mystic | 099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1

Analysis

max time kernel
2s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2023 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1.exe
Size

1.4MB
MD5

81e316aa4ad2b21b86ee294b728f6feb
SHA1

b1c88a94cb2f11d5ca19c25d73a5d811a523ad92
SHA256

099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1
SHA512

0c7e67191e49329fde123d052bdc1e85558d3cde48ef44c6bccfb0f8a4017e3b9ee9c7edc623da6ecce088ba21127c8aac0699f91ac4aa78beb927e1e2e4195f
SSDEEP

24576:yyW03Kg4GLQvrveaIsXxYGmy1DMWKnc4TJyfsd76yfNARB9kSgrit/lK:ZWDgL+Dehq6GnIJTkfsh6yfNAf0iRl

Score

10^/10

mystic raccoon redline sectoprat smokeloader @ytlogsbot c78f27a0d43f29dbd112dbd9e387406b livetrafic pixelfresh taiga up3 backdoor evasion infostealer persistence rat stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://5.42.92.190/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Extracted

Family

redline

Botnet

pixelfresh

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

raccoon

Botnet

c78f27a0d43f29dbd112dbd9e387406b

http://31.192.237.23:80/

http://193.233.132.12:80/

Attributes

user_agent
SunShineMoonLight

xor.plain

Extracted

Family

redline

Botnet

@ytlogsbot

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTrafic

195.10.205.16:1056

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/6288-243-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/6288-245-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/6288-247-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/6288-250-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer payload 2 IoCs

resource	yara_rule
behavioral1/memory/2088-1114-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon
behavioral1/memory/2088-1118-0x0000000000400000-0x000000000041B000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/5224-359-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/5812-590-0x0000000000D00000-0x0000000000D1E000-memory.dmp	family_redline
behavioral1/memory/2368-1035-0x0000000000540000-0x000000000059A000-memory.dmp	family_redline
behavioral1/memory/4400-1231-0x00000000005C0000-0x00000000005FE000-memory.dmp	family_redline
behavioral1/memory/4216-1341-0x0000000000750000-0x000000000078C000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/5812-590-0x0000000000D00000-0x0000000000D1E000-memory.dmp	family_sectoprat

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4900	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
3432	gy8JA04.exe
3532	Gy2Fw50.exe
4684	Hf0qQ44.exe
1460	1Nv96Vs4.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	gy8JA04.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Gy2Fw50.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Hf0qQ44.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000022d86-27.dat	autoit_exe
behavioral1/files/0x0007000000022d86-26.dat	autoit_exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6552	6288	WerFault.exe	114
6836	2368	WerFault.exe	185
6868	4636	WerFault.exe	184

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3516	schtasks.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1460	1Nv96Vs4.exe
1460	1Nv96Vs4.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1460	1Nv96Vs4.exe
1460	1Nv96Vs4.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 3432	4760	NEAS.099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1.exe	27
PID 4760 wrote to memory of 3432	4760	NEAS.099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1.exe	27
PID 4760 wrote to memory of 3432	4760	NEAS.099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1.exe	27
PID 3432 wrote to memory of 3532	3432	gy8JA04.exe	28
PID 3432 wrote to memory of 3532	3432	gy8JA04.exe	28
PID 3432 wrote to memory of 3532	3432	gy8JA04.exe	28
PID 3532 wrote to memory of 4684	3532	Gy2Fw50.exe	30
PID 3532 wrote to memory of 4684	3532	Gy2Fw50.exe	30
PID 3532 wrote to memory of 4684	3532	Gy2Fw50.exe	30
PID 4684 wrote to memory of 1460	4684	Hf0qQ44.exe	29
PID 4684 wrote to memory of 1460	4684	Hf0qQ44.exe	29
PID 4684 wrote to memory of 1460	4684	Hf0qQ44.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.099c137bcd7e60aab4e147ae2df14501db9e1d0005f756ecd92a973189ecaab1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gy8JA04.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gy8JA04.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gy2Fw50.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gy2Fw50.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hf0qQ44.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hf0qQ44.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Qq4249.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Qq4249.exe
        5⤵
        
        PID:5872
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6288 -s 540
        7⤵
        Program crash
        
        PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7SF89fA.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7SF89fA.exe
      4⤵
      PID:6444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8Mt561eS.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8Mt561eS.exe
    3⤵
    PID:6176
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5440
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9XX1gK3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9XX1gK3.exe
  2⤵
  PID:6744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:5548

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nv96Vs4.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nv96Vs4.exe
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x174,0x178,0x17c,0x150,0x180,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:1304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
    3⤵
    PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
    3⤵
    PID:5972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:5728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:2080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
    3⤵
    PID:7160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
    3⤵
    PID:7152
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8020 /prefetch:8
    3⤵
    PID:6280
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8020 /prefetch:8
    3⤵
    PID:6320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7896 /prefetch:1
    3⤵
    PID:6564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1
    3⤵
    PID:6516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7556 /prefetch:1
    3⤵
    PID:7088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7388 /prefetch:1
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8321782355903924607,4931500218450437275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4088 /prefetch:2
    3⤵
    PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
  2⤵
  PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10815899635672011273,852140616874283334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 /prefetch:3
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10815899635672011273,852140616874283334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5266468869395278368,3674187292073794939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login/
  2⤵
  PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12525786894137193568,4702605860113705000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:5636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12525786894137193568,4702605860113705000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
    3⤵
    PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
  2⤵
  PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,4476755081958410220,11006277600878261258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
    3⤵
    PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
  2⤵
  PID:5748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
  2⤵
  PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x16c,0x170,0x174,0x148,0x40,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
  2⤵
  PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
    3⤵
    PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform/
  2⤵
  PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
1⤵
PID:1688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffcd7e846f8,0x7ffcd7e84708,0x7ffcd7e84718
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6288 -ip 6288
1⤵
PID:6512

