\Program Files (x86)\BBuster\BBuster.exe" -s
2⤵
- Executes dropped EXE
PID:6672

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 3
2⤵
PID:6164

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:6376

C:\Windows\system32\netsh.exe
netsh wlan show profiles
2⤵
PID:6896

C:\Windows\system32\tar.exe
tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\811856890180_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"
2⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
1⤵
- Executes dropped EXE
PID:860

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 3
1⤵
PID:5360

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:6464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5164

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
1⤵
PID:5664

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2800

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
16e56f576d6ace85337e8c07ec00c0bf

SHA1
5c9579bb4975c93a69d1336eed5f05013dc35b9c

SHA256
7796a7ba79148fc3cb46e4bbca48094376371ca9dd66f0810f7797c5e24158f5

SHA512
69e89f39fa6438a74a48985387cd2e3e003858b0855ee6cd03abf6967674503b98b90573c784b4cf785b9cca594d3c8762f92def24e2bf51374ef5a00921e5e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9b7a209274fde194ec22feb420ebf120

SHA1
ccb6694e9feae3f7a1e8694369ec987b53396d2f

SHA256
e70a2f34ee1ba4e1511392f4da39b86583701ee9eee201ae3b2215c1a37ca872

SHA512
5910d2fe8702a45e083614412c72bf5100c73b12a6f7112fe72e0c2eca17aa58f4c3988a9ca60fba0a9b691a38c2edbb7229be718bdaaaec3cd3eedf04c77010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a2e14233cba8ad7864bfdda7fb25e6e7

SHA1
7722d2fcc4c66d9d34ca910185860a777b2a98ca

SHA256
a9f8c71fcc5bc961e4e954f391ffe6a84c86c13c7eaf59a9823d6a68215c5d7d

SHA512
43add0dc0ffd55c597f56b5132f6bfa46b973f605cd6cc294a6d26713fbe53d4854ab654dc0fc5d6c3de327c184b2327aa1016e327b06f0d1f50df2a1681bf32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0629525c94f6548880f5f3a67846755e

SHA1
40ef667fc04bb1c0ae4bf2c17ded88594f0f4423

SHA256
812576f4a24f399abbd54b83ba7f404f021d4a7d2ec0fd2f988ebf4cbf8477ee

SHA512
f74d2e4a65a152f46852eb78dd70a958fdfb8c14e060ca41ffa783b7362e44659cc5fc73f59f3edb1f1d817000b85de7c1860512aa65d937eb5a0a8d9e5890fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055
Filesize
186KB

MD5
4a2977698422c3c6e58b664643322efa

SHA1
939e0f3f916f936be7c8c49121d8f245b99cab1b

SHA256
d60610d21436821de350b6e21d3915e5ea1617d97cf20f7aaa1d5ae782cc4cd8

SHA512
ca9d91650de72ff1faed43344dbc86ea3e81d4fd615b89347d31c7676fde084ddcae30a9dbfa3b341ec32b00966004fe7d6d96e383b18363ebd8f02b982ffd57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
c4655dcf31b0d6eebbb13f7004aa1d29

SHA1
2b53d4f949864ee38e507cab9ac3059e69f6436f

SHA256
2cec5b9d261e06c2201488826e5a1efc33cd1ea90ff7ebbb51573a1801ef25cb

SHA512
e813578defd7653256da5243840d4bf3343e222283d4db5a2de3ca9f37c476a6ddf08f4a8a7e7de89f4f1a4c4d2f38d9b70898564a92602b731f1a4e823d9492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
38be25702312c00750a170f95eeb8d15

SHA1
f7e13eaa4b3d71220d7b47daa3839cf532fd4468

SHA256
b9607fdb542a9d264c72084644d7b040891a1410b344de68aab1739366c6388b

SHA512
2da6c0f570e267b3221a1272f7927ce93f24eca0e8e878985d741009e3132c28bba8933a015757e6aee399fcaa27f88b7da187f17e9b026a69db111f5b4e2488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
4be5c2e9e9d65b51e3e187c99b257e5d

SHA1
68544a2f315743680050ba2cfbb3bdb324e01c6e

SHA256
cb9278c937808bac267bd7feb3d9bd9549386da06b2014b0cf03935cb2f0fa16

SHA512
6aabbcf1d26d8440246b3949b32c24e4801432801c8f8a1663446b882967c8203930ddbf2282aad8553efd2109512051a475ef2b32c5c3477dea4d3251d8caba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
106ff0ed5b910eb853bff331505077c4

SHA1
982e041ae72a7006b140b6592e4ae10d6e69621d

SHA256
fc64ab1f54a46e346f956342d2a45ea919a4008283662ccf10af54b386f001dc

SHA512
c4a4ade4f538f8f2ac5e14aa7f7c2630b43285858334916ebc39643d13c42f57c973fec4ed14a9bf28e0e53e28c3903f70dab40d41f016fa3af5bca2210fe945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
12f598ba4eb63fe4b42106091c9f7442

SHA1
5028f5a2b8d2e1c5af7bf340d438b033b36b7c0e

SHA256
e89a2df552aa745d4d5e00429d255631e6c4d4aaf4a0667782714c18bd46a478

SHA512
935ff68f631b384af39f26862e4ce5484242b36b233b8b25ca4f12f77df4e9a8db9c3eca69f8ed2b68e922fe600e20cb9a84807f4e1b9a0732997352e1ad4201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
f965999d29edba85bcb35b97baa53f1f

SHA1
89dc663346ad1c2da49f247db7e770c67f3b92ca

SHA256
25db155a99e99473c982260efc1f0fb72e374370ae3b46cf533c9a97dbb4757d

SHA512
a9401e17c74eb04c9633b847723c27d37a6ab2e6f62a4e9f7e14e812add707dd36e19197c8d029d3ff1e0bb92c6d3f418cfafb6aa6ab4fc6340238492bc98d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
56409aa6d95414c18873bd617d88fd06

