privateloader | dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a

Resubmissions

29-11-2023 16:13

231129-tpbw7shg6z 10

29-11-2023 15:20

231129-sqy8fshd4y 10

Analysis

max time kernel
90s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2023 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe
Size

1.7MB
MD5

a060030e45f6c2d167e115463389d583
SHA1

9f7568b3f78347de535b7fa9aa87713f9b25214b
SHA256

dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a
SHA512

15759467d379255ef592fa423ec80e63377f8dae503565f435256d026860e758c051da2df9b5d6f12dfa975498e7c5b83280c12beddf22ac4552de9fb3cf2eab
SSDEEP

24576:kyILr4FcPU3/U68GN1Eac6zo5+ldWiSC9ziJV7OlFCClQOGR1a7ArzijwkBYB:zI+cc18GfEV6zQ+HWiSB7OHYhJzik2Y

Malware Config

Extracted

Family

risepro

194.49.94.152

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

smokeloader

Version

2022

http://194.49.94.210/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTraffic

195.10.205.16:2245

Extracted

Family

smokeloader

Botnet

up3

Signatures

Detect ZGRat V1 26 IoCs

Processes:

resource	yara_rule
behavioral1/memory/5936-738-0x000002137EBF0000-0x000002137ECD4000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-742-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-743-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-745-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-747-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-749-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-751-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-753-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-755-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-757-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-760-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-771-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-773-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-775-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-777-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-779-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-781-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-783-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-785-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-787-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-789-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-791-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-793-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-795-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-797-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1
behavioral1/memory/5936-799-0x000002137EBF0000-0x000002137ECD0000-memory.dmp	family_zgrat_v1

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/740-36-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/3232-692-0x0000000000810000-0x000000000084E000-memory.dmp	family_redline
behavioral1/memory/4568-1727-0x0000000002770000-0x00000000027AC000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

Processes:

latestX.exe

description	pid	process	target process
PID 7484 created 3136	7484	latestX.exe	Explorer.EXE
PID 7484 created 3136	7484	latestX.exe	Explorer.EXE
PID 7484 created 3136	7484	latestX.exe	Explorer.EXE
PID 7484 created 3136	7484	latestX.exe	Explorer.EXE
PID 7484 created 3136	7484	latestX.exe	Explorer.EXE

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

latestX.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

6604 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

pid	process
6604	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6774.exe4CE5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation	6774.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\Control Panel\International\Geo\Nation	4CE5.exe

Drops startup file 1 IoCs

Processes:

AppLaunch.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk AppLaunch.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	AppLaunch.exe

Executes dropped EXE 31 IoCs

Processes:

vf1YA73.exeOl4xn77.exeNo2dV67.exe1Vb44Uy0.exe2Xe9255.exe3kl64up.exe4gu967vm.exe5CX5eI1.exeCBD.exeF8C.exeF8C.exe4CE5.exeInstallSetup9.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exetuc3.exeBroom.exetuc3.tmplatestX.exe5B4D.exe5B4D.tmp5F94.exepowercfg.exeVolumeUTIL.exe6774.exempeg4bind.exeVolumeUTIL.exe6D61.exetoolspub2.exe31839b57a4f11171d6abc8bbc4451ee4.exeupdater.exe

pid	process
1328	vf1YA73.exe
3320	Ol4xn77.exe
1632	No2dV67.exe
1424	1Vb44Uy0.exe
3096	2Xe9255.exe
3848	3kl64up.exe
1612	4gu967vm.exe
6660	5CX5eI1.exe
3232	CBD.exe
7064	F8C.exe
5936	F8C.exe
6204	4CE5.exe
3452	InstallSetup9.exe
824	toolspub2.exe
6748	31839b57a4f11171d6abc8bbc4451ee4.exe
5816	tuc3.exe
7280	Broom.exe
5992	tuc3.tmp
7484	latestX.exe
4728	5B4D.exe
8184	5B4D.tmp
5700	5F94.exe
7692	powercfg.exe
7780	VolumeUTIL.exe
4568	6774.exe
7056	mpeg4bind.exe
720	VolumeUTIL.exe
7152	6D61.exe
5812	toolspub2.exe
6884	31839b57a4f11171d6abc8bbc4451ee4.exe
3696	updater.exe

Loads dropped DLL 6 IoCs

Processes:

tuc3.tmp5B4D.tmp

pid process

5992 tuc3.tmp
5992 tuc3.tmp
5992 tuc3.tmp
8184 5B4D.tmp
8184 5B4D.tmp
8184 5B4D.tmp
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5992	tuc3.tmp
5992	tuc3.tmp
5992	tuc3.tmp
8184	5B4D.tmp
8184	5B4D.tmp
8184	5B4D.tmp

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exevf1YA73.exeOl4xn77.exeNo2dV67.exeAppLaunch.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vf1YA73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ol4xn77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	No2dV67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2013768333-4045878716-2922883000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	AppLaunch.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe	autoit_exe

Detected potential entity reuse from brand paypal.
phishing paypal

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exeAppLaunch.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	AppLaunch.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	AppLaunch.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	AppLaunch.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	AppLaunch.exe

Suspicious use of SetThreadContext 5 IoCs

Processes:

1Vb44Uy0.exe2Xe9255.exe5CX5eI1.exeF8C.exetoolspub2.exe

description	pid	process	target process
PID 1424 set thread context of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 3096 set thread context of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 6660 set thread context of 6488	6660	5CX5eI1.exe	AppLaunch.exe
PID 7064 set thread context of 5936	7064	F8C.exe	F8C.exe
PID 824 set thread context of 5812	824	toolspub2.exe	toolspub2.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 39 IoCs

Processes:

tuc3.tmp5B4D.tmplatestX.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-ESV59.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-MA48J.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-K2VP3.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-512EI.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-IP5GN.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-L7H4H.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-R0URB.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-PK085.tmp	5B4D.tmp
File opened for modification	C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-DJ0G5.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-6C1A1.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-4SFC5.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-SG3C9.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-E46KQ.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-JM2A9.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-BU25G.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-05B6A.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-PBQ6M.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-6DBJ3.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-VA9JS.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-BN8F2.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-02AUH.tmp	5B4D.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-08U3O.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-2CV5E.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-2LI87.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-L6T4F.tmp	tuc3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-99E70.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-0VJPV.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-JC6JJ.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-INJGV.tmp	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-LOLGR.tmp	5B4D.tmp
File opened for modification	C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat	tuc3.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat	5B4D.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-QAC4L.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-G43DI.tmp	tuc3.tmp

Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

6184 sc.exe
6220 sc.exe
760 sc.exe
5988 sc.exe
896 sc.exe
8048 sc.exe
7872 sc.exe
6632 sc.exe
2476 sc.exe
1424 sc.exe
7860 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
6184	sc.exe
6220	sc.exe
760	sc.exe
5988	sc.exe
896	sc.exe
8048	sc.exe
7872	sc.exe
6632	sc.exe
2476	sc.exe
1424	sc.exe
7860	sc.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub2.exe3kl64up.exeAppLaunch.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3kl64up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3kl64up.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3kl64up.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4020 schtasks.exe
1032 schtasks.exe
5568 schtasks.exe
7184 schtasks.exe

pid	process
4020	schtasks.exe
1032	schtasks.exe
5568	schtasks.exe
7184	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3kl64up.exeExplorer.EXEmsedge.exe

pid	process
3848	3kl64up.exe
3848	3kl64up.exe
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
5336	msedge.exe
5336	msedge.exe
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE
3136	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3136 Explorer.EXE
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

3kl64up.exeAppLaunch.exetoolspub2.exe

pid process

3848 3kl64up.exe
6488 AppLaunch.exe
5812 toolspub2.exe

pid	process
3136	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

Processes:

msedge.exe

pid	process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEF8C.exeCBD.exe

description	pid	process
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeDebugPrivilege	7064	F8C.exe
Token: SeDebugPrivilege	3232	CBD.exe
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE
Token: SeShutdownPrivilege	3136	Explorer.EXE
Token: SeCreatePagefilePrivilege	3136	Explorer.EXE

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

4gu967vm.exeExplorer.EXEmsedge.exe

pid	process
1612	4gu967vm.exe
3136	Explorer.EXE
3136	Explorer.EXE
1612	4gu967vm.exe
1612	4gu967vm.exe
1612	4gu967vm.exe
1612	4gu967vm.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
1612	4gu967vm.exe
3136	Explorer.EXE
3136	Explorer.EXE
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

Processes:

4gu967vm.exemsedge.exe

pid	process
1612	4gu967vm.exe
1612	4gu967vm.exe
1612	4gu967vm.exe
1612	4gu967vm.exe
1612	4gu967vm.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
1612	4gu967vm.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Broom.exe

pid process

7280 Broom.exe

pid	process
7280	Broom.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exevf1YA73.exeOl4xn77.exeNo2dV67.exe1Vb44Uy0.exe2Xe9255.exeAppLaunch.exe4gu967vm.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 1832 wrote to memory of 1328	1832	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe	vf1YA73.exe
PID 1832 wrote to memory of 1328	1832	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe	vf1YA73.exe
PID 1832 wrote to memory of 1328	1832	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe	vf1YA73.exe
PID 1328 wrote to memory of 3320	1328	vf1YA73.exe	Ol4xn77.exe
PID 1328 wrote to memory of 3320	1328	vf1YA73.exe	Ol4xn77.exe
PID 1328 wrote to memory of 3320	1328	vf1YA73.exe	Ol4xn77.exe
PID 3320 wrote to memory of 1632	3320	Ol4xn77.exe	No2dV67.exe
PID 3320 wrote to memory of 1632	3320	Ol4xn77.exe	No2dV67.exe
PID 3320 wrote to memory of 1632	3320	Ol4xn77.exe	No2dV67.exe
PID 1632 wrote to memory of 1424	1632	No2dV67.exe	1Vb44Uy0.exe
PID 1632 wrote to memory of 1424	1632	No2dV67.exe	1Vb44Uy0.exe
PID 1632 wrote to memory of 1424	1632	No2dV67.exe	1Vb44Uy0.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1424 wrote to memory of 2828	1424	1Vb44Uy0.exe	AppLaunch.exe
PID 1632 wrote to memory of 3096	1632	No2dV67.exe	2Xe9255.exe
PID 1632 wrote to memory of 3096	1632	No2dV67.exe	2Xe9255.exe
PID 1632 wrote to memory of 3096	1632	No2dV67.exe	2Xe9255.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3096 wrote to memory of 740	3096	2Xe9255.exe	AppLaunch.exe
PID 3320 wrote to memory of 3848	3320	Ol4xn77.exe	3kl64up.exe
PID 3320 wrote to memory of 3848	3320	Ol4xn77.exe	3kl64up.exe
PID 3320 wrote to memory of 3848	3320	Ol4xn77.exe	3kl64up.exe
PID 2828 wrote to memory of 4020	2828	AppLaunch.exe	schtasks.exe
PID 2828 wrote to memory of 4020	2828	AppLaunch.exe	schtasks.exe
PID 2828 wrote to memory of 4020	2828	AppLaunch.exe	schtasks.exe
PID 2828 wrote to memory of 1032	2828	AppLaunch.exe	schtasks.exe
PID 2828 wrote to memory of 1032	2828	AppLaunch.exe	schtasks.exe
PID 2828 wrote to memory of 1032	2828	AppLaunch.exe	schtasks.exe
PID 1328 wrote to memory of 1612	1328	vf1YA73.exe	4gu967vm.exe
PID 1328 wrote to memory of 1612	1328	vf1YA73.exe	4gu967vm.exe
PID 1328 wrote to memory of 1612	1328	vf1YA73.exe	4gu967vm.exe
PID 1612 wrote to memory of 4904	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 4904	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 1492	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 1492	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 2992	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 2992	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 2848	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 2848	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 3480	1612	4gu967vm.exe	msedge.exe
PID 1612 wrote to memory of 3480	1612	4gu967vm.exe	msedge.exe
PID 4904 wrote to memory of 3340	4904	msedge.exe	msedge.exe
PID 4904 wrote to memory of 3340	4904	msedge.exe	msedge.exe
PID 2848 wrote to memory of 2220	2848	msedge.exe	msedge.exe
PID 2848 wrote to memory of 2220	2848	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4216	3480	msedge.exe	msedge.exe
PID 3480 wrote to memory of 4216	3480	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4376	2992	msedge.exe	msedge.exe
PID 2992 wrote to memory of 4376	2992	msedge.exe	msedge.exe
PID 1492 wrote to memory of 3568	1492	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3136