C:\Users\Admin\AppData\Local\Temp\B12A.exe
C:\Users\Admin\AppData\Local\Temp\B12A.exe
1⤵
PID:2136
- C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
  2⤵
  PID:6392
- - C:\Users\Admin\AppData\Local\Temp\Broom.exe
    C:\Users\Admin\AppData\Local\Temp\Broom.exe
    3⤵
    PID:4004
- C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
  2⤵
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    PID:6936
- C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
  "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
  2⤵
  PID:4764
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    PID:5640
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:6680
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      PID:5840
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4900
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:6508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4620
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      PID:4984
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:5544
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2220
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:6616
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:3516
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        
        PID:6760

C:\Users\Admin\AppData\Local\Temp\B39C.exe
C:\Users\Admin\AppData\Local\Temp\B39C.exe
1⤵
PID:5812

C:\Users\Admin\AppData\Local\Temp\5B57.exe
C:\Users\Admin\AppData\Local\Temp\5B57.exe
1⤵
PID:6544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  2⤵
  PID:4400

C:\Users\Admin\AppData\Local\Temp\6923.exe
C:\Users\Admin\AppData\Local\Temp\6923.exe
1⤵
PID:4636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1184
  2⤵
  - Program crash
  PID:6868

C:\Users\Admin\AppData\Local\Temp\6B76.exe
C:\Users\Admin\AppData\Local\Temp\6B76.exe
1⤵
PID:2368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 784
  2⤵
  - Program crash
  PID:6836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2368 -ip 2368
1⤵
PID:7040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4636 -ip 4636
1⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\EA0D.exe
C:\Users\Admin\AppData\Local\Temp\EA0D.exe
1⤵
PID:6684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  2⤵
  PID:4216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8992ae6e99b277eea6fb99c4f267fa3f

SHA1
3715825c48f594068638351242fac7fdd77c1eb7

SHA256
525038333c02dff407d589fa407b493b7962543e205c587feceefbc870a08e3d

SHA512
a1f44fff4ea76358c7f2a909520527ec0bbc3ddcb722c5d1f874e03a0c4ac42dac386a49ccf72807ef2fa6ccc534490ad90de2f699b1e49f06f79157f251ab25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
21KB

MD5
7d75a9eb3b38b5dd04b8a7ce4f1b87cc

SHA1
68f598c84936c9720c5ffd6685294f5c94000dff

SHA256
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

SHA512
cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
186KB

MD5
740a924b01c31c08ad37fe04d22af7c5

SHA1
34feb0face110afc3a7673e36d27eee2d4edbbff

SHA256
f0e1953b71cc4abbffdd5096d99dfb274688e517c381b15c3446c28a4ac416e0

SHA512
da7061f944c69245c2f66b0e6a8b5a9bca91bda8a73f99734dcb23db56c5047de796fa7e348ff8840d9ac123436e38a4206408573215b7e5e98942ea6d66bb7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
33KB

MD5
fdbf5bcfbb02e2894a519454c232d32f

SHA1
5e225710e9560458ac032ab80e24d0f3cb81b87a

SHA256
d9315d0678ac213bbe2c1de27528f82fd40dbff160f5a0c19850f891da29ea1c

SHA512
9eb86ebb1b50074df9bd94f7660df6f362b5a46411b35ce820740f629f8ef77f0b49a95c5550441a7db2b2638f0ed3d0204cb8f8c76391c05401506833b8c916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

Filesize
225KB

MD5
278ce13b5f7ac97240d5637771dc0cb2

SHA1
8c7968e288fa6c7b285da953f67c77bc699a2032

SHA256
6b97bc303716881d1abeefbfb6bb32900cf139dbc83640c53686aa23d6867e35

SHA512
65e08bc5fcec3c20facd631cc0bd7004520583521e4b3616d32f5922d2409ad8e444fc0e83cda4e7af41c6506dac431265bf2b588156937a7b7e6cd0507d67bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4d2678c425bfc3d95a3da07147841fbe

SHA1
f63f36101f649d8f27ed1ff11ce01d2062f52f73

SHA256
8a426f7fd63442181a1c4394b550ae7050ac9aa83e1394080e5bf0816f2c4553

SHA512
2e6444c5f94023350338642cc6c7d3dbf181df528534c7ebf1a2d83b93c411a487bf87640fe655857431229ded9d16bc0164fa54551400b1325c2e999514bb3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7b1c8690a0af671912eb5c69f19a7781