SHA1
fb18e9b7f164bcb3c6f62c6d8623c12a44749688

SHA256
efa8b135b1e22195339b3f70a2941cd374f21dbbd50c43f30bddfa016172b618

SHA512
6ccaa1f43623598359cf0c3e7a889119be24ce41874dfdba065230a5719002b76552e0725b85b05e73d14773fe85e3cf8446f11ff282ffaa0e587f77726cbb48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
fd20981c7184673929dfcab50885629b

SHA1
14c2437aad662b119689008273844bac535f946c

SHA256
28b7a1e7b492fff3e5268a6cd480721f211ceb6f2f999f3698b3b8cbd304bb22

SHA512
b99520bbca4d2b39f8bedb59944ad97714a3c9b8a87393719f1cbc40ed63c5834979f49346d31072c4d354c612ab4db9bf7f16e7c15d6802c9ea507d8c46af75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3c670f13-cd61-4218-b297-c5f3982dfa25\index-dir\the-real-index
Filesize
624B

MD5
518f3dbafede5c8e5af2e8b722b04a17

SHA1
0d66b993efa9e7de696730835006f7063e2cbad1

SHA256
19fded062fd14967601cd3fca5fb423d15bb52d95b3134605e9da73e5775463e

SHA512
9e18eceec1ed146299ad797fb75555cb764b4a55d10b83e8edb24db5751551ff7a68d85ec870079c5089f67d96d26ba21f676706df751fe071b222208283f7f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\3c670f13-cd61-4218-b297-c5f3982dfa25\index-dir\the-real-index~RFe592050.TMP
Filesize
48B

MD5
43c4c4304ebdc1042253c8bbcd5dd4c2

SHA1
d5bc0bd2760d32fe8110ba6397d81e4002378bd8

SHA256
e6a2a45df1f3d67da290063e47b5330487fcb703c39f5a31968d3954c07ce4ec

SHA512
bb2fb8ac8d59331fbb3b23c7a26a9a977e0ec67ec30641875f7bdb7e9717df62a1176ceb8d4adb2213e49124b34f35d89bce04450c165abfd53b4aa7c84d2455

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6c4ea2e7-d0b6-4854-bbcd-72d216b5d512\index-dir\the-real-index
Filesize
2KB

MD5
acf218623858cb8fb71ab54b042fb395

SHA1
9fdf0ad1c01b5a86953df438d241fc77ad336cff

SHA256
aa4f95e7048a02ef3ccb7d460245f6dcff384572001d96b96a5081e621995137

SHA512
22e41bf2686acfbc726fbc5ebceb66fd403298ffc3e5e512b7f2b8f05e5e3fe68c2b573a87e0f1b0b18b1132113d11b52629a558c7e2b0dbd06fbf13309ae7cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\6c4ea2e7-d0b6-4854-bbcd-72d216b5d512\index-dir\the-real-index~RFe592011.TMP
Filesize
48B

MD5
f7f6388dea3cc6b48ea724ccbdd05049

SHA1
7741c02e562a2fdae9f284fa34e28bf0442763cb

SHA256
27079c4f22ec3adb145d7962e47e86efef82cb46cd894d3692de37913610f8d6

SHA512
6d1af139b9bd13c110970d3e2aa333fa60a2435955eaae90982668d78800c739aba06f3ff4ba5cdccd77dadf44bbdae42cfb59523e0c40a884f811c2ffaa2985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\fd5535a4-30a8-40f3-b269-18376f9c0bfd\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
5853efbf898d0c176b3d1ff3ebda234f

SHA1
d25b53c3adeaaa0ce39db7b3021627b4e0fb8a21

SHA256
efc758f5f50b13890835221a60a7b85954df49205f6187fffa5e68c0cfaa949f

SHA512
754a5cc9a8e7d2321d9860c69e73c39c81d3a314533db08726bad14e33c799a0778e0f9ceed9ff74df685238d21826715de6d347d0669e4b1bf37283d2150cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
7e778291ae098bd0f31b1f62a3beb52c

SHA1
d342c42031d04f704d06eaf0d3be31c4512f3797

SHA256
91521bb7fe1f3f2e84999203d9c2ca8087d995afddea21f927f142e6b00855a3

SHA512
d5fe0397b901538871b6c5369bf36353556738bc8e50346a7348db3248649dad71f743e7958df405664edeb4268857942ceba01f9a582278da66fae81bf8a3ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
2a2e6f7e72ff9fb8f5fc11fd4e4ff8b6

SHA1
e28ad3f51946ec18ab455addde534f3d1019e2b2

SHA256
de82be72d0646bd117df0cd6d22af3cf3e9b1d53ae5aedbb01ac14d66c3def4d

SHA512
81debacfc446d15b96ccebb5699bf633c7fa28e490f5c46cda6b22b05ddcd81cb193d36f2b350c96a6558cb68318af35d425069fb4dee9a9e73de7b0d542cc81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
217B

MD5
baf224ff5c2ac4a929fb9a49cd4ed250

SHA1
18fadcb34d2c341f645c524c2a4ba368a86d82dc

SHA256
dc9adf7662073e9e9a05525e006149fc833216b0eefae2c50e1ef7d1e6869b8d

SHA512
77ed7d797bd7b30a5cf3aca69933ee44b9a441c611ceeaa88c8087cd6961bca5b8d38dd63468e71aafeb9b990ebc1a4662468facf0ecaf5e2de35cd7710fbc01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
153B