C:\Users\Admin\AppData\Local\Temp\dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe
"C:\Users\Admin\AppData\Local\Temp\dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3320

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:4020

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:1032

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:740

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3848

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
6⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
6⤵
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
6⤵
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
6⤵
PID:6180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
6⤵
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
6⤵
PID:6788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
6⤵
PID:6984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
6⤵
PID:6232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
6⤵
PID:5856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
6⤵
PID:7204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
6⤵
PID:7272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
6⤵
PID:7436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
6⤵
PID:7520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
6⤵
PID:7800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
6⤵
PID:7836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
6⤵
PID:8076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
6⤵
PID:8184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7440 /prefetch:1
6⤵
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:1
6⤵
PID:7444

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7856 /prefetch:8
6⤵
PID:7616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7856 /prefetch:8
6⤵
PID:7672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:1
6⤵
PID:6228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17184785671115617748,13523414437392271791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:1
6⤵
PID:8028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
5⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7841885644127864053,7994273291229708377,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
6⤵
PID:5924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7841885644127864053,7994273291229708377,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
6⤵
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
- Suspicious use of WriteProcessMemory
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12085069289070396659,12088194405530205413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
6⤵
PID:6512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
5⤵
- Suspicious use of WriteProcessMemory
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,14375677104628440706,5063560677122128497,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
6⤵
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,14375677104628440706,5063560677122128497,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
6⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
5⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3246181212098148562,17455032767397942239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
6⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3246181212098148562,17455032767397942239,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
6⤵
PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
5⤵
PID:1276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4432575452768888619,2216467891864638806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
6⤵
PID:5452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4432575452768888619,2216467891864638806,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
6⤵
PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
5⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17028610280698623877,16987671546713128566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
6⤵
PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
5⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1552,10457649165826461989,6670797208817073609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
6⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
5⤵
PID:1040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
6⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
PID:5664

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:6152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:6320

C:\Users\Admin\AppData\Local\Temp\CBD.exe
C:\Users\Admin\AppData\Local\Temp\CBD.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Users\Admin\AppData\Local\Temp\F8C.exe
C:\Users\Admin\AppData\Local\Temp\F8C.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:7064

C:\Users\Admin\AppData\Local\Temp\F8C.exe
C:\Users\Admin\AppData\Local\Temp\F8C.exe
3⤵
- Executes dropped EXE
PID:5936

C:\Users\Admin\AppData\Local\Temp\4CE5.exe
C:\Users\Admin\AppData\Local\Temp\4CE5.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:6204

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
3⤵
- Executes dropped EXE
PID:3452

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:7280

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:824

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5812

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
PID:6748

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:7004

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
PID:6884

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:7816

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:6612

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:6604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6276

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Modifies data under HKEY_USERS
PID:2404

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
PID:928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:1144

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:5568

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:5340

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:3424

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:2356

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
PID:2188

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:7184

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
PID:6456

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:652

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:896

C:\Users\Admin\AppData\Local\Temp\tuc3.exe
"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
3⤵
- Executes dropped EXE
PID:5816

C:\Users\Admin\AppData\Local\Temp\is-8SK2D.tmp\tuc3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8SK2D.tmp\tuc3.tmp" /SL5="$60188,3243561,76288,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5992

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
5⤵
PID:7776

C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe
"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -i
5⤵
PID:7692

C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe
"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -s
5⤵
- Executes dropped EXE
PID:7056

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 28
5⤵
PID:7128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 28
6⤵
PID:6932

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:7484

C:\Users\Admin\AppData\Local\Temp\5B4D.exe
C:\Users\Admin\AppData\Local\Temp\5B4D.exe
2⤵
- Executes dropped EXE
PID:4728

C:\Users\Admin\AppData\Local\Temp\is-PL5MS.tmp\5B4D.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PL5MS.tmp\5B4D.tmp" /SL5="$9005E,3304892,54272,C:\Users\Admin\AppData\Local\Temp\5B4D.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:8184

C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -i
4⤵
- Executes dropped EXE
PID:7780

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
4⤵
PID:7236

C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -s
4⤵
- Executes dropped EXE
PID:720

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 29
4⤵
PID:4476

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 29
5⤵
PID:3368

C:\Users\Admin\AppData\Local\Temp\5F94.exe
C:\Users\Admin\AppData\Local\Temp\5F94.exe
2⤵
- Executes dropped EXE
PID:5700

C:\Users\Admin\AppData\Local\Temp\6774.exe
C:\Users\Admin\AppData\Local\Temp\6774.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
4⤵
PID:6348

C:\Users\Admin\AppData\Local\Temp\6D61.exe
C:\Users\Admin\AppData\Local\Temp\6D61.exe
2⤵
- Executes dropped EXE
PID:7152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:5880

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:6348

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:6772

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3368

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:6220

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:760

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:5988

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:6632

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:2476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:6208

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:5600

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:3764

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Executes dropped EXE
PID:7692

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:5772

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:1516

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:4504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:7420

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:8068

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:1424

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:8048

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:7872

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:7860

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:6184

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:7072

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:5960

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:3960

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:2952

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:7756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:4972

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:5052

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
PID:5408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
1⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffc8a3d46f8,0x7ffc8a3d4708,0x7ffc8a3d4718
1⤵
PID:5864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7192

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7444

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:3696

C:\Users\Admin\AppData\Local\Opcode\ffviixoxo\XsdType.exe
C:\Users\Admin\AppData\Local\Opcode\ffviixoxo\XsdType.exe
1⤵
PID:6716

C:\Users\Admin\AppData\Local\Opcode\ffviixoxo\XsdType.exe
C:\Users\Admin\AppData\Local\Opcode\ffviixoxo\XsdType.exe
2⤵
PID:3124

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
3⤵
PID:3664

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
4⤵
PID:3396

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:6856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

Filesize
101KB

MD5
89d41e1cf478a3d3c2c701a27a5692b2

SHA1
691e20583ef80cb9a2fd3258560e7f02481d12fd

SHA256
dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

SHA512
5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06d5ada5-a8cf-4963-b6c8-8539ebaa2d30.tmp