SHA1
7cc6a9a977d73953528ce6ff8c19602a88098b76

SHA256
5c8a820cad770fa7972c837b063352c164d42272341eb5d425b73dbfb655c170

SHA512
36efdaca798ac44b9b1ae9cb1aa74f90a40a5018911b77cecd112d4611f5f9c30d89e572c81fd9feba8bbc5f06ab189874edb6e4f79609b3dcc5f8b4339d346d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f53dcf30064388455a575b2847efd97e

SHA1
28d12bbd947d66eecae76c32944c5e29924476f0

SHA256
53e3a446de29810d078af4bf1c52e5e557f70744cdfc600f62de429f82c2f060

SHA512
8caac4995950aa3a79fdd79325c950815943ba65c12986449b25f3633930f24527e9d838c82f52df97600824a060aa36d4cdbd110e9782d5a06c42a8c662039c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
e90c425933bffb0bebd04c5aaed9be05

SHA1
4fd3d97d6b95ae028b88ce94d4b06dd81a91abca

SHA256
79026283f7d28b2449cd2f11b1a33dc177a5f325f3bcb2feece0d5570130a458

SHA512
31add95a591a29ca05eeb639eb21af00df5178afa558402c84f52355fc678349140f9a0c32b52a3a46d9cbc2e8b1d96efd63bf34bcd2d1ca0d44d9eca64e3d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
1b64b27cf9de957c27d5ff1a01d29efa

SHA1
cc672bfa1062664cdcf58cceba94a022e8396741

SHA256
88470af58ea7a9e63b036773d3340e7caaf85bbd6f70be4fe4d55b1014557e41

SHA512
616e97599785e9c70a8c97173462e4c5d0fcfa25589736b27b9815b4a9a1cf23d7e1343b34ae051d2d8562bdb451c03e4490647f344a53755abd18032c563421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

Filesize
140B

MD5
09c9465f6e7de49d27d24d5352142394

SHA1
90286397789ac912b1e974c6c941c9dcf1ddf2cd

SHA256
b11daf8d73a6d74fcf0f1d7fe60731d3f22cd147a66ad1ad2e9c403dccf4d512

SHA512
5fc7dd0a0f213f3e4e5bd7cc07228cee42583f7b3fa90493b2edabee9da280da0475c0110b1b706354e783f27ab2ae4349b614596bc7832a0db997c98c633fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt~RFe5a3653.TMP

Filesize
83B

MD5
9b3e5056ae9a76c1b7cdc14c734e8757

SHA1
96e6e7570f54e5924833899cd34a5a3e8841a3cf

SHA256
ae1541dc93be58f113bcef3123a4c429da8781d4b7767792a39af9baa3c25f88

SHA512
30e716b537fe52d495c29e7aed4ee12e1f530e40f9f9300a8ce901c3776e512d1dd7410da1c137f0ef68bbba2f0953a5c0a062b6730fc44404a1cee8d5e07852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c37a99965b71fec9441adb9d67bf2fd4

SHA1
59d46f35fa1fd3e9b64de7850771ce7b7f17a980

SHA256
641d6d4615c1ee5fe5d608cb17f9a2fd4f071ae231ec58014fd253cb60c0db01

SHA512
023eeecafb40fbad488cb36cd41888b823701e11fb92a356e10178a468a1ab7151ea360ce1a0ee22013187fb3260d4ce3a593c18aa1c89bd529c542a03bf5143

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b6882c2153570aeed020171e2fb9d672

SHA1
272880eb06b9b2270cf93ade1a83734196f4bad0

SHA256
22c58ac242e1987b96912104fedbb471ee4a59189e73c061cffd35d3f1be709e

SHA512
6f2a4906e5147c547ddb4878eb98f9baf0208d350afae1397699aea46b31311e62c0caf44cdba20cec691f429f57436e8d48c572f5b3b58f8a0ef32a40341a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
719c13ee994e7ab06b78a3ed587ac741

SHA1
d82d9b724be36bdbcbab64a0e91b899b11cc562e

SHA256
a7121bed21ba74207892e1be3986f6926ad031595631afa71ee68920698e7ef7

SHA512
bfb8ade60a3e0847bac2dfc3eae40858d64a689d4a04648ae1f2d1aed2872ba55569f8ab8860f5d5ff5d812d5c474fd97a1a7790bd9fb48483638790bc5b6382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b2a2a949b93c541729ea3aca8946ddbf

SHA1
b7eacbdce0b0ec62e5831061c87bea2cf291a286

SHA256
979e1777c62f57db4bd5dea01ca941eec02183c73289908d01be61e257e0fe3c

SHA512
00d8e26f2dbd99cc701344ac52f9b561ea3ec012d348f0a33d36785aef9f1a62ec26684c86bc97f120c574ff63d1aed18ac58ad99b6e65fda4b3f3e3b43e15d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
6c43a38023bdb81a49dd96e1c125b017

SHA1
279eef99ceebec38a62eb9fd63c8639910478a55

SHA256
29f05c3446cd18e43fb25420a84a49abc181f70610e6ac5676ecb96f1af666ed

SHA512
c783ba18670354bcbdfd677b4a621b7168fda47ec2b8a09902542d8137b5567ef82b60fc87716eb798dc4b197ac36bd51e62f6b7225263c6fc8fcd928bcc7a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
1655e765762afc169ec47e8bfafcf07b