MD5
6bc2f854e36cedcaae8f40bcde3f2b8e

SHA1
1cbe92f1c71a737bfdb98316eef97658747abf7c

SHA256
1bd679fda1ad29da43ca3daa3d9f8e528e257ad31dac7824d0a0ee8889d93c55

SHA512
70e3b8445aa054f6930504688b6e3c6f665178fb9fd3b2b7855d9f45e63aee2bdfc4a3577cf0649332b8386b51957e0798d3fd1fd06b48b4c72b9c33bd9ce5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
153B

MD5
69970493b7ebda717018219dd71fe9ce

SHA1
c2e48ce83e333e7ea74dec89f3de7a3ed58622db

SHA256
92d970a1d1d356dd0dae77c6f2188cac9ddde074b229c2d1b93d66093e8e31c2

SHA512
eba470579c3883b8b2e6a3f6631fccc2aa805bf3ecb84f485809c2d67b019343e732b96c63738727b056c0b8a585d065782584f8ed63012a38d8a189ef1d1575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
155B

MD5
90afbf2a67509f5727a1b18783d2c282

SHA1
cc88a61589abb44e0c7d175cb6f5027a03093b59

SHA256
454c8c760bfef8fa271b1e61cc7511eb9cb4473f7ce9f473d7e642fa65cccbcd

SHA512
8ee518f011be006735b45bb4df0ff23d50cfb0659b89994bde391e7ef27e51f1de819fca9d804ad69570b102763d6431a7cd08188949c653dfb184867782dc05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
bfa42f7efe419165d3d535baa4aeb82e

SHA1
feacec5e2c527e994bd178e793442b64777a5c50

SHA256
075ac87d2c88601bb5ea9ed283630492dd5c7acb4230e08380eb6d1cf2fe8300

SHA512
94ab49a39c3a64bd85a7a01e5c6f7b45f6509d1c7f67b769892b0212c2a1d98e2b44c8a8c2c5b17e9a1ad220ccb7cb5ff8afd745934c5af4c3a0170d4f90d9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e2ca.TMP
Filesize
72B

MD5
014e47118e47b9b6b6988deb88018243

SHA1
a60ec53debc561bede1706b61428602197405d24

SHA256
9229641e306a8915134cb51b6ac24641677871d8286aa63d97fcb22c9760cb99

SHA512
8c290ee2dadbbd7645433511b375e838bd2bc4b7db691012ad37d4d48180c39b37dea59a9cdd28174e32bf718e012842d872e2d54d2318c3dd803ab65a36233c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
7616f0b8649dd3389c923062323d73cc

SHA1
3082cb5c939c7922b57a8363cb7f2f3126e4e934

SHA256
95e369a7e6dc25e039b58c1680c2d6af6261f1a7fa3496628dfe33ac7397f0d4

SHA512
7b135d646e0cd1a294200f0132502c65e452a234238bc2c59c2d133a3503e0c2b11dee2aed0428d1784e61523342b8b7e2cc3704ab7b5eb28e134c3b04096d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
fa356226721984b8855bba67ba285e26

SHA1
acf065d0d6034a05f555d1f504f32a1b62b3c34c

SHA256
cc7cbc93ce1d93792a7f07b3ce74143014b5c6af0b374e67477da478ddc4b894

SHA512
ecb0d8ad1665bc43b6f0e504fee690ad5219287252e8fbc1196bbf5421aa706e36357bd42a06502a2e42ff350dbee12ebb89063df48035c835a6849cccdd226d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
81b9a693a91ffa0721a69df39d126442

SHA1
85e512225c5dc8e8a1cae2a7a1ed6b25a2eab123

SHA256
3c86352302874dd49cb3bfc5086c74bd8666ac1b467248fee87ffd39a84d9fd8

SHA512
ce3e03ca1228338c502468fefee76772177022836b9c028120ea648d7bf3be317c12592a7f5de08dd210595e90e6e856adb063211902514b7a9f066c0082c7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
fa685caf5745be89ae8e4799f8acf48a

SHA1
2067e6641098c8f09cd682aef89c436adec1cfc1

SHA256
ad2dbc8ce99c7c0d90b142650803c90050757480c96b899418fee2dfcdaea02e

SHA512
e40fdf6acf63703a6d555a197c25b268d8aba0a90212db6acb4feefea2865dc35a5f28a1ee00d8ed38ccbf3d8e8f3ebd7d98aabf74c1673c905087f65a808dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
d054be05c616e9e03b6cb757958be4ef

SHA1
47f408735b7f49520fd8260c0c35d34c76c0d541

SHA256
14f2b9078b0de2be6a8bcbe9928aed6107d020eb83d9212d93e6b5a5976ebbda

SHA512
47dfe4c6c09286d4d4b553dee13b6b316a3ae223877e7558c1f7f2212cf2901fd81101a2739ff61308dbf8c57aae3111d4253a584d77493922b8821fac60e7a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
2f1971c231cae73269a4fdf34cb13edf

SHA1
1f95f99f360388c2e70b067b0b0004e60e4dd15a

SHA256
52d67fab776a9c3db6e0558aea2aa0ddba9d6bbceaaa2add09329eb1a762a8cd

SHA512
6d7a5381d870e452d4ead56ecb86493be822ba83cc2e3612f90928f949a29ef76f79ccfb9549c866f6fb3597a3ee91b38c1759cc1724d34e930c04c0de435a44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58a5b1.TMP
Filesize
1KB

MD5
e49bbdb99708c1ed4de2d7a46e213c95

SHA1
de6d9b31a0a40aa009acfc46f9478bad01db4acc

SHA256
46b50b9a8dc84246eeb1393d1173ed44d47bd88463647a1b43d56313f428c4d5

SHA512
a8729ab03d2190743ea7ecff366a89d86cc21a6e99ca3a45d4becc8438b19bf1db96cd031dc369f549244de8967c4ab2c8878913d6b3a13d5cb570889f9bf66d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
0a603ed490c39dcf121e2a83c6d95b71