Filesize
2KB

MD5
de2ae2d2815216b51269ed58fc443ed9

SHA1
24a403df8fdeb2a1d942df6bc41229311e330199

SHA256
388d3a9e26bb4567391ab363e24efc4a2b0818f188dcdd783fa97b0cb317fac9

SHA512
f7e9d4ffbafd99ca1787700902a6522e9e4a8b8d7c284882da85497f8f53147bace907817bcd38b372f26e061c3a199a86387f90b5be456339ff01240e04484d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\50f93747-d549-467e-8839-fb36b6c5de5d.tmp

Filesize
2KB

MD5
60eaa5e65c2cc105a2c98806fa0ba752

SHA1
7b362009438af27cd5ec71533980d5883c92d452

SHA256
20f5399274c41a55de4cc250af48c7ea98bfb4b00d0e8951b50d7a2674eeac80

SHA512
250887d3a67d2940c84c791629965dc7e1e05071c3456f4bacf4822f7b3065f198b200cb542d1e6eefe90bfaa499c4d6df8e74a3571315e95f2327d31ef052af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b6291e4c0e7d7c4eb4781f60c3721a48

SHA1
4667138679504de20ce0c631d4b39f162042771c

SHA256
f9f5393aff03590496fdec44951c30364a948d373a56cc4878b2393cd2698251

SHA512
2def22f0acbd8ddacd91e92d859ade311e677dcdd80d3e2be48dbb1bb3f97b03116c52e2052fce3349d4ef6bf75e87b3fccd293ce78054f5847823b9a3f284fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d94c59e136e2bc795637c1c05e315e35

SHA1
0ec32d5c51c34e9215b5390e7aa4add173310f01

SHA256
ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

SHA512
57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d94c59e136e2bc795637c1c05e315e35

SHA1
0ec32d5c51c34e9215b5390e7aa4add173310f01

SHA256
ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

SHA512
57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d94c59e136e2bc795637c1c05e315e35

SHA1
0ec32d5c51c34e9215b5390e7aa4add173310f01

SHA256
ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

SHA512
57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d94c59e136e2bc795637c1c05e315e35

SHA1
0ec32d5c51c34e9215b5390e7aa4add173310f01

SHA256
ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

SHA512
57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d94c59e136e2bc795637c1c05e315e35

SHA1
0ec32d5c51c34e9215b5390e7aa4add173310f01

SHA256
ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

SHA512
57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d94c59e136e2bc795637c1c05e315e35

SHA1
0ec32d5c51c34e9215b5390e7aa4add173310f01

SHA256
ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

SHA512
57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d94c59e136e2bc795637c1c05e315e35

SHA1
0ec32d5c51c34e9215b5390e7aa4add173310f01

SHA256
ad71bfe2069efebb4ca211ae6ec21473fc1b43dd3269b8523c5b67da6edcb41f

SHA512
57a5c50bd9e87b20200ecbd18ed2bd7712a46fcb9f5ce3d3aecdb768bcfa52d5025f9fd40523015414aeac3e8c94c9ab1caa6ae006dc4e9e7ab58c92607ffd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
890585f0e978711e84e103f4e737e1b8

SHA1
12b9a7b4a1a016c8a0d4458f389135ed23574e27

SHA256
c83ee823a77974192ee702a6b550e28046fe4f60798e471e7b5b75c1f623c092

SHA512
246b774837bfb5c3f158024986fb040419974c7a8c1e6f6875e713760385084b32cfa294a5195598e7968632d1e2e4f553545f6d084cb4e5204a868aabdc0297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
186KB

MD5
9f61d7b1098e9a21920cf7abd68ca471

SHA1
c2a75ba9d5e426f34290ebda3e7b3874a4c26a50

SHA256
2c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71

SHA512
3d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
21KB

MD5
7d75a9eb3b38b5dd04b8a7ce4f1b87cc

SHA1
68f598c84936c9720c5ffd6685294f5c94000dff

SHA256
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

SHA512
cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
33KB

MD5
09a51b4e0d6e59ba0955364680a41cd6

SHA1
0c9bf805aa43f66b8c7854ccf7c2e2873050a8c2

SHA256
c96a6b48cc4325a0ea43e58c22eefc3713d8720c13ed3cdabc67372d9e1b470d

SHA512
bfa291e26fdddea478b3cc96ce31ca02993194bdf73303f73ee2d021287206fb359e17fc970e7e124e3108e72877a1edc08e8848181c303f0b251379cfef0f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
228KB

MD5
bd3db8aee481dbe42ecb0a1cfc5f2f96

SHA1
3de1107414c4714537fba3511122e9fa88894f35

SHA256
b82ea286491eaa5370e997311b41b5fc1bbc774b40e9750ebfeef27933426083

SHA512
bf400c36bfc41cc82ae65ea9ad670d5319e11f0b43dd67f809935c405a0c560aed7668183dd9d5d49c83f1dd99cfd3134c87f72b0e63747209b0a8e5b3f04360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
5c5105970e0cc71c89f5c3b3f434ebc8

SHA1
b4127bd710aca5c9ae240e2ee4841552b3abedc0

SHA256
9074ac4b6625af00e1012eb614de12847fc366bd38385232292e3c1c557cbad3

SHA512
a7c035d34afef8b2b9e29141bca9b93853ba2bcb37b21b31f2b7b96a9af15c271990d3427c5078e5d8ab552c82a1264accbfd8c3738376a464fb9b9153915b38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bb73e74d1f775756e4724ef85b19b90d

SHA1
1b8f2ee81f4672d8243b909aa9df93eaa6b6732c

SHA256
543828a884471a4bb0b62ce01c8df7136e9cf7a6c74dab0f9d21deab4a209c01

SHA512
5d3dc54eebc58f8b9b57dbe2ba04ea7866abe4ce8bc9c93b920dd527a3eda0eec3d5c09228cf9dc676254d15d38280ec1e50503b61700e93dda97f94ada5556d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81b1ab5f846b44ebad10aeabf94ea965

SHA1
f8c01458792d42e7fc8c3feaa6adf6de4607402e

SHA256
2747808b6dccd43072a746136acdbcd560fce7de1b33f8079fd8f51229e99e59

SHA512
0941e58ce7c05f592224bee473c8bc0dc1f7a419e9b903d1844a0893c7224329d4f119ecd582410b434f8ca3a9c2a0be666eb7670c15250aef578858c49992b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
a553ed37741112dae933596a86226276