SHA1
d09992b4f53c3d1e9a7cc2a856506ccf92a30dcb

SHA256
5fab60d88b42d517022fa5dfa063f4345457ba123bb8c7a566be45857d5b1d92

SHA512
ec673678c76f80f8898adf4431affdfdae8214059dbab7169bc9c735c1ebc41dfbfc9b754c6ae9bc680ee444d04fb7176a0aff91cde3685ebf85b302d15ff3b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
b7817c998290adec3209867e9dd6110f

SHA1
4365e7d92787bd22c18f4f2be58691f6029139b3

SHA256
0dba2955067f7738e98bb5b920fd8e2a30da65342de31b92f3efe08ac0266930

SHA512
f7a86af48cb1363f1fdc14c34f056a8896560f706cae2c97a53d6bcbebf65fc4a6adb558fbb06109ec6b83e8096d9524fede60a03f25f4c7daccf5e8a18aaeec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
9eb99a89b732055ed8efa4193b9e3881

SHA1
b1cd3221a338ed175e761e7acc5509f076f02a61

SHA256
bd9b2900a490eb7bdc941e76932df27b89c9e43fcb267e65d1c7776733d58df0

SHA512
a05d5aee344cb895f6f22dfa4b256c69a46a2dac7e1332a73f5e4e56812e7d5403f659f876e9a15588678456d5584fca9900d02b838755fbe1b5dacf700b1952

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
09a25e9abbeafb5fc10f094ca730e4cd

SHA1
f27f957669a25d7fc4f55431d9a5330c5f335255

SHA256
331580f05c75c8fe6c8b86dfd8edc63dcb3420f017f6fc69cc9851103535d82c

SHA512
8acd6e6276f903075a74b6034f63cccbacdd7366a8654c78cd0b22cfdab3a467f51d17f390016f245cb9dc9d461188c546dbbc4dec29bc1082d779d42a903481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d04ae9dad87fc9a28f4509f17cc3c980

SHA1
0f06a5022944ddda04c9061b535038d0bbaf6218

SHA256
d28de8811cd57444ea0581eedeab54ab2387421a302185e02f90b1cb1fbb5590

SHA512
4a543e72f3fb937239ae3b8f64c2e29abcd62d01267448c200035c7beeac4542c9d017e043925e2e7dfa98b260db0858122667a1808d3c3154148b5352c0beaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586c32.TMP

Filesize
1KB

MD5
6e188e203bf8239a3cba08eb89c8fc2d

SHA1
1559da3eaf01228647a68b349836720f9773e39b

SHA256
4583df4ec9db4261354f28e509138cadd0bb5741f9e11a60feb5c973b0466d78

SHA512
abc714c22069784ce8cc91b3b446b8d5d0de9cd82c0bb7a75d5588a0ed5b1204617de9a625f10eb9d806a478cba979005a0e6a25f83fad98d36a36214538f54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
60e8f491a7761d04edaa2cab7eb7eff2

SHA1
1772bb7d8cf37fa874e3f491b5927c4fa2d741b8

SHA256
1370ddf6e3c27b58f3a500d0493627ddcbff96c5f5ef4d011008aa2c1ac8ccd3

SHA512
2f5785c1c581ce3859d95a5463fb3faa722f3c7a8c13b5e3e352538293dbbc33790c920e563fdd3f2f019d93c68d4323ce9cf3a99125ea0fcce18a08a179ea5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
60e8f491a7761d04edaa2cab7eb7eff2

SHA1
1772bb7d8cf37fa874e3f491b5927c4fa2d741b8

SHA256
1370ddf6e3c27b58f3a500d0493627ddcbff96c5f5ef4d011008aa2c1ac8ccd3

SHA512
2f5785c1c581ce3859d95a5463fb3faa722f3c7a8c13b5e3e352538293dbbc33790c920e563fdd3f2f019d93c68d4323ce9cf3a99125ea0fcce18a08a179ea5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
73149ccd5c3a92593f339402c047a1a0

SHA1
865b54ef81a9277a4d3fdb82ef28c7e70bea51b9

SHA256
8b7eb9c530e768c107e06e51339bab02bf5fcd6281c9276aef778963516d68fa

SHA512
926d9ce02409286d51853924d1efc963fde5c670d874dfbaa1cbaf30ea51eddbbd4aea8e7a9bf3d7d9481094139c9b92711b060f4094aa27273d3c0574cea3c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
0325f5404e04295747c129862b3e235e

SHA1
47b7d1ba8560187287e572f176aa1033d33ad232

SHA256
476105a0c3a57856158f62d9653d8821d138c555edb33283bedddfeaafbe27b8

SHA512
dfebab2de8ed839ef791e7882e6967be741122882585d90ce2e4e2069922666f3ce7da5c47a7cee25a5179db75918d5c8f09c17794788976fae4b93d61e43e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9c47d92f86862e60f33709db2202ebe

SHA1
fbac85b8fd2f66f3176f82a1c7bd8430a9310836

SHA256
eea32bb7f210711ba81391853550bc289d226656df4522ae1341cacd5049bfba

SHA512
2f6c7bd3f778d8a22d47b68a1eabd096a119ab2f96127aabacf6dc02c43c6c879e58779a495b121f693e7b9d4b04b7aced46a2efd5eca23039631f60b38a366f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
53d9a6909aa8efe0c0d2fe98e5718088