SHA1
72747d3fe9b9c79e34ba8031dcb09c85b454dfd9

SHA256
00bd927620fbc16bef91705a011a2855ded7b809f31c44bc5ec765e61ffe2e26

SHA512
d839f6c6f0c40a64cdeb5226cb2c9e35b95b60e4633d9f1137ce1b03bf7117a1036fac785bf2cd9083cff0ea94ee5b103506c69963b4e68c117932fe7f21dc02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
c9e8fe512408a5593a068174d8bc5dd8

SHA1
748061394d552ccdcb67e994ff56afc9a5875d26

SHA256
0804a3359095f4b6b58376a7a0d769b210052c54e929cc3af80ba83fac22ac1d

SHA512
35d2436e4d89718e097ee79901f4ee2f0c747c6c97c1711e2904b02098cef88febb0eff0e7f84ed57b58dd4ee222f79e6543a9fbaa7916f4f9848ef92b8ee133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
ee78272e981a445b35066a4544a682c4

SHA1
e7e6f4211745618a9618f4171519329aed3ff47b

SHA256
dec5af0bf14ce99409469be1003c802bfd449f9baa95e15ba83f4fecbfe24a75

SHA512
49b0ac1641e9bf91aacb00134518406ff61c7ca40a86c1c1a6a7a0a504d424e2e11b39d5029d8c81d2cf61514194937a5ddc6542e461cff30f4152360cf6ce3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
b9023a2e0ca0f7a2442367d2fae84b46

SHA1
e8a1f804253c4567897c5ad56d569b206e9ec18c

SHA256
73810f25b4e38f94ebc8d52ea295d11de0801c93d4b09e7082e791ec36376bef

SHA512
f00b558157b235b6106819deaccc44ce452fa2fcc0253c4ace3c67832d44ec2091e1d0459e0bb81962a05f6f48d3f11db15971796a3e15dd8bce6e8ba3441733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
b9023a2e0ca0f7a2442367d2fae84b46

SHA1
e8a1f804253c4567897c5ad56d569b206e9ec18c

SHA256
73810f25b4e38f94ebc8d52ea295d11de0801c93d4b09e7082e791ec36376bef

SHA512
f00b558157b235b6106819deaccc44ce452fa2fcc0253c4ace3c67832d44ec2091e1d0459e0bb81962a05f6f48d3f11db15971796a3e15dd8bce6e8ba3441733

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.1MB

MD5
0377dfbfa3dd6709118f35d1d0c33b71

SHA1
194dcc880ec2a9d7cadd51c27858ef2c3a2f087a

SHA256
b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632

SHA512
c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\360F.exe
Filesize
1.7MB

MD5
8e7ac64d43db0af7417f98499782fe74

SHA1
37e3133476cb9009fddd5873b44806b100e70b13

SHA256
b084e2f2a893e386fec723c421dceb58e1727c8d8530bd33484707955aafbfc3

SHA512
08ace0cd4268c912008110faa78abcdcb4dae63e0a9dac8aa79cc67781a4b292f12a0fb9a60c35aaef9b4fa60eb52c475bdc4f95d46a98c31c7dc49b13a0824a

Download Submit
C:\Users\Admin\AppData\Local\Temp\360F.exe
Filesize
1.7MB

MD5
8e7ac64d43db0af7417f98499782fe74

SHA1
37e3133476cb9009fddd5873b44806b100e70b13

SHA256
b084e2f2a893e386fec723c421dceb58e1727c8d8530bd33484707955aafbfc3

SHA512
08ace0cd4268c912008110faa78abcdcb4dae63e0a9dac8aa79cc67781a4b292f12a0fb9a60c35aaef9b4fa60eb52c475bdc4f95d46a98c31c7dc49b13a0824a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3739.bat
Filesize
342B

MD5
e79bae3b03e1bff746f952a0366e73ba

SHA1
5f547786c869ce7abc049869182283fa09f38b1d

SHA256
900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63

SHA512
c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

Download Submit
C:\Users\Admin\AppData\Local\Temp\3805.exe
Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\3805.exe
Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\38F0.exe
Filesize
219KB

MD5
1aba285cb98a366dc4be21585eecd62a

SHA1
c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b

SHA256
ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8

SHA512
9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

Download Submit
C:\Users\Admin\AppData\Local\Temp\38F0.exe
Filesize
219KB

MD5
1aba285cb98a366dc4be21585eecd62a

SHA1
c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b

SHA256
ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8

SHA512
9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

Download Submit
C:\Users\Admin\AppData\Local\Temp\6205.exe
Filesize
12.6MB

MD5
699c65fed2ca6370f86d5da5f70ee9c2

SHA1
f27c46e0e5bf076326392f0f4e1976f8ecd6db35

SHA256
f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d

SHA512
87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

Download Submit
C:\Users\Admin\AppData\Local\Temp\6205.exe
Filesize
12.6MB

MD5
699c65fed2ca6370f86d5da5f70ee9c2

SHA1
f27c46e0e5bf076326392f0f4e1976f8ecd6db35

SHA256
f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d

SHA512
87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

Download Submit
C:\Users\Admin\AppData\Local\Temp\80D8.exe
Filesize
499KB

MD5
ed1e95debacead7bec24779f6549744a

SHA1
d1becd6ca86765f9e82c40d8f698c07854b32a45

SHA256
e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651

SHA512
32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\80D8.exe
Filesize
499KB