SHA1
74ab5b15036f657a40a159863fa901421e36d4fa

SHA256
ec16b2f20ead3d276f672ae72533fcc24833c7bcfd08e82abf8c582e1bed5e87

SHA512
25d263aeeda0384b709e1c4ec3f6dba5cfcb8577e026d66846c2045b543f6446439b946163b1ea8f7e53cc6ebf38c93172452bd43e2560b42b56c4d13625e107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
eaed5e2034a5b6ab5ff067480d1528e4

SHA1
67372b713ebc2be766d5b2dbdf40d575973e5b66

SHA256
bd5d6c986d97029979fba789890a1f26e878ab099b4e48555e0ee6621c3bd2b9

SHA512
e609466e33aa644a3157e3c06e945049f732a571a511e2fe0768667afe7f2fa8fc10ac40329183d046d0668e05d87f3ea9302d9b4501924bdaa57c278e221cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
73d27debe46cfddb5c9105edf7cabd8a

SHA1
aae733ef93eb1e999b04c143b84177e50355897b

SHA256
59c06de406ddaa930046730bc88f98cd21cfb2427637dc305ffe5ef121342831

SHA512
deab66ac97aff3a6396825e1ba19de04d376a12a5abe56cb76a8f5c65e6d5afdffeefbfcd1e3a752c50ffb9d7b7ae8595e880953d0874abe6bcaf57796d0875d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58465b.TMP

Filesize
2KB

MD5
d5f812f420b3b642da7d606db49802fd

SHA1
533edf19d90e1c0a8b020030ad50d708e8ea92f7

SHA256
cae8b4a57084a60cda9a24b3f00e81c0c9a94e13954b2dccaca77714e3afe198

SHA512
031698c0bad159dadf831596451092a32dacdcbbfa550ce440efb96f39a8e73a20d7ded46295bf14daa3fa793e4413e4ab7ab673ef41ac791e38e74b578e59ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a47349c4450b6d1764c6a879e9dc807

SHA1
7428a6248cd08bce5415899da88811e4c48b2808

SHA256
d19955eae3b4c958c2f5d7a0f82bdc861fdf1e84343182e8875ec1547f58c541

SHA512
df24e128a9d47e6d9e225f4f17e50ce37489fa95c441a5d4bda0570ac9faa2c7ecbdee2ad619ecc82c72ea7f5f848eaef93de5ef7ef86b968cf37ba7ed323f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
947d478ff9a1f32d49ede86425414b5c

SHA1
da9ae7106a79d8af6d316cd08b294b45efd112ad

SHA256
34bc85db67da564a970134e69717405074a43ac25f2c45c9aabf97e2fe9629d6

SHA512
6182b1a1e15983d954820a6771e24e38b5c7e8b3b852b9529a92abefa11181839d8265e4942f879c12bf96a6e2410eed9abbe25755199011cbb382e4ba082b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
bb5aca8356d13d35e10ff41ea5de52d5

SHA1
9cf7d96bb13fc05b559f0b8bb32e448a36d35387

SHA256
9de9455086db7ee7035d6f666e8fc238d325f431e0ea32d76b345653b82d4edb

SHA512
ca930fea18df8ebf6a573e877582f1d04f8d23bde2b9390e8263552f35ad4768b394171b1fa50815f4b8dc27c21e4db9e3a174a70211733636174287b0a8a795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
bb5aca8356d13d35e10ff41ea5de52d5

SHA1
9cf7d96bb13fc05b559f0b8bb32e448a36d35387

SHA256
9de9455086db7ee7035d6f666e8fc238d325f431e0ea32d76b345653b82d4edb

SHA512
ca930fea18df8ebf6a573e877582f1d04f8d23bde2b9390e8263552f35ad4768b394171b1fa50815f4b8dc27c21e4db9e3a174a70211733636174287b0a8a795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
60eaa5e65c2cc105a2c98806fa0ba752

SHA1
7b362009438af27cd5ec71533980d5883c92d452

SHA256
20f5399274c41a55de4cc250af48c7ea98bfb4b00d0e8951b50d7a2674eeac80

SHA512
250887d3a67d2940c84c791629965dc7e1e05071c3456f4bacf4822f7b3065f198b200cb542d1e6eefe90bfaa499c4d6df8e74a3571315e95f2327d31ef052af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
de2ae2d2815216b51269ed58fc443ed9

SHA1
24a403df8fdeb2a1d942df6bc41229311e330199

SHA256
388d3a9e26bb4567391ab363e24efc4a2b0818f188dcdd783fa97b0cb317fac9

SHA512
f7e9d4ffbafd99ca1787700902a6522e9e4a8b8d7c284882da85497f8f53147bace907817bcd38b372f26e061c3a199a86387f90b5be456339ff01240e04484d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
041e815abb5dcddf25bfddf5bdab9e12

SHA1
f12cd2900bb324cb1e16d56edcd5e4d1934473da

SHA256
2a938b0ab83254384b5b001cd95d775387150b131921b6afcbc24cf4b4243556

SHA512
b061df535da966241d65aab4eceb733e741a2c708ae25d6406988e8735fb32fd0fda32904edbca5a6fef99722d59d679921b30d840b50a45459cd70532b75cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
041e815abb5dcddf25bfddf5bdab9e12

SHA1
f12cd2900bb324cb1e16d56edcd5e4d1934473da

SHA256
2a938b0ab83254384b5b001cd95d775387150b131921b6afcbc24cf4b4243556

SHA512
b061df535da966241d65aab4eceb733e741a2c708ae25d6406988e8735fb32fd0fda32904edbca5a6fef99722d59d679921b30d840b50a45459cd70532b75cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
159141ba8f9fd0474cac4ca4cc954dfb

SHA1
09398529787fa0d85befbd129d6b40874647d12e

SHA256
fd8bf4df2e6d55ebc47bf83a27f08454d86b87f97e8316a4017f97a0a9d54b2d

SHA512
dcc0fa2fa273e732ac96d4523afa1f4a3572e1a15815ca6f3a145e3ca2469306d9bc52b94b3c5005de67d57443ccebe0527ceca8e9ef5d5e358a1c829c8986ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
159141ba8f9fd0474cac4ca4cc954dfb

SHA1
09398529787fa0d85befbd129d6b40874647d12e

SHA256
fd8bf4df2e6d55ebc47bf83a27f08454d86b87f97e8316a4017f97a0a9d54b2d

SHA512
dcc0fa2fa273e732ac96d4523afa1f4a3572e1a15815ca6f3a145e3ca2469306d9bc52b94b3c5005de67d57443ccebe0527ceca8e9ef5d5e358a1c829c8986ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
258505bb31332bf4cc60b8c2aafd382b

SHA1
3ebb23722c9f6a6158273d48f266e7633b8f6447

SHA256
e97ff2a33b470473b4d6ec50dba106f84c448ae3e1641194b77ab41bd790944f

SHA512
66c17bdde785e5170e1427f7967e236d43842e58ab6ed17b14d148878954bc85ec033ea5ce5b2dd9ee6c52d7d04624b04780ada5168559b296e302bcce28340e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
f712cca4eb49b2b5c952b6c87f5d667b

SHA1
0f92f6e2b45508b72a9ece6b980bae69eff3cd80

SHA256
1e993fa1fd145ec532857feb952f6a15fbdea0c127da8c8e7971bca686cc8685

SHA512
165dbd3b61a8e126a59ccd92873bf66e37610d27f72af6019200e9a9be09bab3ea556888bab132d71407f328d9ac14154b4ab54c30cbcccfd9fbeb3340d88bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
f712cca4eb49b2b5c952b6c87f5d667b

SHA1
0f92f6e2b45508b72a9ece6b980bae69eff3cd80

SHA256
1e993fa1fd145ec532857feb952f6a15fbdea0c127da8c8e7971bca686cc8685

SHA512
165dbd3b61a8e126a59ccd92873bf66e37610d27f72af6019200e9a9be09bab3ea556888bab132d71407f328d9ac14154b4ab54c30cbcccfd9fbeb3340d88bf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
258505bb31332bf4cc60b8c2aafd382b

SHA1
3ebb23722c9f6a6158273d48f266e7633b8f6447

SHA256
e97ff2a33b470473b4d6ec50dba106f84c448ae3e1641194b77ab41bd790944f

SHA512
66c17bdde785e5170e1427f7967e236d43842e58ab6ed17b14d148878954bc85ec033ea5ce5b2dd9ee6c52d7d04624b04780ada5168559b296e302bcce28340e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
258505bb31332bf4cc60b8c2aafd382b

SHA1
3ebb23722c9f6a6158273d48f266e7633b8f6447

SHA256
e97ff2a33b470473b4d6ec50dba106f84c448ae3e1641194b77ab41bd790944f

SHA512
66c17bdde785e5170e1427f7967e236d43842e58ab6ed17b14d148878954bc85ec033ea5ce5b2dd9ee6c52d7d04624b04780ada5168559b296e302bcce28340e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
de2ae2d2815216b51269ed58fc443ed9

SHA1
24a403df8fdeb2a1d942df6bc41229311e330199

SHA256
388d3a9e26bb4567391ab363e24efc4a2b0818f188dcdd783fa97b0cb317fac9

SHA512
f7e9d4ffbafd99ca1787700902a6522e9e4a8b8d7c284882da85497f8f53147bace907817bcd38b372f26e061c3a199a86387f90b5be456339ff01240e04484d

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
194599419a04dd1020da9f97050c58b4

SHA1
cd9a27cbea2c014d376daa1993538dac80968114

SHA256
37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe

SHA512
551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe

Filesize
219KB

MD5
f5a086c831973eb628af8ae477dbba2d

SHA1
f91a16149d57072b8a92097cbc2c90f2bd480f88

SHA256
878103685ca87ccc49028e2a4fcd2f935b285d4224f6256213e5f33420dfcaba

SHA512
b3a7ed38f9efb77ff79059a32a12f4bcde531cda2dceadb1c36088188bfe141a3d49f08e2fe6c8fc29a118ee9af5a56f36a1b06938d900dfd9a67b90b5e8f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe

Filesize
219KB

MD5
f5a086c831973eb628af8ae477dbba2d

SHA1
f91a16149d57072b8a92097cbc2c90f2bd480f88

SHA256
878103685ca87ccc49028e2a4fcd2f935b285d4224f6256213e5f33420dfcaba

SHA512
b3a7ed38f9efb77ff79059a32a12f4bcde531cda2dceadb1c36088188bfe141a3d49f08e2fe6c8fc29a118ee9af5a56f36a1b06938d900dfd9a67b90b5e8f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe

Filesize
1.5MB

MD5
7f7c88a33d9723c35a6051fd95fa4067

SHA1
1eb8d86bbe6a47d608a206708a9abd210f62f00c

SHA256
2c0c06408590c1e4e7b99afd429775c53371aae8a16be9fe43624e76caa343ec

SHA512
737474b0d6d91cd0b5289a8136377363c28574b8f7df1bbcb333bce10d7ef791b4ef897cc0d1419272ebbfa80b03049bb1278697de8458e0ca2fb19c1c25e78b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe

Filesize
1.5MB

MD5
7f7c88a33d9723c35a6051fd95fa4067

SHA1
1eb8d86bbe6a47d608a206708a9abd210f62f00c

SHA256
2c0c06408590c1e4e7b99afd429775c53371aae8a16be9fe43624e76caa343ec

SHA512
737474b0d6d91cd0b5289a8136377363c28574b8f7df1bbcb333bce10d7ef791b4ef897cc0d1419272ebbfa80b03049bb1278697de8458e0ca2fb19c1c25e78b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe

Filesize
895KB

MD5
caf3505c5244a7a2ee9071b6632a5f31

SHA1
585c37d41ee6f41b1f389cc3182b6eb04d5f769a

SHA256
19f5bb3652ec616f0423f8c984c4a4230631a408001fc4377d3b89bf83401c42

SHA512
fda4c2ce9e708118c2eb0d4d611f4e92e55afb1700d4d52da39e1909492c5e7ab93bc785f9cad8e327122e17bb79d8e67236a0711d1af266c1030b303af4fd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe

Filesize
895KB

MD5
caf3505c5244a7a2ee9071b6632a5f31

SHA1
585c37d41ee6f41b1f389cc3182b6eb04d5f769a

SHA256
19f5bb3652ec616f0423f8c984c4a4230631a408001fc4377d3b89bf83401c42

SHA512
fda4c2ce9e708118c2eb0d4d611f4e92e55afb1700d4d52da39e1909492c5e7ab93bc785f9cad8e327122e17bb79d8e67236a0711d1af266c1030b303af4fd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe

Filesize
1.1MB

MD5
92c486d3212831b18786a62abf831497

SHA1
13b41c107854ff3faa00d2b84b534b8ba78ef68a

SHA256
11420db0ce86660f43d2b1014e1e4c625efd553afbd2504419b1c4ca5301fb07

SHA512
75e76d0d838ea85b00111577e03d3bd82e76bf6effc64c8ed087976151ac734db72b74811fa5257021c7b324fd5b2eac6f51bf38720fa2f1e3705daf55dab273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe

Filesize
1.1MB

MD5
92c486d3212831b18786a62abf831497

SHA1
13b41c107854ff3faa00d2b84b534b8ba78ef68a

SHA256
11420db0ce86660f43d2b1014e1e4c625efd553afbd2504419b1c4ca5301fb07

SHA512
75e76d0d838ea85b00111577e03d3bd82e76bf6effc64c8ed087976151ac734db72b74811fa5257021c7b324fd5b2eac6f51bf38720fa2f1e3705daf55dab273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe

Filesize
38KB

MD5
130f76a4eb2fd826ddfade140794fbd4

SHA1
b81a5db8cb86ccf286e169504f3c1a56d9e8cb4d

SHA256
c44fa253ff90e80115b377a3b9c1a0a422a8f82c6d97c3d6df485227f6dac4a5

SHA512
18b87831c6aac725e2d71f601c599767a07615115b40c7c9b5090923b16c8f17ca7e7a395f8e8d45c75700aabcbe85f99cbbf38243d23740e7b2df796ea6193f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe

Filesize
38KB

MD5
130f76a4eb2fd826ddfade140794fbd4

SHA1
b81a5db8cb86ccf286e169504f3c1a56d9e8cb4d

SHA256
c44fa253ff90e80115b377a3b9c1a0a422a8f82c6d97c3d6df485227f6dac4a5

SHA512
18b87831c6aac725e2d71f601c599767a07615115b40c7c9b5090923b16c8f17ca7e7a395f8e8d45c75700aabcbe85f99cbbf38243d23740e7b2df796ea6193f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe

Filesize
964KB

MD5
7172171d2d830e627e3f18b455713fd1

SHA1
358c2360f82f40eaab06918764c30d65b37157c0

SHA256
b843430500dcd41998a67225ebc23b3d492a65d013960b10d0d9013476b982e5

SHA512
89374e2095344066c9f0f49b5da6d5f948a8003e384bcc4119d811a9bdf691dee87c8013d827856422f31405e28d72bce3ebd0a36b2ccb340d2efb11709c7a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe

Filesize
964KB

MD5
7172171d2d830e627e3f18b455713fd1

SHA1
358c2360f82f40eaab06918764c30d65b37157c0

SHA256
b843430500dcd41998a67225ebc23b3d492a65d013960b10d0d9013476b982e5

SHA512
89374e2095344066c9f0f49b5da6d5f948a8003e384bcc4119d811a9bdf691dee87c8013d827856422f31405e28d72bce3ebd0a36b2ccb340d2efb11709c7a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe

Filesize
1.6MB

MD5
f0f2b1d8ae7a5d7ef3466177f844b8ee

SHA1
2fd508e69614eecf8c19a49dc7ac4d9e456218e2

SHA256
b4cb5f50adb5925ed88e8f48b670ab4f9303de4ba03ad1bded92591f83938a75

SHA512
1de045bd28d630018b145ad5e419c3dbc59197e03d3862d10841d27624a9c26f755ab4ba9a77ac05578cf8df40c4a775a4de0f06f9fb70f67f9fe77e4d254bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe

Filesize
1.6MB

MD5
f0f2b1d8ae7a5d7ef3466177f844b8ee

SHA1
2fd508e69614eecf8c19a49dc7ac4d9e456218e2

SHA256
b4cb5f50adb5925ed88e8f48b670ab4f9303de4ba03ad1bded92591f83938a75

SHA512
1de045bd28d630018b145ad5e419c3dbc59197e03d3862d10841d27624a9c26f755ab4ba9a77ac05578cf8df40c4a775a4de0f06f9fb70f67f9fe77e4d254bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe

Filesize
401KB

MD5
e74002b92ab417e259a20bd0e48acbbb

SHA1
4dadcb8893527b772727467fd00ae98ce0bf7478

SHA256
f30547b40c19c734882e6eaf2f973c0aad522743694d8eae881746c9b5f4017a

SHA512
455e528d5f4f612acef714ed2f29d5ec152ffa6c6fad0204f0acc404ff53a013cb2b6899b1a91cd48698f72b8d1554fb432d5d1c9f1f1724d59e6632278b4c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe

Filesize
401KB

MD5
e74002b92ab417e259a20bd0e48acbbb

SHA1
4dadcb8893527b772727467fd00ae98ce0bf7478

SHA256
f30547b40c19c734882e6eaf2f973c0aad522743694d8eae881746c9b5f4017a

SHA512
455e528d5f4f612acef714ed2f29d5ec152ffa6c6fad0204f0acc404ff53a013cb2b6899b1a91cd48698f72b8d1554fb432d5d1c9f1f1724d59e6632278b4c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

Filesize
2.3MB

MD5
5a4d9c7655774781ac874d28e5f4e8c3

SHA1
a07b8efb4ba7a5325310d67f8ab0bab289c1bcfe

SHA256
6dbdd7e60ed858d48b55cc0ccc5036e0f075fac5ca204711c3e2e96488335af1

SHA512
ff9cdb2b0e881c6edbf1e35d280f5fa308ccc4e58dce8aa095990c721950f8378435c8479fd7707a18eede44baf5c4fed8ee23a6d0c67f170b74812d9b0c732f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vohulyw3.dkc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7M7QI.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-7M7QI.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
282KB

MD5
2edd463e1e0eb9ee47c8c652292376fd

SHA1
4489c3b20a3a6d2f97838371a53c6d1a25493359

SHA256
d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7

SHA512
d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516

Download Submit
C:\Users\Admin\AppData\Local\Temp\tuc3.exe

Filesize
3.3MB

MD5
9d203bb88cfaf2a9dc2cdb04d888b4a2

SHA1
4481b6b9195590eee905f895cce62524f970fd51

SHA256
ba8a003d3491205e5e43c608daa1a51087d43dfe53260eb82227ddfb7448d83b

SHA512
86790d21b2731f36c9e1f80b617e016c37a01b3d8bb74dc73f53387b2c57dfd301f936f9ec6bc8d9750870ffcd7bb3dedb92c41c07eb0b519961e029aff2996d

Download Submit
\??\pipe\LOCAL\crashpad_1276_XKGLNMCGFMQBRSFV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_2848_ZIRJAYTAOYZELSRN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_3480_MGQEOCELOEADBLDV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4904_DKJNJWIYSLVZZBQL

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/720-1674-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/720-1677-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/740-36-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/740-54-0x0000000007B70000-0x0000000008114000-memory.dmp

Filesize
5.6MB

Download
memory/740-59-0x00000000078B0000-0x00000000078BA000-memory.dmp

Filesize
40KB

Download
memory/740-60-0x0000000008740000-0x0000000008D58000-memory.dmp

Filesize
6.1MB

Download
memory/740-61-0x0000000007A60000-0x0000000007B6A000-memory.dmp

Filesize
1.0MB

Download
memory/740-55-0x00000000076B0000-0x0000000007742000-memory.dmp

Filesize
584KB

Download
memory/740-693-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/740-58-0x00000000078E0000-0x00000000078F0000-memory.dmp

Filesize
64KB

Download
memory/740-62-0x0000000007990000-0x00000000079A2000-memory.dmp

Filesize
72KB

Download
memory/740-718-0x00000000078E0000-0x00000000078F0000-memory.dmp

Filesize
64KB

Download
memory/740-63-0x00000000079F0000-0x0000000007A2C000-memory.dmp

Filesize
240KB

Download
memory/740-53-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/740-64-0x0000000008120000-0x000000000816C000-memory.dmp

Filesize
304KB

Download
memory/824-1722-0x0000000002C40000-0x0000000002C49000-memory.dmp

Filesize
36KB

Download
memory/824-1718-0x0000000002AC0000-0x0000000002BC0000-memory.dmp

Filesize
1024KB

Download
memory/2828-29-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/2828-34-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/2828-57-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/2828-28-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/2828-32-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/3136-65-0x00000000034E0000-0x00000000034F6000-memory.dmp

Filesize
88KB

Download
memory/3136-438-0x0000000003510000-0x0000000003526000-memory.dmp

Filesize
88KB

Download
memory/3232-720-0x00000000075C0000-0x00000000075D0000-memory.dmp

Filesize
64KB

Download
memory/3232-1079-0x0000000009A40000-0x0000000009F6C000-memory.dmp

Filesize
5.2MB

Download
memory/3232-1419-0x0000000009810000-0x0000000009860000-memory.dmp

Filesize
320KB

Download
memory/3232-853-0x0000000008280000-0x00000000082E6000-memory.dmp

Filesize
408KB

Download
memory/3232-694-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/3232-1481-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/3232-1074-0x0000000009340000-0x0000000009502000-memory.dmp

Filesize
1.8MB

Download
memory/3232-692-0x0000000000810000-0x000000000084E000-memory.dmp

Filesize
248KB

Download
memory/3848-48-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3848-66-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4568-1727-0x0000000002770000-0x00000000027AC000-memory.dmp

Filesize
240KB

Download
memory/4568-1734-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/4728-1525-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4728-1736-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5700-1664-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5700-1678-0x00000000001C0000-0x00000000001EE000-memory.dmp

Filesize
184KB

Download
memory/5700-1685-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/5700-1687-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/5812-1725-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5816-1485-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/5816-1714-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/5936-1662-0x000002137CB10000-0x000002137CB20000-memory.dmp

Filesize
64KB

Download
memory/5936-751-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-793-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-795-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-797-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-799-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-789-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-787-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-785-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-736-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/5936-738-0x000002137EBF0000-0x000002137ECD4000-memory.dmp

Filesize
912KB

Download
memory/5936-740-0x00007FFC87380000-0x00007FFC87E41000-memory.dmp

Filesize
10.8MB

Download
memory/5936-741-0x000002137CB10000-0x000002137CB20000-memory.dmp

Filesize
64KB

Download
memory/5936-783-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-742-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-781-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-743-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-779-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-777-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-775-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-773-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-745-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-747-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-749-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-771-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-791-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-753-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-755-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-757-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5936-1643-0x00007FFC87380000-0x00007FFC87E41000-memory.dmp

Filesize
10.8MB

Download
memory/5936-760-0x000002137EBF0000-0x000002137ECD0000-memory.dmp

Filesize
896KB

Download
memory/5992-1528-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/6204-1410-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/6204-1411-0x00000000000E0000-0x000000000109E000-memory.dmp

Filesize
15.7MB

Download
memory/6204-1530-0x0000000073D60000-0x0000000074510000-memory.dmp

Filesize
7.7MB

Download
memory/6488-440-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/6488-237-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/7056-1671-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/7056-1680-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/7064-721-0x0000023376EF0000-0x0000023376FCE000-memory.dmp

Filesize
888KB

Download
memory/7064-722-0x00007FFC87380000-0x00007FFC87E41000-memory.dmp

Filesize
10.8MB

Download
memory/7064-724-0x00000233778A0000-0x0000023377968000-memory.dmp

Filesize
800KB

Download
memory/7064-726-0x0000023376E70000-0x0000023376EBC000-memory.dmp

Filesize
304KB

Download
memory/7064-719-0x0000023375150000-0x0000023375238000-memory.dmp

Filesize
928KB

Download
memory/7064-723-0x00000233777C0000-0x00000233778A0000-memory.dmp

Filesize
896KB

Download
memory/7064-725-0x0000023377970000-0x0000023377A38000-memory.dmp

Filesize
800KB

Download
memory/7064-739-0x00007FFC87380000-0x00007FFC87E41000-memory.dmp

Filesize
10.8MB

Download
memory/7280-1506-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/7280-1729-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download
memory/7692-1654-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/7692-1634-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/7780-1659-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/8184-1594-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download