SHA1
8841590fa24e2fb10d503f923861f7335da6c9a0

SHA256
2375a200197a0631290030228f81187d7069448a8581fd533669df14ed210eb1

SHA512
71b519629949088506193ef388a8771ff794235edb5f2dd6c6315c356259ae5d2483a36631c65a423048c5be37b16ca7be7a4df6f71f67388592991305c4226d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5787d06f25679a1d0a106549afabcd43

SHA1
a083581baf1287c14db7e9940eeec52d9b267a65

SHA256
c7c57a94743abe0225c584981098b9674297943c495fa9e92a043457d774c767

SHA512
fa1acfa4667ee5a65e36e2dbeaae0c633b28af8b45b7251ffd8689cbf5301236edae1bc6ebc8b001aafce8a48934626e8306f932aeee4d32fd38e040b10cd274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5787d06f25679a1d0a106549afabcd43

SHA1
a083581baf1287c14db7e9940eeec52d9b267a65

SHA256
c7c57a94743abe0225c584981098b9674297943c495fa9e92a043457d774c767

SHA512
fa1acfa4667ee5a65e36e2dbeaae0c633b28af8b45b7251ffd8689cbf5301236edae1bc6ebc8b001aafce8a48934626e8306f932aeee4d32fd38e040b10cd274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
0325f5404e04295747c129862b3e235e

SHA1
47b7d1ba8560187287e572f176aa1033d33ad232

SHA256
476105a0c3a57856158f62d9653d8821d138c555edb33283bedddfeaafbe27b8

SHA512
dfebab2de8ed839ef791e7882e6967be741122882585d90ce2e4e2069922666f3ce7da5c47a7cee25a5179db75918d5c8f09c17794788976fae4b93d61e43e3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6ff7a42fc81b11923c5663b365894de5

SHA1
a15d9e72d957d49ccb510c9f0954689a02c906ec

SHA256
71dfd4fed49589f4b74da3740e034444c7b68c4261e8b395f5e07f82f5c714f0

SHA512
414ee156598151cfc1f3112880e8c02f8131c1e8423359d535f2b2987209dc2b16d369e79d9a77d63ba74f50fe4da54bf9ddeb55d972edf66491b1d9b54eaecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
60e8f491a7761d04edaa2cab7eb7eff2

SHA1
1772bb7d8cf37fa874e3f491b5927c4fa2d741b8

SHA256
1370ddf6e3c27b58f3a500d0493627ddcbff96c5f5ef4d011008aa2c1ac8ccd3

SHA512
2f5785c1c581ce3859d95a5463fb3faa722f3c7a8c13b5e3e352538293dbbc33790c920e563fdd3f2f019d93c68d4323ce9cf3a99125ea0fcce18a08a179ea5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
73149ccd5c3a92593f339402c047a1a0

SHA1
865b54ef81a9277a4d3fdb82ef28c7e70bea51b9

SHA256
8b7eb9c530e768c107e06e51339bab02bf5fcd6281c9276aef778963516d68fa

SHA512
926d9ce02409286d51853924d1efc963fde5c670d874dfbaa1cbaf30ea51eddbbd4aea8e7a9bf3d7d9481094139c9b92711b060f4094aa27273d3c0574cea3c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
5787d06f25679a1d0a106549afabcd43

SHA1
a083581baf1287c14db7e9940eeec52d9b267a65

SHA256
c7c57a94743abe0225c584981098b9674297943c495fa9e92a043457d774c767

SHA512
fa1acfa4667ee5a65e36e2dbeaae0c633b28af8b45b7251ffd8689cbf5301236edae1bc6ebc8b001aafce8a48934626e8306f932aeee4d32fd38e040b10cd274

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
1.9MB

MD5
d30be0a7c7e64fc10c1a1d74077d6242

SHA1
20222a4b3291209b89f2fa515c133f7bff6a2419

SHA256
2ee3deb1c18255b59169a72d9210497c4fdfb1579b17af8e27ed2fb0880ea3cf

SHA512
ea388b4dd87ebc849600d483fadff27658818621c79af9aae7f8435383597593d2a247ed47b9f59c37c3b8a140847b5baa2ebd88cfba1d263b605ebeb031725f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9XX1gK3.exe

Filesize
659KB

MD5
cfa3da6c69ff6f176c2c3d08072db258

SHA1
7e7884daa427e39591e1e18a3500232e2866f551

SHA256
09967c60e38b7de30828f102018afe51228269ed5ec114af959e309a28096acd

SHA512
04122e7892efd262d90c047c7cfcaba6128a4b0de1958505a4ee230a190b38c8e26e940333ed9daa4aaa99a4758d55b7e4357b914bd3a959b84f4870a829a0c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\9XX1gK3.exe

Filesize
659KB

MD5
cfa3da6c69ff6f176c2c3d08072db258

SHA1
7e7884daa427e39591e1e18a3500232e2866f551

SHA256
09967c60e38b7de30828f102018afe51228269ed5ec114af959e309a28096acd

SHA512
04122e7892efd262d90c047c7cfcaba6128a4b0de1958505a4ee230a190b38c8e26e940333ed9daa4aaa99a4758d55b7e4357b914bd3a959b84f4870a829a0c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gy8JA04.exe