MD5
ed1e95debacead7bec24779f6549744a

SHA1
d1becd6ca86765f9e82c40d8f698c07854b32a45

SHA256
e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651

SHA512
32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\811856890180
Filesize
87KB

MD5
d720ede8cd49211ae22083cd01a0a9ee

SHA1
98e3411297196d7c7606cd4bcabd49ad73c73913

SHA256
f78e4277f97001c462bef9df419067f06982ef5c9027e1fd46ce287053053f13

SHA512
8c63206dfdab1d2f8424d28da3fc336998b74e0aa2fc6397f9360c1ffe97f9c99adf2e28fd2496901ba3177686db31808b6d3b149b333c145f1f6065ef8713c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\86F4.exe
Filesize
95KB

MD5
0592c6d7674c77b053080c5b6e79fdcb

SHA1
693339ede19093e2b4593fda93be0b140be69141

SHA256
fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14

SHA512
37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\86F4.exe
Filesize
95KB

MD5
0592c6d7674c77b053080c5b6e79fdcb

SHA1
693339ede19093e2b4593fda93be0b140be69141

SHA256
fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14

SHA512
37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4OZ818HH.exe
Filesize
1.1MB

MD5
8f50af5616ca037fb0918b418cc35ea7

SHA1
9c03eb5f5c932b898c7ffd811af1d22c3d3e83d1

SHA256
85ba1f0f30d0cc69ae8b9f45716b2c112d41a4c041c15e37276a668d3e0b2f89

SHA512
455f5f591ea07379123736886517407451b3c930a0bc47fdcee60bc5265b81d7ccf09492793ef2bdc57803631d47f1e7533ebf70ef9441ada896299f7f48c263

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4OZ818HH.exe
Filesize
1.1MB

MD5
8f50af5616ca037fb0918b418cc35ea7

SHA1
9c03eb5f5c932b898c7ffd811af1d22c3d3e83d1

SHA256
85ba1f0f30d0cc69ae8b9f45716b2c112d41a4c041c15e37276a668d3e0b2f89

SHA512
455f5f591ea07379123736886517407451b3c930a0bc47fdcee60bc5265b81d7ccf09492793ef2bdc57803631d47f1e7533ebf70ef9441ada896299f7f48c263

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GK6mr22.exe
Filesize
652KB

MD5
a6220d9911be7dd1270bb7f84059bf27

SHA1
feafce3425893eae59a3bad907c9851b7a1b3b44

SHA256
4e3603a9bb97e1cf3695dd1c8b03fd9d0cd0022bbc6f240681aa72f786893c87

SHA512
13c93fabb5958d1619eda6ca25b8eb7d7c2bcb8d442e5975e0bf36cd2093cf2aed8f609f6075969741751c0d3971eef599116e6c32147b63f8170fb30a9c6051

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GK6mr22.exe
Filesize
652KB

MD5
a6220d9911be7dd1270bb7f84059bf27

SHA1
feafce3425893eae59a3bad907c9851b7a1b3b44

SHA256
4e3603a9bb97e1cf3695dd1c8b03fd9d0cd0022bbc6f240681aa72f786893c87

SHA512
13c93fabb5958d1619eda6ca25b8eb7d7c2bcb8d442e5975e0bf36cd2093cf2aed8f609f6075969741751c0d3971eef599116e6c32147b63f8170fb30a9c6051

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3dJ29Ej.exe
Filesize
31KB

MD5
54cda63d15369bc055a40439aafcee6b

SHA1
0ba1c30c648a51776ceaf8042ce37095347eadb8

SHA256
4cbd6cc51703cf70afdae6f4d8fe0529c2746c4d20078b10999457f009620e64

SHA512
156a4a790d711ef6622359e01ca8f0585d664ddeae87b0dab750ae8b3d14615913fd28c97c1ab4cb467e96f6d4c862ecb750df58d892c267f0f5e5b191e31bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3dJ29Ej.exe
Filesize
31KB

MD5
54cda63d15369bc055a40439aafcee6b

SHA1
0ba1c30c648a51776ceaf8042ce37095347eadb8

SHA256
4cbd6cc51703cf70afdae6f4d8fe0529c2746c4d20078b10999457f009620e64

SHA512
156a4a790d711ef6622359e01ca8f0585d664ddeae87b0dab750ae8b3d14615913fd28c97c1ab4cb467e96f6d4c862ecb750df58d892c267f0f5e5b191e31bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AN3jW6Zq.exe
Filesize
1.6MB

MD5
d0854d9856550e5c0d1877c2c3cab14c

SHA1
b708098edb6ec177df59a976159bf6e53a7120eb

SHA256
843135ccc0cb3344c4fcab4e78a96697012ac2899b9f3201cece60bd42fd63be

SHA512
21ccc82fb6fe35e4595709cb2140460a2bcdf94d1cab05afe7dff8b19d6d6dbac356132d5ad2eec38b0154cadb7f944d80898a3dc8ce93ec0a8103c6abf45d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\AN3jW6Zq.exe
Filesize
1.6MB

MD5
d0854d9856550e5c0d1877c2c3cab14c

SHA1
b708098edb6ec177df59a976159bf6e53a7120eb

SHA256
843135ccc0cb3344c4fcab4e78a96697012ac2899b9f3201cece60bd42fd63be

SHA512
21ccc82fb6fe35e4595709cb2140460a2bcdf94d1cab05afe7dff8b19d6d6dbac356132d5ad2eec38b0154cadb7f944d80898a3dc8ce93ec0a8103c6abf45d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu1LB04.exe
Filesize
528KB

MD5
e328ede8a2e64f153d5c53146d2f88e0

SHA1
84bea53a645939eb8705435b7d4129d7c1fb9e9d

SHA256
9ac50c337f6887a185efe174ecacf4d714b0c2cfd580d6236003ef230bcaf375

SHA512
e3d8641248c6054ac07c7a6bce39827597b034a9fe727bf14a42d14f255d462532a726fdab0716b98fdc4f446cde5fc6d2bf55c3b78ca5e168d9391c8fc066ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Eu1LB04.exe
Filesize
528KB

MD5
e328ede8a2e64f153d5c53146d2f88e0

SHA1
84bea53a645939eb8705435b7d4129d7c1fb9e9d

SHA256
9ac50c337f6887a185efe174ecacf4d714b0c2cfd580d6236003ef230bcaf375

SHA512
e3d8641248c6054ac07c7a6bce39827597b034a9fe727bf14a42d14f255d462532a726fdab0716b98fdc4f446cde5fc6d2bf55c3b78ca5e168d9391c8fc066ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1js24KF3.exe
Filesize
869KB

MD5
5f246615a0a756b59522eaa3e198a280

SHA1
889d90ae922e79780334cba5302ed6ab7b679805

SHA256
cf81ab43686d20d25deaa24bf93565359758effc74074545490d2e4d5e7d62cf

SHA512
f1e1c239835f71e8f0caefbd4db0d4308fe31f84a378dffa8b65a1b38de06358d02a6f253687520acb7c271fddc0c9d467d1f1801fa20ec6eaacee402f43d998

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1js24KF3.exe
Filesize
869KB

MD5
5f246615a0a756b59522eaa3e198a280

SHA1
889d90ae922e79780334cba5302ed6ab7b679805

SHA256
cf81ab43686d20d25deaa24bf93565359758effc74074545490d2e4d5e7d62cf

SHA512
f1e1c239835f71e8f0caefbd4db0d4308fe31f84a378dffa8b65a1b38de06358d02a6f253687520acb7c271fddc0c9d467d1f1801fa20ec6eaacee402f43d998

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Yy0261.exe
Filesize
1.0MB

MD5
3192aac1e3241388e3a3e1d3cdcbe104

SHA1
c81bc75de2226594242ebde2f04fe764a2f29b51

SHA256
be051c463bfee6c1bd5ef760b0b9dca486fa14578f83079fc64da31b04689660

SHA512
7e099fbaeef3b58376a1ac82c6eda49dc09393cee3b201df40aa142dcee44e5317e6612e1e75c3a8b8e91ad0145e61e3da3b98211e0fef3b84c02e1d6268838e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Yy0261.exe
Filesize
1.0MB

MD5
3192aac1e3241388e3a3e1d3cdcbe104

SHA1
c81bc75de2226594242ebde2f04fe764a2f29b51

SHA256
be051c463bfee6c1bd5ef760b0b9dca486fa14578f83079fc64da31b04689660

SHA512
7e099fbaeef3b58376a1ac82c6eda49dc09393cee3b201df40aa142dcee44e5317e6612e1e75c3a8b8e91ad0145e61e3da3b98211e0fef3b84c02e1d6268838e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wc4Vv5zZ.exe
Filesize
1.4MB

MD5
1319f7684a18ec46814b0ac2263c66c2

SHA1
8b03721b6ec259bcfe172a4ddd702c6b6903b2e1

SHA256
1ecc85a6367bfe1b1cde77d25d259903b9b93159d95516e703b52af3dcf859b9

SHA512
d59293ef5ee7123fda20779aa006d570c94e618665e1cdf3446f15baf88dd3d407e43b4e48515d26551948680f6634bec9aaf9ff211a20ce198ad97fe462eb8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Wc4Vv5zZ.exe
Filesize
1.4MB

MD5
1319f7684a18ec46814b0ac2263c66c2

SHA1
8b03721b6ec259bcfe172a4ddd702c6b6903b2e1

SHA256
1ecc85a6367bfe1b1cde77d25d259903b9b93159d95516e703b52af3dcf859b9

SHA512
d59293ef5ee7123fda20779aa006d570c94e618665e1cdf3446f15baf88dd3d407e43b4e48515d26551948680f6634bec9aaf9ff211a20ce198ad97fe462eb8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ea2Vy9AH.exe
Filesize
882KB

MD5
c0aee186732f40cc2cbb91f7fdc52dfa

SHA1
c976f6014e547caa047030c17280b6d88b499a3f

SHA256
db8d16b08433d29eacaa319fc65ac1f8d762a8ba1625979f519c20fabd4dd069

SHA512
bccd13e5b89979595d9cbfaf6f861177d306f74afe4bf5ee557de50953d3a5e5ffb1c83549a2de6186e7bcb6e63c56042ad48d3661329726c5e9c11001cebf21

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ea2Vy9AH.exe
Filesize
882KB

MD5
c0aee186732f40cc2cbb91f7fdc52dfa

SHA1
c976f6014e547caa047030c17280b6d88b499a3f

SHA256
db8d16b08433d29eacaa319fc65ac1f8d762a8ba1625979f519c20fabd4dd069

SHA512
bccd13e5b89979595d9cbfaf6f861177d306f74afe4bf5ee557de50953d3a5e5ffb1c83549a2de6186e7bcb6e63c56042ad48d3661329726c5e9c11001cebf21

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ef6OF8Gr.exe
Filesize
687KB

MD5
d2d04be11ac1c625e4cc7a952bb616cf

SHA1
b9480c795176bd39ef6631f7308c21291c9c1f23

SHA256
9ea5115c7304555fb62f20e0264b03973f9f0bcc41492064a034243b5fb4970b

SHA512
74c31d5e6db6ac2f58f199ea4ed1c8416d6a8112099f0affbce4bff2407edb2ed940afbbe625ec3cfd17f71b92a3568cf7377e9b9a141a0b310114eeaf5c6c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ef6OF8Gr.exe
Filesize
687KB

MD5
d2d04be11ac1c625e4cc7a952bb616cf

SHA1
b9480c795176bd39ef6631f7308c21291c9c1f23

SHA256
9ea5115c7304555fb62f20e0264b03973f9f0bcc41492064a034243b5fb4970b

SHA512
74c31d5e6db6ac2f58f199ea4ed1c8416d6a8112099f0affbce4bff2407edb2ed940afbbe625ec3cfd17f71b92a3568cf7377e9b9a141a0b310114eeaf5c6c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1os31GD9.exe
Filesize
1.8MB

MD5
b8602a827093638f928e1b7896c67998

SHA1
f86417c0524ac41088a9645281a97deaa1a9a3ed

SHA256
0e63ed6a64ab9a67cf9bd50ec6168ce2e9882314452325982b6bb87691f2e177

SHA512
6a8655f12cb6267da2a3c14b7cab806af31ca85ec5c4856dc0a7c727e16572baa0501ed146da97e129019e3d00370b58cc4867ad49624e6bbca45c70a30631e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1os31GD9.exe
Filesize
1.8MB

MD5
b8602a827093638f928e1b7896c67998

SHA1
f86417c0524ac41088a9645281a97deaa1a9a3ed

SHA256
0e63ed6a64ab9a67cf9bd50ec6168ce2e9882314452325982b6bb87691f2e177

SHA512
6a8655f12cb6267da2a3c14b7cab806af31ca85ec5c4856dc0a7c727e16572baa0501ed146da97e129019e3d00370b58cc4867ad49624e6bbca45c70a30631e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2La264aw.exe
Filesize
219KB

MD5
11af49bc49fce79382d86c9a4d462b50

SHA1
6f481057f3dcdedda1f2d4c7c198cac5722a4a70

SHA256
3bb71d21eb7a975c821779518d0388a8810fd3cff7a3e362b465ef3f1d01cdce

SHA512
5b24640c02c2e68a7ab828199309c2d1f17aac0fff2e1a90bb33711afbce4330bc8241f7435d133b0ffa097c411acccfa3778f3f90e085b969fce3b7e898011e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2La264aw.exe
Filesize
219KB

MD5
11af49bc49fce79382d86c9a4d462b50

SHA1
6f481057f3dcdedda1f2d4c7c198cac5722a4a70

SHA256
3bb71d21eb7a975c821779518d0388a8810fd3cff7a3e362b465ef3f1d01cdce

SHA512
5b24640c02c2e68a7ab828199309c2d1f17aac0fff2e1a90bb33711afbce4330bc8241f7435d133b0ffa097c411acccfa3778f3f90e085b969fce3b7e898011e

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
Filesize
2.5MB

MD5
032a919dff4e6ba21c24d11a423b112c

SHA1
cbaa859c0afa6b4c0d2a288728e653e324e80e90

SHA256
12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553

SHA512
0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
Filesize
4.7MB

MD5
f514e32558ae7b07969a99b2aed8165d

SHA1
18a6cd2b777b8edda0c2644a7c2bde71f06d8f86

SHA256
e2d95c441c6a1cadd0e765bfec2a9c2ab8606173164f72149e5f845aa914c858

SHA512
29b37cbcfcda41f8e882e180a18618c381bb2b249791b6e9399dadd070d680187f45aca652bca6e9e9145a3c305e84a9775ad3434b3830965f72868196d0c562

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3rjkzmk.lju.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe
Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE00B.tmp
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE09E.tmp
Filesize
92KB

MD5
985339a523cfa3862ebc174380d3340c

SHA1
73bf03c8f7bc58b4e28bcbfdd1c2ba52dea5dfb7

SHA256
57c7f10cd97c8db447281ad0f47d4694035056e050b85b81f5a5124f461621a2

SHA512
b5d34c43330f8070b3f353c826a54aecd99b7129a214913a365b66009a1a6744093bf085d3f86681ed40c714d6ebdfff40d99d7bd7a3508a0a0caed6304ac27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE175.tmp
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE17B.tmp
Filesize
20KB

MD5
cb3aad56d2464e03efde5ccd41a6dc4d

SHA1
1ce719c7dd02d2ba810b09dc3a6ad586b0cc414f

SHA256
ea425685d2eb2b7f86527cb7f235e93a6a603a9234cb2a6e2372c32fc4ab4d07

SHA512
5ebe93fdf0af16dad4dbe719cbc4b62aa7377528fb03db88f6572dfc21217c7137d2b0bba385e2fea645900149be60ebbb6734583854b4454d6bc6003d07c8c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE248.tmp
Filesize
116KB

MD5
83db691b5c5409dd2ec2b3ebddc463ac

SHA1
6d9dc900c0cf292b1fec7f4cd4b6a5929e21bdc1

SHA256
1e00dc04692e288d32cc9874a0f19d06b7a101fcdfa4d37b9bb645c4fff3e10f

SHA512
c31ffad7cf68b9518b4e453858c12c3f36c596748b63e1bd18b6cbab4656d0c5302fe6d798691172b9f8c21aaf3d7d788968ec7f6d824a70516b63455d689e3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE2A2.tmp
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
250KB

MD5
020ad283a781f7ff82b32ca785d890e4

SHA1
6c0dfa83de61c67bddef5d35ddefac9eacf60dc3

SHA256
9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629

SHA512
b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll
Filesize
102KB

MD5
8da053f9830880089891b615436ae761

SHA1
47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4

SHA256
d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374

SHA512
69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll
Filesize
1.2MB

MD5
0111e5a2a49918b9c34cbfbf6380f3f3

SHA1
81fc519232c0286f5319b35078ac3bb381311bd4

SHA256
4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c

SHA512
a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5

Download Submit
\??\pipe\LOCAL\crashpad_1516_DUSTHMLDABYSPPOV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4432_BKSVVDOXQMSFIHFD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/644-56-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/644-49-0x0000000007CA0000-0x0000000007DAA000-memory.dmp

Filesize
1.0MB

Download
memory/644-45-0x00000000071E0000-0x0000000007272000-memory.dmp

Filesize
584KB

Download
memory/644-46-0x0000000007460000-0x0000000007470000-memory.dmp

Filesize
64KB

Download
memory/644-47-0x00000000073C0000-0x00000000073CA000-memory.dmp

Filesize
40KB

Download
memory/644-48-0x00000000082C0000-0x00000000088D8000-memory.dmp

Filesize
6.1MB

Download
memory/644-44-0x00000000076F0000-0x0000000007C94000-memory.dmp

Filesize
5.6MB

Download
memory/644-57-0x0000000007460000-0x0000000007470000-memory.dmp

Filesize
64KB

Download
memory/644-42-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/644-53-0x0000000007690000-0x00000000076DC000-memory.dmp

Filesize
304KB

Download
memory/644-52-0x0000000007650000-0x000000000768C000-memory.dmp

Filesize
240KB

Download
memory/644-43-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/644-50-0x00000000075F0000-0x0000000007602000-memory.dmp

Filesize
72KB

Download
memory/704-267-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/704-129-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/704-128-0x00000000001D0000-0x000000000020C000-memory.dmp

Filesize
240KB

Download
memory/704-135-0x0000000007200000-0x0000000007210000-memory.dmp

Filesize
64KB

Download
memory/704-259-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/1392-1585-0x00007FF705C30000-0x00007FF706596000-memory.dmp

Filesize
9.4MB

Download
memory/2176-51-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/2176-55-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/2176-25-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/2176-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2976-341-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/2976-907-0x00000000068E0000-0x0000000006956000-memory.dmp

Filesize
472KB

Download
memory/2976-340-0x00000000005E0000-0x00000000005FE000-memory.dmp

Filesize
120KB

Download
memory/2976-641-0x00000000063E0000-0x0000000006446000-memory.dmp

Filesize
408KB

Download
memory/2976-368-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/2976-633-0x0000000006B50000-0x000000000707C000-memory.dmp

Filesize
5.2MB

Download
memory/2976-627-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

Filesize
64KB

Download
memory/2976-1089-0x0000000007570000-0x00000000075C0000-memory.dmp

Filesize
320KB

Download
memory/2976-625-0x0000000006450000-0x0000000006612000-memory.dmp

Filesize
1.8MB

Download
memory/2976-966-0x0000000006B10000-0x0000000006B2E000-memory.dmp

Filesize
120KB

Download
memory/2976-547-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/3148-1214-0x0000000002930000-0x0000000002946000-memory.dmp

Filesize
88KB

Download
memory/3148-35-0x0000000002230000-0x0000000002246000-memory.dmp

Filesize
88KB

Download
memory/3332-843-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3332-823-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3332-808-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3604-973-0x0000000000AB0000-0x0000000000BB0000-memory.dmp

Filesize
1024KB

Download
memory/3604-974-0x00000000008E0000-0x00000000008E9000-memory.dmp

Filesize
36KB

Download
memory/4572-106-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4572-108-0x0000000000FB0000-0x0000000000FEC000-memory.dmp

Filesize
240KB

Download
memory/4572-252-0x0000000007CE0000-0x0000000007CF0000-memory.dmp

Filesize
64KB

Download
memory/4572-248-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4572-112-0x0000000007CE0000-0x0000000007CF0000-memory.dmp

Filesize
64KB

Download
memory/4592-115-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4592-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4592-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4592-116-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4608-36-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4608-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4704-34-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4704-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4704-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4704-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4812-359-0x00000000005E0000-0x000000000063A000-memory.dmp

Filesize
360KB

Download
memory/4812-342-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4812-384-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4812-492-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4812-471-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4888-299-0x0000000000D20000-0x00000000019B4000-memory.dmp

Filesize
12.6MB

Download
memory/4888-298-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/4888-465-0x0000000074AB0000-0x0000000075260000-memory.dmp

Filesize
7.7MB

Download
memory/5860-1709-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/5972-1584-0x0000000000560000-0x000000000059C000-memory.dmp

Filesize
240KB

Download
memory/6220-976-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6220-1215-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6220-978-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6232-1088-0x0000000002DE0000-0x00000000036CB000-memory.dmp

Filesize
8.9MB

Download
memory/6232-1422-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/6232-1188-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/6232-1283-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/6232-985-0x00000000028E0000-0x0000000002CE0000-memory.dmp

Filesize
4.0MB

Download
memory/6232-1165-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/6240-1229-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/6240-757-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/6240-462-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/6324-453-0x0000000000FE0000-0x0000000000FE8000-memory.dmp

Filesize
32KB

Download
memory/6324-464-0x00000000017F0000-0x0000000001800000-memory.dmp

Filesize
64KB

Download
memory/6324-460-0x00007FF9F06E0000-0x00007FF9F11A1000-memory.dmp

Filesize
10.8MB

Download
memory/6324-642-0x00007FF9F06E0000-0x00007FF9F11A1000-memory.dmp

Filesize
10.8MB

Download
memory/6420-1487-0x00007FF628710000-0x00007FF628CB1000-memory.dmp

Filesize
5.6MB

Download
memory/6464-1803-0x00007FF6D8D00000-0x00007FF6D92A1000-memory.dmp

Filesize
5.6MB

Download
memory/6580-977-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/6580-635-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/6672-900-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/6672-960-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/6672-1802-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/6696-1801-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/6696-666-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download