Filesize
1002KB

MD5
cc166916f8b7f463903e015ca142883b

SHA1
a0f21921a7ffb591520589d4ff7139fcc64453ef

SHA256
7574d1798e36f704cbe6b2c482dfce65027b64c00f23853dd1cdf25b414dbe8e

SHA512
431c550424b85b61d95f7cd84178f0f680f854510f9b165d00aecc09279a1a07ec8f44e53aeaa00397281a6e4826c8989ea53cec78c62552045185ed190e6bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gy8JA04.exe

Filesize
1002KB

MD5
cc166916f8b7f463903e015ca142883b

SHA1
a0f21921a7ffb591520589d4ff7139fcc64453ef

SHA256
7574d1798e36f704cbe6b2c482dfce65027b64c00f23853dd1cdf25b414dbe8e

SHA512
431c550424b85b61d95f7cd84178f0f680f854510f9b165d00aecc09279a1a07ec8f44e53aeaa00397281a6e4826c8989ea53cec78c62552045185ed190e6bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8Mt561eS.exe

Filesize
315KB

MD5
a0017b16b7312b37f113015a1d78f623

SHA1
64154d53aa87991ac41f2924c8963876671079fe

SHA256
57ef1e5e225c7614bbac1f4c21da44457f138a7c6de5279a7e83698e2b862047

SHA512
0002a7d39cf220eee6f7f68668fa3406ff2024a160be062784ebfb8b1a8385d3986f0b2b46bd401073db939c2b1c2264976237d19c4c9ea1131791cdd336321e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\8Mt561eS.exe

Filesize
315KB

MD5
a0017b16b7312b37f113015a1d78f623

SHA1
64154d53aa87991ac41f2924c8963876671079fe

SHA256
57ef1e5e225c7614bbac1f4c21da44457f138a7c6de5279a7e83698e2b862047

SHA512
0002a7d39cf220eee6f7f68668fa3406ff2024a160be062784ebfb8b1a8385d3986f0b2b46bd401073db939c2b1c2264976237d19c4c9ea1131791cdd336321e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gy2Fw50.exe

Filesize
781KB

MD5
f1eb4e40be1c7d1b69393c257b9e408a

SHA1
99075736872ac270f801d800eb3919b060104cc6

SHA256
fcfc205d621de722716b62ead048430597454983c413f802f3db72ac03257418

SHA512
c989aa34e3812752ba3b2256d85a4dc0730ebab8f7232c6d7ba805e4474dad73cf39037235272d62ad3627d26fa0663c8c3e59a988308e058e4b3093c9564e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Gy2Fw50.exe

Filesize
781KB

MD5
f1eb4e40be1c7d1b69393c257b9e408a

SHA1
99075736872ac270f801d800eb3919b060104cc6

SHA256
fcfc205d621de722716b62ead048430597454983c413f802f3db72ac03257418

SHA512
c989aa34e3812752ba3b2256d85a4dc0730ebab8f7232c6d7ba805e4474dad73cf39037235272d62ad3627d26fa0663c8c3e59a988308e058e4b3093c9564e3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7SF89fA.exe

Filesize
37KB

MD5
b938034561ab089d7047093d46deea8f

SHA1
d778c32cc46be09b107fa47cf3505ba5b748853d

SHA256
260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161

SHA512
4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\7SF89fA.exe

Filesize
37KB

MD5
b938034561ab089d7047093d46deea8f

SHA1
d778c32cc46be09b107fa47cf3505ba5b748853d

SHA256
260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161

SHA512
4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hf0qQ44.exe

Filesize
656KB

MD5
8af979f4573f3f5dc9fc460d90ce3b0f

SHA1
b362c93863fdc55bb1ecc0fdafcbc8c92999a674

SHA256
71c9602ae68f853f3c851ecbf28b9f6a746561cffe0b8ff803ecfd96b179a6a2

SHA512
e77d2b11f3ec4a65b8beffb1f77487308712ff2ad0705f64451f5613b965fd15f0a68effac951188808f2a509b14b65611b068c57d11b9f1e3ef65b0c03cba83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hf0qQ44.exe

Filesize
656KB

MD5
8af979f4573f3f5dc9fc460d90ce3b0f

SHA1
b362c93863fdc55bb1ecc0fdafcbc8c92999a674

SHA256
71c9602ae68f853f3c851ecbf28b9f6a746561cffe0b8ff803ecfd96b179a6a2

SHA512
e77d2b11f3ec4a65b8beffb1f77487308712ff2ad0705f64451f5613b965fd15f0a68effac951188808f2a509b14b65611b068c57d11b9f1e3ef65b0c03cba83

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nv96Vs4.exe

Filesize
895KB

MD5
8e27fa2892beea600f59bce31a8f0ae9

SHA1
23a6e41e19bf0ae51c6f26d6ce22b203958c39a8

SHA256
120fba9e3a1b2ba57f9ddbee328f64eeae4d4b31e61e2f3d32030e5dd85363c8

SHA512
7694c7e784b91ee520ab2e946dec9f0e052fd74ec6545e28fa103b9b4af76cb07e17c53ffc04927c21b58237ac5ff50eae6dfe2d8581368ae699159ddb37173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Nv96Vs4.exe

Filesize
895KB

MD5
8e27fa2892beea600f59bce31a8f0ae9

SHA1
23a6e41e19bf0ae51c6f26d6ce22b203958c39a8

SHA256
120fba9e3a1b2ba57f9ddbee328f64eeae4d4b31e61e2f3d32030e5dd85363c8

SHA512
7694c7e784b91ee520ab2e946dec9f0e052fd74ec6545e28fa103b9b4af76cb07e17c53ffc04927c21b58237ac5ff50eae6dfe2d8581368ae699159ddb37173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Qq4249.exe

Filesize
276KB

MD5
3542d295207e24d8ae6adc913357949e

SHA1
00db420d4185651d933d04b9af678a9bff94b450

SHA256
cc39749b12225105eb4e90802a5496eca9579d01445037832074e8961e30a26b

SHA512
de8c1a8371c775841ca9469c8838fc2f27ef65758c0a2f9f8a9e0d427242578dac912298eab2d884becbbcf0d88fc6c2566cbb0c1e693d87aa206756462a66ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Qq4249.exe

Filesize
276KB

MD5
3542d295207e24d8ae6adc913357949e

SHA1
00db420d4185651d933d04b9af678a9bff94b450

SHA256
cc39749b12225105eb4e90802a5496eca9579d01445037832074e8961e30a26b

SHA512
de8c1a8371c775841ca9469c8838fc2f27ef65758c0a2f9f8a9e0d427242578dac912298eab2d884becbbcf0d88fc6c2566cbb0c1e693d87aa206756462a66ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
1.4MB

MD5
bdb6db54c6d531f92d912a635250a269

SHA1
9bd83c6d430506052ae6add46ee6bf3f0cee5f3f

SHA256
adc246e6f57f3da69a7b69e4c077224ccbd2cc04776f91e8813dd7f72340ca44

SHA512
10599b927f30ce10a610ea1e29e4bf54c88e7d8698b909ed25e77756c570d175de35165ef6c6cf17c28204561925c47d0cca7bbf621f09dae4f23ea82113f465

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a0dsqjaa.3hr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE6C2.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE745.tmp

Filesize
92KB

MD5
2c49291f7cd253c173250751551fd2b5

SHA1
9d8a80c2a365675a63b5f50f63b72b76d625b1b1

SHA256
5766d76fbd9f797ab218de6c240dcae6f78066bc5812a99aeeed584fb0621f75

SHA512
de4a9ca73d663384264643be909726cb3393ea45779c888eb54bb3fbd2e36d8ad1c30260a16f1ced9fc5d8fe96dee761a655ff3764148b3e2678563417d6d933

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE85B.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE861.tmp

Filesize
20KB

MD5
6589c55d778252d2ac5483a83ae1e31c

SHA1
b37a9c8f38ae4438ec0a6e594cdbd8f5a537a725

SHA256
118e2a167ecf323583d6bff3e431aef0beeab8a9e6c8bae16383b5f971a3d8f6

SHA512
78ad995782906f4d06ba02343c94e7285005b9e3e90a2185bdcba042f62105cdb4f376a44fc4a67675681c462539938983e5258419deff97f0615c00eed1886d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE92E.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE9A7.tmp

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
217KB

MD5
aec6574d82d7e5f96a01f9f048192490

SHA1
0286b5d6fa5fb8c17fcab11648857e91fbba803f

SHA256
4502fe32e39a7351336cde70507ee3f07eaad121a4dda4757608fc7354c7d157

SHA512
53848861e058547c4ad7faa29afe33b1df2382ab28689627c70e3ea8fd39014244a093d6e49294663e669becd3251126fb3e72f05f5e136a25c0aafb46aa755c

Download Submit
memory/1160-903-0x0000000005960000-0x0000000005CB4000-memory.dmp

Filesize
3.3MB

Download
memory/1160-921-0x0000000007210000-0x000000000722A000-memory.dmp

Filesize
104KB

Download
memory/1160-914-0x00000000063E0000-0x0000000006424000-memory.dmp

Filesize
272KB

Download
memory/1160-893-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/1160-888-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/1160-892-0x0000000004F80000-0x0000000004FA2000-memory.dmp

Filesize
136KB

Download
memory/1160-890-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/1160-889-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/1160-886-0x0000000004FE0000-0x0000000005608000-memory.dmp

Filesize
6.2MB

Download
memory/1160-916-0x00000000049A0000-0x00000000049B0000-memory.dmp

Filesize
64KB

Download
memory/1160-884-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/1160-904-0x0000000005E60000-0x0000000005E7E000-memory.dmp

Filesize
120KB

Download
memory/1160-920-0x0000000007870000-0x0000000007EEA000-memory.dmp

Filesize
6.5MB

Download
memory/1160-963-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/1160-955-0x00000000075B0000-0x00000000075B8000-memory.dmp

Filesize
32KB

Download
memory/1160-954-0x0000000007660000-0x000000000767A000-memory.dmp

Filesize
104KB

Download
memory/1160-923-0x000000007F2A0000-0x000000007F2B0000-memory.dmp

Filesize
64KB

Download
memory/1160-953-0x0000000007570000-0x0000000007584000-memory.dmp

Filesize
80KB

Download
memory/1160-943-0x0000000007560000-0x000000000756E000-memory.dmp

Filesize
56KB

Download
memory/1160-924-0x00000000073D0000-0x0000000007402000-memory.dmp

Filesize
200KB

Download
memory/1160-940-0x0000000007520000-0x0000000007531000-memory.dmp

Filesize
68KB

Download
memory/1160-939-0x00000000075C0000-0x0000000007656000-memory.dmp

Filesize
600KB

Download
memory/1160-938-0x0000000007500000-0x000000000750A000-memory.dmp

Filesize
40KB

Download
memory/1160-937-0x0000000007410000-0x00000000074B3000-memory.dmp

Filesize
652KB

Download
memory/1160-936-0x00000000073B0000-0x00000000073CE000-memory.dmp

Filesize
120KB

Download
memory/1160-926-0x000000006BE90000-0x000000006C1E4000-memory.dmp

Filesize
3.3MB

Download
memory/1160-925-0x000000006DE60000-0x000000006DEAC000-memory.dmp

Filesize
304KB

Download
memory/2088-1118-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2088-1114-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2136-585-0x0000000000DA0000-0x0000000001486000-memory.dmp

Filesize
6.9MB

Download
memory/2136-614-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2136-586-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/2368-1035-0x0000000000540000-0x000000000059A000-memory.dmp

Filesize
360KB

Download
memory/2404-807-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/2404-808-0x00000000022C0000-0x00000000022C9000-memory.dmp

Filesize
36KB

Download
memory/3304-341-0x0000000002CA0000-0x0000000002CB6000-memory.dmp

Filesize
88KB

Download
memory/3304-859-0x0000000008650000-0x0000000008666000-memory.dmp

Filesize
88KB

Download
memory/4004-915-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/4004-1376-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/4004-615-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/4216-1341-0x0000000000750000-0x000000000078C000-memory.dmp

Filesize
240KB

Download
memory/4400-1231-0x00000000005C0000-0x00000000005FE000-memory.dmp

Filesize
248KB

Download
memory/4764-837-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4764-836-0x0000000002D60000-0x000000000364B000-memory.dmp

Filesize
8.9MB

Download
memory/4764-968-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4764-969-0x0000000002D60000-0x000000000364B000-memory.dmp

Filesize
8.9MB

Download
memory/4764-811-0x0000000002960000-0x0000000002D5C000-memory.dmp

Filesize
4.0MB

Download
memory/5224-382-0x0000000007A90000-0x0000000007ADC000-memory.dmp

Filesize
304KB

Download
memory/5224-375-0x0000000007710000-0x00000000077A2000-memory.dmp

Filesize
584KB

Download
memory/5224-381-0x0000000007A50000-0x0000000007A8C000-memory.dmp

Filesize
240KB

Download
memory/5224-359-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5224-379-0x0000000008190000-0x000000000829A000-memory.dmp

Filesize
1.0MB

Download
memory/5224-376-0x0000000007880000-0x0000000007890000-memory.dmp

Filesize
64KB

Download
memory/5224-380-0x00000000079F0000-0x0000000007A02000-memory.dmp

Filesize
72KB

Download
memory/5224-378-0x00000000087B0000-0x0000000008DC8000-memory.dmp

Filesize
6.1MB

Download
memory/5224-374-0x0000000007BE0000-0x0000000008184000-memory.dmp

Filesize
5.6MB

Download
memory/5224-600-0x0000000007880000-0x0000000007890000-memory.dmp

Filesize
64KB

Download
memory/5224-377-0x0000000007810000-0x000000000781A000-memory.dmp

Filesize
40KB

Download
memory/5224-591-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/5224-363-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/5548-838-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/5548-842-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/5548-844-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/5548-841-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/5640-1201-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/5640-1007-0x0000000002A60000-0x0000000002E67000-memory.dmp

Filesize
4.0MB

Download
memory/5812-652-0x0000000007270000-0x000000000779C000-memory.dmp

Filesize
5.2MB

Download
memory/5812-865-0x0000000007970000-0x000000000798E000-memory.dmp

Filesize
120KB

Download
memory/5812-885-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/5812-597-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/5812-649-0x0000000006B70000-0x0000000006D32000-memory.dmp

Filesize
1.8MB

Download
memory/5812-864-0x00000000078F0000-0x0000000007966000-memory.dmp

Filesize
472KB

Download
memory/5812-805-0x0000000006DB0000-0x0000000006E16000-memory.dmp

Filesize
408KB

Download
memory/5812-891-0x0000000074330000-0x0000000074AE0000-memory.dmp

Filesize
7.7MB

Download
memory/5812-590-0x0000000000D00000-0x0000000000D1E000-memory.dmp

Filesize
120KB

Download
memory/5812-754-0x0000000006B10000-0x0000000006B60000-memory.dmp

Filesize
320KB

Download
memory/6288-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6288-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6288-243-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6288-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6444-342-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/6444-257-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/6544-1232-0x00007FF6D4A50000-0x00007FF6D5B67000-memory.dmp

Filesize
17.1MB

Download
memory/6684-1342-0x00007FF688D50000-0x00007FF689F43000-memory.dmp

Filesize
17.9MB

Download
memory/6936-860-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6936-810-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/6936-809-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads