glupteba | dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a

Resubmissions

29-11-2023 16:13

231129-tpbw7shg6z 10

29-11-2023 15:20

231129-sqy8fshd4y 10

Analysis

max time kernel
368s
max time network
372s
platform
windows11-21h2_x64
resource
win11-20231128-en
resource tags

arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
submitted
29-11-2023 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe
Size

1.7MB
MD5

a060030e45f6c2d167e115463389d583
SHA1

9f7568b3f78347de535b7fa9aa87713f9b25214b
SHA256

dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a
SHA512

15759467d379255ef592fa423ec80e63377f8dae503565f435256d026860e758c051da2df9b5d6f12dfa975498e7c5b83280c12beddf22ac4552de9fb3cf2eab
SSDEEP

24576:kyILr4FcPU3/U68GN1Eac6zo5+ldWiSC9ziJV7OlFCClQOGR1a7ArzijwkBYB:zI+cc18GfEV6zQ+HWiSB7OHYhJzik2Y

Malware Config

Extracted

Family

risepro

194.49.94.152

Extracted

Family

redline

Botnet

horda

194.49.94.152:19053

Extracted

Family

smokeloader

Version

2022

http://194.49.94.210/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

194.169.175.235:42691

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

redline

Botnet

LiveTraffic

195.10.205.16:2245

Signatures

Detect ZGRat V1 16 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4464-1095-0x00000200C8FF0000-0x00000200C90D4000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1098-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1100-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1102-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1104-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1106-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1108-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1110-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1112-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1114-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1116-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1118-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1120-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1122-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1124-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4464-1126-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/6060-35-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline
behavioral1/memory/2004-1079-0x0000000000970000-0x00000000009AE000-memory.dmp	family_redline
behavioral1/memory/5300-2097-0x0000000000E40000-0x0000000000E7C000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

Processes:

taskmgr.exe

description pid process target process

PID 7368 created 5416 7368 taskmgr.exe msedge.exe
PID 7368 created 5416 7368 taskmgr.exe msedge.exe

description	pid	process	target process
PID 7368 created 5416	7368	taskmgr.exe	msedge.exe
PID 7368 created 5416	7368	taskmgr.exe	msedge.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

Processes:

latestX.exeupdater.exe

description	pid	process	target process
PID 2536 created 3132	2536	latestX.exe	Explorer.EXE
PID 2536 created 3132	2536	latestX.exe	Explorer.EXE
PID 2536 created 3132	2536	latestX.exe	Explorer.EXE
PID 2536 created 3132	2536	latestX.exe	Explorer.EXE
PID 2536 created 3132	2536	latestX.exe	Explorer.EXE
PID 6312 created 3132	6312	updater.exe	Explorer.EXE
PID 6312 created 3132	6312	updater.exe	Explorer.EXE
PID 6312 created 3132	6312	updater.exe	Explorer.EXE
PID 6312 created 3132	6312	updater.exe	Explorer.EXE
PID 6312 created 3132	6312	updater.exe	Explorer.EXE
PID 6312 created 3132	6312	updater.exe	Explorer.EXE

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF\Performance	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo\Performance	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest\Performance	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse\Performance	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService\Performance	taskmgr.exe

Downloads MZ/PE file
Drops file in Drivers directory 2 IoCs

Processes:

latestX.exeupdater.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts latestX.exe
File created C:\Windows\System32\drivers\etc\hosts updater.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exe

pid process

5420 netsh.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Deletes itself 1 IoCs

Processes:

Broom.exe

pid process

7868 Broom.exe
Drops startup file 1 IoCs

Processes:

AppLaunch.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk AppLaunch.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

pid	process
5420	netsh.exe

pid	process
7868	Broom.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	AppLaunch.exe

Executes dropped EXE 43 IoCs

Processes:

vf1YA73.exeOl4xn77.exeNo2dV67.exe1Vb44Uy0.exe2Xe9255.exe3kl64up.exe4gu967vm.exe5CX5eI1.exeFE74.exeA8.exeA8.exe3DB2.exeInstallSetup9.exetoolspub2.exeBroom.exe31839b57a4f11171d6abc8bbc4451ee4.exetuc3.exetuc3.tmplatestX.exe4EAB.exe4EAB.tmp54D6.exeVolumeUTIL.exempeg4bind.exeVolumeUTIL.exempeg4bind.exetoolspub2.exe60BE.exe68BE.exe31839b57a4f11171d6abc8bbc4451ee4.exeupdater.execsrss.exeinjector.exeXsdType.exeXsdType.exewindefender.exewindefender.exexztpwht.exesyncUpd.exef801950a962ddba14caaa44bf084b55c.exexztpwht.exeTypeId.exeTypeId.exe

pid	process
2112	vf1YA73.exe
8	Ol4xn77.exe
4932	No2dV67.exe
5800	1Vb44Uy0.exe
6040	2Xe9255.exe
6004	3kl64up.exe
5056	4gu967vm.exe
2096	5CX5eI1.exe
2004	FE74.exe
7712	A8.exe
4464	A8.exe
6548	3DB2.exe
7128	InstallSetup9.exe
1444	toolspub2.exe
7868	Broom.exe
7708	31839b57a4f11171d6abc8bbc4451ee4.exe
6100	tuc3.exe
2344	tuc3.tmp
2536	latestX.exe
4040	4EAB.exe
5588	4EAB.tmp
5312	54D6.exe
7964	VolumeUTIL.exe
6576	mpeg4bind.exe
868	VolumeUTIL.exe
3224	mpeg4bind.exe
8112	toolspub2.exe
5300	60BE.exe
6168	68BE.exe
3432	31839b57a4f11171d6abc8bbc4451ee4.exe
6312	updater.exe
5784	csrss.exe
2684	injector.exe
7776	XsdType.exe
4676	XsdType.exe
6088	windefender.exe
6704	windefender.exe
6308	xztpwht.exe
2064	syncUpd.exe
7736	f801950a962ddba14caaa44bf084b55c.exe
7700	xztpwht.exe
3332	TypeId.exe
7456	TypeId.exe

Loads dropped DLL 15 IoCs

Processes:

tuc3.tmp4EAB.tmptaskmgr.exetaskmgr.exeInstallSetup9.exesyncUpd.exe

pid	process
2344	tuc3.tmp
2344	tuc3.tmp
2344	tuc3.tmp
5588	4EAB.tmp
5588	4EAB.tmp
5588	4EAB.tmp
7368	taskmgr.exe
3240	taskmgr.exe
7128	InstallSetup9.exe
7128	InstallSetup9.exe
7128	InstallSetup9.exe
7128	InstallSetup9.exe
7128	InstallSetup9.exe
2064	syncUpd.exe
2064	syncUpd.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 12 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	152.89.198.214
Destination IP	45.155.250.90
Destination IP	152.89.198.214
Destination IP	45.155.250.90
Destination IP	152.89.198.214
Destination IP	81.31.197.38
Destination IP	152.89.198.214
Destination IP	152.89.198.214
Destination IP	152.89.198.214
Destination IP	81.31.197.38
Destination IP	45.155.250.90
Destination IP	152.89.198.214

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

csrss.exedcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exevf1YA73.exeOl4xn77.exeNo2dV67.exeAppLaunch.exe31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vf1YA73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Ol4xn77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	No2dV67.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3484251756-2814966285-185304317-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

103 api.ipify.org
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

flow	ioc
103	api.ipify.org

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe	autoit_exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe	autoit_exe

Detected potential entity reuse from brand paypal.
phishing paypal

Drops file in System32 directory 15 IoCs

Processes:

powershell.exepowershell.exeAppLaunch.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	AppLaunch.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	AppLaunch.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	AppLaunch.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	AppLaunch.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 14 IoCs

Processes:

1Vb44Uy0.exe2Xe9255.exe5CX5eI1.exeA8.exetoolspub2.exeXsdType.exeupdater.exeXsdType.exeInstallUtil.exexztpwht.exeTypeId.exeTypeId.exeRegSvcs.exe

description	pid	process	target process
PID 5800 set thread context of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 6040 set thread context of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 2096 set thread context of 2064	2096	5CX5eI1.exe	AppLaunch.exe
PID 7712 set thread context of 4464	7712	A8.exe	A8.exe
PID 1444 set thread context of 8112	1444	toolspub2.exe	toolspub2.exe
PID 7776 set thread context of 4676	7776	XsdType.exe	XsdType.exe
PID 6312 set thread context of 2860	6312	updater.exe	conhost.exe
PID 6312 set thread context of 5812	6312	updater.exe	explorer.exe
PID 4676 set thread context of 6028	4676	XsdType.exe	InstallUtil.exe
PID 6028 set thread context of 7520	6028	InstallUtil.exe	InstallUtil.exe
PID 6308 set thread context of 7700	6308	xztpwht.exe	xztpwht.exe
PID 3332 set thread context of 7456	3332	TypeId.exe	TypeId.exe
PID 7456 set thread context of 7108	7456	TypeId.exe	RegSvcs.exe
PID 7108 set thread context of 7188	7108	RegSvcs.exe	RegSvcs.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

31839b57a4f11171d6abc8bbc4451ee4.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN 31839b57a4f11171d6abc8bbc4451ee4.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 40 IoCs

Processes:

4EAB.tmptuc3.tmplatestX.exeupdater.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-22GN3.tmp	4EAB.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat	4EAB.tmp
File opened for modification	C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-ICN88.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-7H883.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-JA0U7.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-LF77M.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-57O1C.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-CB6TH.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-8TT2Q.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-42P8M.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-TFFGG.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-S6C9R.tmp	4EAB.tmp
File opened for modification	C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-9HI9E.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-NK6LL.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-PKKVE.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-I0H7P.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-4AJ3M.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\UIText\is-NTE73.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-E2LFC.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-RBINT.tmp	4EAB.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-FB0K6.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-E5QVB.tmp	4EAB.tmp
File opened for modification	C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-3GUKF.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-P31PC.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-76UD0.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-NHNIC.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-UEK4J.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\unins000.dat	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-4A23K.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-QTVBH.tmp	4EAB.tmp
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-EF2MK.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\MPEG4Binder\is-7R888.tmp	tuc3.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\is-PJ41E.tmp	4EAB.tmp
File created	C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-8PP1B.tmp	4EAB.tmp

Drops file in Windows directory 64 IoCs

Processes:

Broom.exe31839b57a4f11171d6abc8bbc4451ee4.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\Prefetch\AgGlFgAppHistory.db	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-E93AC6A6.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SEARCHPROTOCOLHOST.EXE-0CB8CADE.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7EF4A0DD.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-A7B4D8FC.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-6674203D.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\VERCLSID.EXE-7C52E31C.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-A73FB9CB.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\ONEDRIVESETUP.EXE-8CE5A462.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\REG.EXE-E7E8BD26.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-E7A262DF.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SRTASKS.EXE-4F77756F.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-FCAF5656.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-B540D505.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-FC4F7215.pf	Broom.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-156D43F1.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-9F4DB6F5.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-A8DE6D5B.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\PICKERHOST.EXE-B8A68B3C.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-97BCF638.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\TASKKILL.EXE-8F5B2253.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\WFSERVICESREG.EXE-6AD9F515.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-01E21A55.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-16AF9B6E.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SEARCHFILTERHOST.EXE-77482212.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-FF8EBD82.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\ASPNET_REGIIS.EXE-945CDB73.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\FILESYNCCONFIG.EXE-CB60E6FA.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-FFCC5BB3.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\ONEDRIVE.EXE-96969DDA.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-5EB5F789.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-AE5EC6E9.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-F1E63CFD.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\FILESYNCCONFIG.EXE-ECFE920C.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-002D6F84.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-32DA767E.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-8A79BC53.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-4BA0E729.pf	Broom.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\FSQUIRT.EXE-BBD9646E.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-5B70F332.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7C77C512.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-6F670F94.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-39F0F210.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-7CFEDEA3.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SVCHOST.EXE-E45D8788.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\NGEN.EXE-AE594A6B.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\ONEDRIVESETUP.EXE-ADFC0EFD.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\PSEXESVC.EXE-7F956DAF.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\SGRMBROKER.EXE-0CA31CC6.pf	Broom.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-0C84305E.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-47DEBDFE.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-7CB48DE8.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\PSEXEC.EXE-80F89DAE.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-4EFE6110.pf	Broom.exe
File opened for modification	C:\Windows\Prefetch\RUNDLL32.EXE-99F89D15.pf	Broom.exe

Launches sc.exe 11 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

6676 sc.exe
7488 sc.exe
5484 sc.exe
3880 sc.exe
8000 sc.exe
4464 sc.exe
4724 sc.exe
6664 sc.exe
496 sc.exe
2848 sc.exe
6076 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3812 2064 WerFault.exe syncUpd.exe

pid	process
6676	sc.exe
7488	sc.exe
5484	sc.exe
3880	sc.exe
8000	sc.exe
4464	sc.exe
4724	sc.exe
6664	sc.exe
496	sc.exe
2848	sc.exe
6076	sc.exe

pid	pid_target	process	target process
3812	2064	WerFault.exe	syncUpd.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3kl64up.exetaskmgr.exetoolspub2.exetaskmgr.exetaskmgr.exeAppLaunch.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3kl64up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3kl64up.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3kl64up.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

syncUpd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	syncUpd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	syncUpd.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2952 schtasks.exe
7324 schtasks.exe
1444 schtasks.exe
4748 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

6960 timeout.exe

pid	process
2952	schtasks.exe
7324	schtasks.exe
1444	schtasks.exe
4748	schtasks.exe

pid	process
6960	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exe31839b57a4f11171d6abc8bbc4451ee4.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exeexplorer.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-152 = "Central America Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time"	windefender.exe

Modifies registry class 1 IoCs

Processes:

Explorer.EXE

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE
Runs net.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3kl64up.exeExplorer.EXEmsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
6004	3kl64up.exe
6004	3kl64up.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
4544	msedge.exe
4544	msedge.exe
3132	Explorer.EXE
3132	Explorer.EXE
800	msedge.exe
800	msedge.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
5248	msedge.exe
5248	msedge.exe
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
3132	Explorer.EXE
5416	msedge.exe
5416	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

Explorer.EXEtaskmgr.exetaskmgr.exe

pid process

3132 Explorer.EXE
7368 taskmgr.exe
3240 taskmgr.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

680
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

3kl64up.exeAppLaunch.exetoolspub2.exe

pid process

6004 3kl64up.exe
2064 AppLaunch.exe
8112 toolspub2.exe

pid	process
3132	Explorer.EXE
7368	taskmgr.exe
3240	taskmgr.exe

pid	process
680

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

Processes:

msedge.exe

pid	process
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEtaskmgr.exetaskmgr.exe

description	pid	process
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	6736	taskmgr.exe
Token: SeSystemProfilePrivilege	6736	taskmgr.exe
Token: SeCreateGlobalPrivilege	6736	taskmgr.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: 33	6736	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6736	taskmgr.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeDebugPrivilege	7368	taskmgr.exe
Token: SeSystemProfilePrivilege	7368	taskmgr.exe
Token: SeCreateGlobalPrivilege	7368	taskmgr.exe
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE
Token: SeShutdownPrivilege	3132	Explorer.EXE
Token: SeCreatePagefilePrivilege	3132	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

4gu967vm.exemsedge.exetaskmgr.exe

pid	process
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

4gu967vm.exemsedge.exetaskmgr.exetaskmgr.exe

pid	process
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5416	msedge.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
5056	4gu967vm.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
6736	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe
7368	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Broom.exeExplorer.EXE

pid process

7868 Broom.exe
3132 Explorer.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3132 Explorer.EXE

pid	process
7868	Broom.exe
3132	Explorer.EXE

pid	process
3132	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exevf1YA73.exeOl4xn77.exeNo2dV67.exe1Vb44Uy0.exe2Xe9255.exeAppLaunch.exe4gu967vm.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 3268 wrote to memory of 2112	3268	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe	vf1YA73.exe
PID 3268 wrote to memory of 2112	3268	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe	vf1YA73.exe
PID 3268 wrote to memory of 2112	3268	dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe	vf1YA73.exe
PID 2112 wrote to memory of 8	2112	vf1YA73.exe	Ol4xn77.exe
PID 2112 wrote to memory of 8	2112	vf1YA73.exe	Ol4xn77.exe
PID 2112 wrote to memory of 8	2112	vf1YA73.exe	Ol4xn77.exe
PID 8 wrote to memory of 4932	8	Ol4xn77.exe	No2dV67.exe
PID 8 wrote to memory of 4932	8	Ol4xn77.exe	No2dV67.exe
PID 8 wrote to memory of 4932	8	Ol4xn77.exe	No2dV67.exe
PID 4932 wrote to memory of 5800	4932	No2dV67.exe	1Vb44Uy0.exe
PID 4932 wrote to memory of 5800	4932	No2dV67.exe	1Vb44Uy0.exe
PID 4932 wrote to memory of 5800	4932	No2dV67.exe	1Vb44Uy0.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 5800 wrote to memory of 1936	5800	1Vb44Uy0.exe	AppLaunch.exe
PID 4932 wrote to memory of 6040	4932	No2dV67.exe	2Xe9255.exe
PID 4932 wrote to memory of 6040	4932	No2dV67.exe	2Xe9255.exe
PID 4932 wrote to memory of 6040	4932	No2dV67.exe	2Xe9255.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 6040 wrote to memory of 6060	6040	2Xe9255.exe	AppLaunch.exe
PID 8 wrote to memory of 6004	8	Ol4xn77.exe	3kl64up.exe
PID 8 wrote to memory of 6004	8	Ol4xn77.exe	3kl64up.exe
PID 8 wrote to memory of 6004	8	Ol4xn77.exe	3kl64up.exe
PID 1936 wrote to memory of 4748	1936	AppLaunch.exe	schtasks.exe
PID 1936 wrote to memory of 4748	1936	AppLaunch.exe	schtasks.exe
PID 1936 wrote to memory of 4748	1936	AppLaunch.exe	schtasks.exe
PID 1936 wrote to memory of 2952	1936	AppLaunch.exe	schtasks.exe
PID 1936 wrote to memory of 2952	1936	AppLaunch.exe	schtasks.exe
PID 1936 wrote to memory of 2952	1936	AppLaunch.exe	schtasks.exe
PID 2112 wrote to memory of 5056	2112	vf1YA73.exe	4gu967vm.exe
PID 2112 wrote to memory of 5056	2112	vf1YA73.exe	4gu967vm.exe
PID 2112 wrote to memory of 5056	2112	vf1YA73.exe	4gu967vm.exe
PID 5056 wrote to memory of 5416	5056	4gu967vm.exe	msedge.exe
PID 5056 wrote to memory of 5416	5056	4gu967vm.exe	msedge.exe
PID 5056 wrote to memory of 2780	5056	4gu967vm.exe	msedge.exe
PID 5056 wrote to memory of 2780	5056	4gu967vm.exe	msedge.exe
PID 5416 wrote to memory of 3996	5416	msedge.exe	msedge.exe
PID 5416 wrote to memory of 3996	5416	msedge.exe	msedge.exe
PID 2780 wrote to memory of 1464	2780	msedge.exe	msedge.exe
PID 2780 wrote to memory of 1464	2780	msedge.exe	msedge.exe
PID 5056 wrote to memory of 3284	5056	4gu967vm.exe	msedge.exe
PID 5056 wrote to memory of 3284	5056	4gu967vm.exe	msedge.exe
PID 3284 wrote to memory of 4604	3284	msedge.exe	msedge.exe
PID 3284 wrote to memory of 4604	3284	msedge.exe	msedge.exe
PID 5056 wrote to memory of 900	5056	4gu967vm.exe	msedge.exe
PID 5056 wrote to memory of 900	5056	4gu967vm.exe	msedge.exe
PID 900 wrote to memory of 988	900	msedge.exe	msedge.exe
PID 900 wrote to memory of 988	900	msedge.exe	msedge.exe
PID 5056 wrote to memory of 4624	5056	4gu967vm.exe	msedge.exe
PID 5056 wrote to memory of 4624	5056	4gu967vm.exe	msedge.exe
PID 4624 wrote to memory of 5196	4624	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:3132

C:\Users\Admin\AppData\Local\Temp\dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe
"C:\Users\Admin\AppData\Local\Temp\dcc72e7e7d3f483ed2bf91e99c5485ee4126d6f564d799cc996351d28513e73a.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3268

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2112

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:8

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4932

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:4748

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
8⤵
- Creates scheduled task(s)
PID:2952

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:6040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:6060

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:6004

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
6⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
6⤵
PID:5308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
6⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
6⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
6⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
6⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
6⤵
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
6⤵
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1
6⤵
PID:6300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
6⤵
PID:6620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
6⤵
PID:6428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
6⤵
PID:6748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
6⤵
PID:7128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6808 /prefetch:1
6⤵
PID:6904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
6⤵
PID:6952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5464 /prefetch:8
6⤵
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1
6⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
6⤵
PID:7624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
6⤵
PID:7756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
6⤵
PID:7864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,15988058933317906517,4689375376012255373,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3348 /prefetch:2
6⤵
PID:7868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
5⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,13462941357940368253,4267770424444001191,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
6⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,13462941357940368253,4267770424444001191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x148,0x14c,0x150,0x118,0x154,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,17083927896935400527,6238150794263313722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:3
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,17083927896935400527,6238150794263313722,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:2
6⤵
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/login
5⤵
- Suspicious use of WriteProcessMemory
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9048084094994691465,14523990357400289905,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
6⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://twitter.com/i/flow/login
5⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x114,0x13c,0x140,0x120,0x144,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,11184055203046839674,12588014133211996804,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 /prefetch:3
6⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,11184055203046839674,12588014133211996804,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2020 /prefetch:2
6⤵
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://steamcommunity.com/openid/loginform
5⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,8565865123260596024,16609111235075268361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
6⤵
PID:6440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.epicgames.com/id/login
5⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.paypal.com/signin
5⤵
PID:1856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
5⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
5⤵
PID:6832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
6⤵
PID:7012

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2064

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
2⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6736

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /1
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:7368

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /1
4⤵
- Enumerates VirtualBox registry keys
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
PID:3240

C:\Users\Admin\AppData\Local\Temp\FE74.exe
C:\Users\Admin\AppData\Local\Temp\FE74.exe
2⤵
- Executes dropped EXE
PID:2004

C:\Users\Admin\AppData\Local\Temp\A8.exe
C:\Users\Admin\AppData\Local\Temp\A8.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7712

C:\Users\Admin\AppData\Local\Temp\A8.exe
C:\Users\Admin\AppData\Local\Temp\A8.exe
3⤵
- Executes dropped EXE
PID:4464

C:\Users\Admin\AppData\Local\Temp\3DB2.exe
C:\Users\Admin\AppData\Local\Temp\3DB2.exe
2⤵
- Executes dropped EXE
PID:6548

C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe
"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7128

C:\Users\Admin\AppData\Local\Temp\Broom.exe
C:\Users\Admin\AppData\Local\Temp\Broom.exe
4⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:7868

C:\Windows\SysWOW64\cmd.exe
cmd /c rd /s /q c:\$Recycle.bin
5⤵
PID:3500

C:\Windows\SysWOW64\cmd.exe
cmd /c rd /s /q c:\recycler
5⤵
PID:2156

C:\Windows\SysWOW64\cmd.exe
cmd /c rd /s /q c:\$Recycle.bin
5⤵
PID:4744

C:\Windows\SysWOW64\cmd.exe
cmd /c rd /s /q c:\recycler
5⤵
PID:5548

C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2064

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\syncUpd.exe" & del "C:\ProgramData\*.dll"" & exit
5⤵
PID:3652

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
6⤵
- Delays execution with timeout.exe
PID:6960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 2604
5⤵
- Program crash
PID:3812

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1444

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8112

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
3⤵
- Executes dropped EXE
PID:7708

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
PID:6556

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3432

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:8176

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:6804

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:5420

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:6332

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4328

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
PID:5784

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4156

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:7324

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:4332

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:7056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:7744

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
- Executes dropped EXE
PID:2684

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:1444

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
- Executes dropped EXE
PID:6088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:4604

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:8000

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3100

C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
6⤵
- Executes dropped EXE
PID:7736

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn "csrss" /f
7⤵
PID:5420

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn "ScheduledUpdate" /f
7⤵
PID:7976

C:\Users\Admin\AppData\Local\Temp\tuc3.exe
"C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
3⤵
- Executes dropped EXE
PID:6100

C:\Users\Admin\AppData\Local\Temp\is-3NS41.tmp\tuc3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-3NS41.tmp\tuc3.tmp" /SL5="$303A4,3243561,76288,C:\Users\Admin\AppData\Local\Temp\tuc3.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:2344

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
5⤵
PID:8008

C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe
"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -i
5⤵
- Executes dropped EXE
PID:6576

C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe
"C:\Program Files (x86)\Common Files\MPEG4Binder\mpeg4bind.exe" -s
5⤵
- Executes dropped EXE
PID:3224

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 28
5⤵
PID:1692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 28
6⤵
PID:6320

C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:2536

C:\Users\Admin\AppData\Local\Temp\4EAB.exe
C:\Users\Admin\AppData\Local\Temp\4EAB.exe
2⤵
- Executes dropped EXE
PID:4040

C:\Users\Admin\AppData\Local\Temp\is-C43UG.tmp\4EAB.tmp
"C:\Users\Admin\AppData\Local\Temp\is-C43UG.tmp\4EAB.tmp" /SL5="$601E4,3304892,54272,C:\Users\Admin\AppData\Local\Temp\4EAB.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:5588

C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -i
4⤵
- Executes dropped EXE
PID:7964

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
4⤵
PID:4832

C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe
"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -s
4⤵
- Executes dropped EXE
PID:868

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 29
4⤵
PID:6020

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 29
5⤵
PID:6792

C:\Users\Admin\AppData\Local\Temp\54D6.exe
C:\Users\Admin\AppData\Local\Temp\54D6.exe
2⤵
- Executes dropped EXE
PID:5312

C:\Users\Admin\AppData\Local\Temp\60BE.exe
C:\Users\Admin\AppData\Local\Temp\60BE.exe
2⤵
- Executes dropped EXE
PID:5300

C:\Users\Admin\AppData\Local\Temp\68BE.exe
C:\Users\Admin\AppData\Local\Temp\68BE.exe
2⤵
- Executes dropped EXE
PID:6168

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
PID:2484

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:6432

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:6664

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:6676

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:7488

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:5484

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:3880

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:5616

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:2008

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:6708

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:5928

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:6728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
PID:6072

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
2⤵
PID:2600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1000

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
PID:2264

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4464

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:496

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:2848

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4724

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:6076

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:5184

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:6620

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:4852

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:5936

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:1408

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1920

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
PID:2860

C:\Windows\explorer.exe
C:\Windows\explorer.exe
2⤵
- Modifies data under HKEY_USERS
PID:5812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x148,0x14c,0x150,0x11c,0x154,0x7ff9eca33cb8,0x7ff9eca33cc8,0x7ff9eca33cd8
1⤵
PID:4684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7228

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\6f4126c8cbc044f68afc6b1c304c9852 /t 5708 /p 5416
1⤵
PID:7260

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:6312

C:\Users\Admin\AppData\Local\Opcode\ubgfzwww\XsdType.exe
C:\Users\Admin\AppData\Local\Opcode\ubgfzwww\XsdType.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7776

C:\Users\Admin\AppData\Local\Opcode\ubgfzwww\XsdType.exe
C:\Users\Admin\AppData\Local\Opcode\ubgfzwww\XsdType.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4676

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
3⤵
- Suspicious use of SetThreadContext
PID:6028

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
4⤵
PID:7520

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6704

C:\Users\Admin\AppData\Local\Temp\xztpwht.exe
C:\Users\Admin\AppData\Local\Temp\xztpwht.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:6308

C:\Users\Admin\AppData\Local\Temp\xztpwht.exe
C:\Users\Admin\AppData\Local\Temp\xztpwht.exe
2⤵
- Executes dropped EXE
PID:7700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2064 -ip 2064
1⤵
PID:7812

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3332

C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
C:\Users\Admin\AppData\Roaming\NextChannelSink\TypeId.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7456

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
3⤵
- Suspicious use of SetThreadContext
PID:7108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
4⤵
PID:7188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\FHCBGIIJ

Filesize
112KB

MD5
b8d21330da9dc836ed3e8e579926f2c6

SHA1
a05f04f6c8c1ccee9b40052655c1e83b760fc1e8

SHA256
6ff6a41f452b0d23d88f6e2f79e3039d142eb1b1761abd12775fa7b637fa73a9

SHA512
a2fd9061d38f5f6b1c89e957669768329de74df4e817413fae44f234870fd21c092d26e586cb5837c1e57f3a0d3f5eaad4c32e1c4d9cf34b0561e28cc5649416

Download Submit
C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe

Filesize
100KB

MD5
77656f8297803d4b5c9d6804f2da62f9

SHA1
6425c666e1611d56a929124171811830e031b386

SHA256
1830afacaa1f2cee9cb28918f9a0163e39f47b527b2cbaf62edbda54d6a8ac28

SHA512
023b33063d68f11754b8330fcf45a7019e97e80df5ea35aaecdaee3af1dc139c0b827de8caba11ff0009ce66525890da46eb79438a188f551495117ac36b2dcc

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
11722fb37c8cc94e666085b16bdd836c

SHA1
0ba98ac7f767d405d410558cccdd2b00f967e15d

SHA256
afadd1ce87b0437be5afd4bff9356780502fa6bc2f16ad6225b30145f177274d

SHA512
d2fcd3b6fda207fbdd223d85515860e922f62084fe97bd024e3f0bdbb74cbb90068eef69b1a95ff61a1c873e8a3a9b6b8ad46e063040ad73e54eb987e1a428f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TypeId.exe.log

Filesize
1KB

MD5
6766a7cc8b7039bf7f32b9e4a63b7f4d

SHA1
8eb95e170a3dc512589a12ec936989d7d3bb86e4

SHA256
14c0bf2c6febb71441fe2b1a04934a00d49aeee1bf2d9f21452cba57ade2fd0a

SHA512
636e1091399f101f8494936489fb605ae91d542639b4704d5f541a64dffb320960c676c730bca2a835ab70c9feed517b87efa9390f7cb06c73fde50d7a75d331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55542110-2d25-44cf-b9c8-da313c04593f.tmp

Filesize
2KB

MD5
418b15dc3ca4e2fe964b764860cf0ede

SHA1
b3f9baf3dca732b26427d6ae22375b64db90f0cb

SHA256
4b52cc987dad3a469feaaf8f782725645e4bbdf3830408f21343c5b897940f89

SHA512
7b2d0c35eda312ce8766fae549ed7d186729cd4e981b105c68da2f8b0907aeb74607e318dc9f2033ea4dabf84af93c2067f81f8e68a4bf5e6a573284c65c79ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d84ce9b4c1ec0024a4ad8bd286889d94

SHA1
5d593279963c334375579f489215f9a255c6e724

SHA256
6bd8103b715d1b39a3d8825b07b972e05c58e0176cbfeb14ba33369d43a546ba

SHA512
263714e55582f6e48354c6ad0208a7c2746b4a32c8bc5cabb315cf1849d862eb086048e6b6ca201a4fbcb2fac981fea505ff83c417a93d62cc1336b94c8d34ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d84ce9b4c1ec0024a4ad8bd286889d94

SHA1
5d593279963c334375579f489215f9a255c6e724

SHA256
6bd8103b715d1b39a3d8825b07b972e05c58e0176cbfeb14ba33369d43a546ba

SHA512
263714e55582f6e48354c6ad0208a7c2746b4a32c8bc5cabb315cf1849d862eb086048e6b6ca201a4fbcb2fac981fea505ff83c417a93d62cc1336b94c8d34ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d84ce9b4c1ec0024a4ad8bd286889d94

SHA1
5d593279963c334375579f489215f9a255c6e724

SHA256
6bd8103b715d1b39a3d8825b07b972e05c58e0176cbfeb14ba33369d43a546ba

SHA512
263714e55582f6e48354c6ad0208a7c2746b4a32c8bc5cabb315cf1849d862eb086048e6b6ca201a4fbcb2fac981fea505ff83c417a93d62cc1336b94c8d34ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6b9543a1c167d24c0d4b0399a13a7e79

SHA1
6f58a92dc29ffc1b309ecb634fcef10030d096a5

SHA256
115b6dc809257d2f5fac27700a171c5c2e6da9d13c44f502ed104a2f3acd966e

SHA512
ee558daf3a46fc2ff1d79a1ee4cfa104d0610225080e94366bf251bba9d319b3cd6d3751ba0914d5781f2afcbb0e3c0e9fc7cfc0a48426d90c3e5c1bddc34719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
21KB

MD5
7d75a9eb3b38b5dd04b8a7ce4f1b87cc

SHA1
68f598c84936c9720c5ffd6685294f5c94000dff

SHA256
6c24799e77b963b00401713a1dbd9cba3a00249b9363e2c194d01b13b8cdb3d7

SHA512
cf0488c34a1af36b1bb854dea2decfc8394f47831b1670cab3eed8291b61188484cc8ab0a726a524ecdd20b71d291bcccbc2ce999fd91662aca63d2d22ed0d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
33KB

MD5
09a51b4e0d6e59ba0955364680a41cd6

SHA1
0c9bf805aa43f66b8c7854ccf7c2e2873050a8c2

SHA256
c96a6b48cc4325a0ea43e58c22eefc3713d8720c13ed3cdabc67372d9e1b470d

SHA512
bfa291e26fdddea478b3cc96ce31ca02993194bdf73303f73ee2d021287206fb359e17fc970e7e124e3108e72877a1edc08e8848181c303f0b251379cfef0f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
228KB

MD5
c0660cfcd794ca909e7af9b022407c0c

SHA1
60acb88ea5cee5039ed5c8b98939a88146152956

SHA256
7daf6a271b7fb850af986ee9ea160f35b9500478509e3bd5649c42e20de54083

SHA512
ccf4f2885656c3eacc4ad1c521079757a3340701bebd2a24fe2e74e6c40207e607b2220e233d561e02228ce427edc5081ef068ccd7a53246bbea911e001fa13c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b278a2da4e0f4186f56ede33d13ab5eb

SHA1
ffe3cc9cb145d4236bc829567b56bfd5ff919fcd

SHA256
dd891e23d0765af08dca0b340631e74b72cac08857c913b127fcbf3caa657b9b

SHA512
6f9ed0198312d371770b295e42f5192f0b13eb7700f22fc08c633b05d2502a3920c9a95abf4c6fe7688bc97e4b8e1d7296909a5af9f25619c473340c93b126de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
81c66fb5eaaa7119450ccb8036e17a95

SHA1
8004ca9c1dce88ec7d9bbeb2172f362345f9cfc4

SHA256
8eb01d14596bd445986888270428276e7aac4f7b4ea5ec52e0c982fec39e3f2a

SHA512
1a9ab4a61229b8e15dd527426bbcd2afdbfb3a5e7050f074e0dedce695fe18e90deebf8d5d8ed20cba9f9f226bf62861c7d6b27a283d739a7989e292cf19fb8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c9d4f9d9a69eafb453c122ad86d22a0c

SHA1
6d27b005c5cf328d3aee1a53d87ad6f4129d2c11

SHA256
3342cad055f8c23f416dfd042ca6a4b00ca5218a33827771bd50ebfaeed87241

SHA512
fbf6ab661cbfbe8436d767be65c38546bf3029286561476c7f8e1f34b131fd8a91dd2c8723fb9584c06c9848cfb7f590df14705b7092b1240234d8a612667dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\e2b2aeeb-1f28-44c4-9c86-ccacac4a0539\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
af3e1aae0c68ea514a7e7e59a54c2c3f

SHA1
efe8da4452b78834dfc305e3d1ee489e935a114e

SHA256
05e1cc8e3e9a3a9e7c1d045a58d0264a9ad4ea379f1a5704e03c861a14271ddc

SHA512
a48d2b7d254dcb51d8b648fad745ab0001962827a67c6bc21c8c4ff6c81871a4f7617367f0aeb6302cf8d5c824320661bfc3c5f3b4ac8acad48ce905d0c2369f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
a026cef27d766acc9cfb45ba724c6d5f

SHA1
bea2196b51fcd7c09103d4275a7e182c1e69b898

SHA256
995eeb82b47d22f152c69f66f6209593281211a733d2b0067dfe320728b01ed5

SHA512
199cc6f567033ad5645790e6de8cb0a2ede70f918161e611b7a26b53d425163c0d7ddbf6b613cc29f852c16b96a4db625d561a79fc4ba6b9809238f3d2f4777d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
8cfa2629689a07056bea680cb5aa79b4

SHA1
f16bcd9d13e354251e8683ee4bfdcc4c359d4e66

SHA256
e26a24b6f461e71097fde6865fe27b6e96dc2ce589c553d5c2382dcd60592e69

SHA512
c1660c6b0260ba7231369ba0e51f630d123abe19f6acf1770c6bd642ce8c870bbe0f9ac91a0ac16f6752074a09c86f446e8e6e180f3eeae20b838bd4d65e8da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\8b0356bb-b9dd-4392-acd0-41d51da23dd6\index-dir\the-real-index

Filesize
936B

MD5
282fdca3cb477a8630279a13022eec7a

SHA1
0d68d9bbae351db606750a010e5e3306c55456bc

SHA256
0e1996c499f1adc8eb64565f95b0274b3dfc2b8531da337d0599d9767e6a8be1

SHA512
4ff2f0ec699ed95782830c2465b16a753cf217b5b983e589869f27d32a9b1d1493558b4f7775aa7ff835e022c4b2f3a8cd0ab884b40b81cc7a538c8215a444ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\8b0356bb-b9dd-4392-acd0-41d51da23dd6\index-dir\the-real-index~RFe57e678.TMP

Filesize
48B

MD5
816a25a3b6d981668e99389ad71016fa

SHA1
4ff3918e263a1880f9d5a52c5fb4901e4ee22352

SHA256
a4805a592ef497e79f13ce4edbeae2c867516fe9e210cf7484c064aa64ec1273

SHA512
dd7a70c999295e1cb39a9316c01e311a7cfcad75dbffc081dc481acccae61a10093a4686fec05ce7a6290b18a8ce7ac55a33722dae1888a08a667cf99739b6ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\ae1b86c2-3d93-41c8-9da1-3150c5157969\index-dir\the-real-index

Filesize
72B

MD5
7cf544c24d143cdb93ba374c6e9ff0d4

SHA1
e4f8313d53c43dbbb427ad149658a2a258dc8716

SHA256
8aca997520f071b7c701a42d604304067215c210776bf3cea456861841e74331

SHA512
8729e48fab800ad738253cfa60e81105c3c0adbaf5c5c84fd1c159d8b1168d622d86e872003c3d5e7c2e85ea840c7f898a1c48a3ce71b9b404a5a833151623b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\ae1b86c2-3d93-41c8-9da1-3150c5157969\index-dir\the-real-index~RFe57e678.TMP

Filesize
48B

MD5
423dd19b0834592fa3f92bbc5f3b7c37

SHA1
b6572c9a1a5de30d6311f93c0ae3ce5621770e07

SHA256
8cbd76b60ff2fa69926f76d7b54b9086d0d4bc2144d48ceab8ceba5d5cae6a16

SHA512
7f9141f8e10d21bc4200a28f393c92242a33ed470602888c2bdb4d0082780944911efec162136f592152e631871dcddcf9ac5300eb01d2be594286d661ae3cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt

Filesize
140B

MD5
2c9987d10da4e211937289ea59137c14

SHA1
16fe9966ffd107a62fe5da4a4c13959973638ce3

SHA256
c8cfffa60ad3c3aac2d69dea3264c280a375aff39863083b181e27532dcb9af5

SHA512
4a98d66fce6f4b0b796d5fb53a525ecdc74ea1bbbeec0f19a7d57153546acdc215b8034d3637850594b1a57e1ba6c5eecae8f05810d37e3651793eee15a2e72f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8f7abdeb3486c1b8780fede76afc20e044eff1b5\index.txt~RFe57b9f9.TMP

Filesize
83B

MD5
aeaafb151c11287e3d988b4221274a72

SHA1
d4590d43e16ef67abb2d6fef2cfe5d1b8e9cf6e8

SHA256
ee0ffdf203edacf834d07fb983328eedd4ce41c257c8e16529497ddfc352ed8a

SHA512
1e06a0443fb0897540f173ae5029eda5857389f75164d4dfc374d0dca2843bf9c11416725c312e60ebcd1d51c38206cd5e68cf82bcc7adfd70905787d1a3273c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003

Filesize
20KB

MD5
2a029687e73114ebcb4fad10c0114e8a

SHA1
f09cbbed46b9f8c731568bdcee13024e89bda397

SHA256
fe6e92a5b020858bbdd8089533c6f22703bc5927e22f689c384164096705b11b

SHA512
211dc45e2bb5739bcf863c44ca8132f92e895b3c95d074929aa4338698d53c6ccb3a8e2f23180260d9226073f4f5cd21a200010a7a224de7c8ac2e1cc853730d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
418b15dc3ca4e2fe964b764860cf0ede

SHA1
b3f9baf3dca732b26427d6ae22375b64db90f0cb

SHA256
4b52cc987dad3a469feaaf8f782725645e4bbdf3830408f21343c5b897940f89

SHA512
7b2d0c35eda312ce8766fae549ed7d186729cd4e981b105c68da2f8b0907aeb74607e318dc9f2033ea4dabf84af93c2067f81f8e68a4bf5e6a573284c65c79ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
e15ba17a907ca98c5c4e99f225654763

SHA1
834c663d4464c71c4bcfaa1ef11b964df889f1bc

SHA256
3f44250b20e808ba7445a6d7f5c07fa44d0484e809293be7b95dba150b308971

SHA512
767784691f53118c15fa431b8427805d9f6eed7d0e6cd44bcbb394e7b92213529107576fd640c52081b0219b5ef4aceccb481b6fb9da0f268934d8739d83a7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
e15ba17a907ca98c5c4e99f225654763

SHA1
834c663d4464c71c4bcfaa1ef11b964df889f1bc

SHA256
3f44250b20e808ba7445a6d7f5c07fa44d0484e809293be7b95dba150b308971

SHA512
767784691f53118c15fa431b8427805d9f6eed7d0e6cd44bcbb394e7b92213529107576fd640c52081b0219b5ef4aceccb481b6fb9da0f268934d8739d83a7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
42c7cff7311f719320b830b500881876

SHA1
806cebcf62cab3039de51414ae0d78dddb2083c4

SHA256
a080788e8242b9fda3f545b4ced1b76a030692efb98b1a317e02fd1ae1e6ef4a

SHA512
408fe1f184deef2576032340b9e40f8e456d66ce6710be0d3b039fad97865eff4ac13b5ab56853291c15140333f6afb682f59daf99dd3117bf38bfd94c9e6d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
42c7cff7311f719320b830b500881876

SHA1
806cebcf62cab3039de51414ae0d78dddb2083c4

SHA256
a080788e8242b9fda3f545b4ced1b76a030692efb98b1a317e02fd1ae1e6ef4a

SHA512
408fe1f184deef2576032340b9e40f8e456d66ce6710be0d3b039fad97865eff4ac13b5ab56853291c15140333f6afb682f59daf99dd3117bf38bfd94c9e6d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a8f13d06a768abaf97cc7002b0cd7fb

SHA1
e07162ae399e8f993fa21f10a8c6ad7587068ca7

SHA256
3caae7f8e6c34cb65c967b4150e4b3fb8ed884e1cd9915d3c0533291a10a288b

SHA512
de7705108846f262507cc2c98881d968ca97dc05e6a14e1b695874036f90d82fc4b8a033d41c1f0c243a3c2c3b45070370975d8684d6563449ec402fbef03e8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
caf13e2bd4d23fd70a754ad4ff38b1ad

SHA1
3f7bfeb78b075b5a01d48100da388f03ab19a3e0

SHA256
3d38a6e8ca224bd6fc6b1b8f06267509b6b1e31a9d4d2f9420eddbbcccb28f71

SHA512
0fadf3b3d2de3d5a6727e0aae48083b0b2b6037910ee11b4e197f3087e6c76d7a968728bab7bd59f9cefb70f6822f6dbf21e13c19486bd4c5651f46031d4a113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
caf13e2bd4d23fd70a754ad4ff38b1ad

SHA1
3f7bfeb78b075b5a01d48100da388f03ab19a3e0

SHA256
3d38a6e8ca224bd6fc6b1b8f06267509b6b1e31a9d4d2f9420eddbbcccb28f71

SHA512
0fadf3b3d2de3d5a6727e0aae48083b0b2b6037910ee11b4e197f3087e6c76d7a968728bab7bd59f9cefb70f6822f6dbf21e13c19486bd4c5651f46031d4a113

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
ea2c1ab46657d1d282278b2ac462a54a

SHA1
64f295340a434bd073837806d234bd7b7f0abc03

SHA256
57fda2981750ff5fedfc8bf9e3b9925b9f418b02a326db5987b6f18d1bd4ed6f

SHA512
ee9e3125b3c2e9daba595d3cb0df2c78149f8aae5854db1c9aef8b2594e5e829b44b7a08a4248efede410f132d4b46021e2322f7f515a84bb5ba43b0f80f7ad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
ea2c1ab46657d1d282278b2ac462a54a

SHA1
64f295340a434bd073837806d234bd7b7f0abc03

SHA256
57fda2981750ff5fedfc8bf9e3b9925b9f418b02a326db5987b6f18d1bd4ed6f

SHA512
ee9e3125b3c2e9daba595d3cb0df2c78149f8aae5854db1c9aef8b2594e5e829b44b7a08a4248efede410f132d4b46021e2322f7f515a84bb5ba43b0f80f7ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.2MB

MD5
194599419a04dd1020da9f97050c58b4

SHA1
cd9a27cbea2c014d376daa1993538dac80968114

SHA256
37378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe

SHA512
551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe

Filesize
219KB

MD5
f5a086c831973eb628af8ae477dbba2d

SHA1
f91a16149d57072b8a92097cbc2c90f2bd480f88

SHA256
878103685ca87ccc49028e2a4fcd2f935b285d4224f6256213e5f33420dfcaba

SHA512
b3a7ed38f9efb77ff79059a32a12f4bcde531cda2dceadb1c36088188bfe141a3d49f08e2fe6c8fc29a118ee9af5a56f36a1b06938d900dfd9a67b90b5e8f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5CX5eI1.exe

Filesize
219KB

MD5
f5a086c831973eb628af8ae477dbba2d

SHA1
f91a16149d57072b8a92097cbc2c90f2bd480f88

SHA256
878103685ca87ccc49028e2a4fcd2f935b285d4224f6256213e5f33420dfcaba

SHA512
b3a7ed38f9efb77ff79059a32a12f4bcde531cda2dceadb1c36088188bfe141a3d49f08e2fe6c8fc29a118ee9af5a56f36a1b06938d900dfd9a67b90b5e8f4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe

Filesize
1.5MB

MD5
7f7c88a33d9723c35a6051fd95fa4067

SHA1
1eb8d86bbe6a47d608a206708a9abd210f62f00c

SHA256
2c0c06408590c1e4e7b99afd429775c53371aae8a16be9fe43624e76caa343ec

SHA512
737474b0d6d91cd0b5289a8136377363c28574b8f7df1bbcb333bce10d7ef791b4ef897cc0d1419272ebbfa80b03049bb1278697de8458e0ca2fb19c1c25e78b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vf1YA73.exe

Filesize
1.5MB

MD5
7f7c88a33d9723c35a6051fd95fa4067

SHA1
1eb8d86bbe6a47d608a206708a9abd210f62f00c

SHA256
2c0c06408590c1e4e7b99afd429775c53371aae8a16be9fe43624e76caa343ec

SHA512
737474b0d6d91cd0b5289a8136377363c28574b8f7df1bbcb333bce10d7ef791b4ef897cc0d1419272ebbfa80b03049bb1278697de8458e0ca2fb19c1c25e78b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe

Filesize
895KB

MD5
caf3505c5244a7a2ee9071b6632a5f31

SHA1
585c37d41ee6f41b1f389cc3182b6eb04d5f769a

SHA256
19f5bb3652ec616f0423f8c984c4a4230631a408001fc4377d3b89bf83401c42

SHA512
fda4c2ce9e708118c2eb0d4d611f4e92e55afb1700d4d52da39e1909492c5e7ab93bc785f9cad8e327122e17bb79d8e67236a0711d1af266c1030b303af4fd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4gu967vm.exe

Filesize
895KB

MD5
caf3505c5244a7a2ee9071b6632a5f31

SHA1
585c37d41ee6f41b1f389cc3182b6eb04d5f769a

SHA256
19f5bb3652ec616f0423f8c984c4a4230631a408001fc4377d3b89bf83401c42

SHA512
fda4c2ce9e708118c2eb0d4d611f4e92e55afb1700d4d52da39e1909492c5e7ab93bc785f9cad8e327122e17bb79d8e67236a0711d1af266c1030b303af4fd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe

Filesize
1.1MB

MD5
92c486d3212831b18786a62abf831497

SHA1
13b41c107854ff3faa00d2b84b534b8ba78ef68a

SHA256
11420db0ce86660f43d2b1014e1e4c625efd553afbd2504419b1c4ca5301fb07

SHA512
75e76d0d838ea85b00111577e03d3bd82e76bf6effc64c8ed087976151ac734db72b74811fa5257021c7b324fd5b2eac6f51bf38720fa2f1e3705daf55dab273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ol4xn77.exe

Filesize
1.1MB

MD5
92c486d3212831b18786a62abf831497

SHA1
13b41c107854ff3faa00d2b84b534b8ba78ef68a

SHA256
11420db0ce86660f43d2b1014e1e4c625efd553afbd2504419b1c4ca5301fb07

SHA512
75e76d0d838ea85b00111577e03d3bd82e76bf6effc64c8ed087976151ac734db72b74811fa5257021c7b324fd5b2eac6f51bf38720fa2f1e3705daf55dab273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe

Filesize
38KB

MD5
130f76a4eb2fd826ddfade140794fbd4

SHA1
b81a5db8cb86ccf286e169504f3c1a56d9e8cb4d

SHA256
c44fa253ff90e80115b377a3b9c1a0a422a8f82c6d97c3d6df485227f6dac4a5

SHA512
18b87831c6aac725e2d71f601c599767a07615115b40c7c9b5090923b16c8f17ca7e7a395f8e8d45c75700aabcbe85f99cbbf38243d23740e7b2df796ea6193f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3kl64up.exe

Filesize
38KB

MD5
130f76a4eb2fd826ddfade140794fbd4

SHA1
b81a5db8cb86ccf286e169504f3c1a56d9e8cb4d

SHA256
c44fa253ff90e80115b377a3b9c1a0a422a8f82c6d97c3d6df485227f6dac4a5

SHA512
18b87831c6aac725e2d71f601c599767a07615115b40c7c9b5090923b16c8f17ca7e7a395f8e8d45c75700aabcbe85f99cbbf38243d23740e7b2df796ea6193f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe

Filesize
964KB

MD5
7172171d2d830e627e3f18b455713fd1

SHA1
358c2360f82f40eaab06918764c30d65b37157c0

SHA256
b843430500dcd41998a67225ebc23b3d492a65d013960b10d0d9013476b982e5

SHA512
89374e2095344066c9f0f49b5da6d5f948a8003e384bcc4119d811a9bdf691dee87c8013d827856422f31405e28d72bce3ebd0a36b2ccb340d2efb11709c7a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\No2dV67.exe

Filesize
964KB

MD5
7172171d2d830e627e3f18b455713fd1

SHA1
358c2360f82f40eaab06918764c30d65b37157c0

SHA256
b843430500dcd41998a67225ebc23b3d492a65d013960b10d0d9013476b982e5

SHA512
89374e2095344066c9f0f49b5da6d5f948a8003e384bcc4119d811a9bdf691dee87c8013d827856422f31405e28d72bce3ebd0a36b2ccb340d2efb11709c7a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe

Filesize
1.6MB

MD5
f0f2b1d8ae7a5d7ef3466177f844b8ee

SHA1
2fd508e69614eecf8c19a49dc7ac4d9e456218e2

SHA256
b4cb5f50adb5925ed88e8f48b670ab4f9303de4ba03ad1bded92591f83938a75

SHA512
1de045bd28d630018b145ad5e419c3dbc59197e03d3862d10841d27624a9c26f755ab4ba9a77ac05578cf8df40c4a775a4de0f06f9fb70f67f9fe77e4d254bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Vb44Uy0.exe

Filesize
1.6MB

MD5
f0f2b1d8ae7a5d7ef3466177f844b8ee

SHA1
2fd508e69614eecf8c19a49dc7ac4d9e456218e2

SHA256
b4cb5f50adb5925ed88e8f48b670ab4f9303de4ba03ad1bded92591f83938a75

SHA512
1de045bd28d630018b145ad5e419c3dbc59197e03d3862d10841d27624a9c26f755ab4ba9a77ac05578cf8df40c4a775a4de0f06f9fb70f67f9fe77e4d254bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe

Filesize
401KB

MD5
e74002b92ab417e259a20bd0e48acbbb

SHA1
4dadcb8893527b772727467fd00ae98ce0bf7478

SHA256
f30547b40c19c734882e6eaf2f973c0aad522743694d8eae881746c9b5f4017a

SHA512
455e528d5f4f612acef714ed2f29d5ec152ffa6c6fad0204f0acc404ff53a013cb2b6899b1a91cd48698f72b8d1554fb432d5d1c9f1f1724d59e6632278b4c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Xe9255.exe

Filesize
401KB

MD5
e74002b92ab417e259a20bd0e48acbbb

SHA1
4dadcb8893527b772727467fd00ae98ce0bf7478

SHA256
f30547b40c19c734882e6eaf2f973c0aad522743694d8eae881746c9b5f4017a

SHA512
455e528d5f4f612acef714ed2f29d5ec152ffa6c6fad0204f0acc404ff53a013cb2b6899b1a91cd48698f72b8d1554fb432d5d1c9f1f1724d59e6632278b4c69

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe

Filesize
2.3MB

MD5
5a4d9c7655774781ac874d28e5f4e8c3

SHA1
a07b8efb4ba7a5325310d67f8ab0bab289c1bcfe

SHA256
6dbdd7e60ed858d48b55cc0ccc5036e0f075fac5ca204711c3e2e96488335af1

SHA512
ff9cdb2b0e881c6edbf1e35d280f5fa308ccc4e58dce8aa095990c721950f8378435c8479fd7707a18eede44baf5c4fed8ee23a6d0c67f170b74812d9b0c732f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k5saljiw.bjs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FL4VF.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FL4VF.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk4DA5.tmp\INetC.dll

Filesize
25KB

MD5
40d7eca32b2f4d29db98715dd45bfac5

SHA1
124df3f617f562e46095776454e1c0c7bb791cc7

SHA256
85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

SHA512
5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
282KB

MD5
2edd463e1e0eb9ee47c8c652292376fd

SHA1
4489c3b20a3a6d2f97838371a53c6d1a25493359

SHA256
d2a392c59f9985f753b9a10f03a7a567f21747ff3a7589722f22748a005953e7

SHA512
d964b77fbb92910909415f5fe7823984752f03d3cda4051da95f8b075ecf4bffa16acc8716f7fe79a017251438f415c41526bfa6245e8e1bab73da4113e99516

Download Submit
C:\Users\Admin\AppData\Local\Temp\tuc3.exe

Filesize
3.3MB

MD5
9d203bb88cfaf2a9dc2cdb04d888b4a2

SHA1
4481b6b9195590eee905f895cce62524f970fd51

SHA256
ba8a003d3491205e5e43c608daa1a51087d43dfe53260eb82227ddfb7448d83b

SHA512
86790d21b2731f36c9e1f80b617e016c37a01b3d8bb74dc73f53387b2c57dfd301f936f9ec6bc8d9750870ffcd7bb3dedb92c41c07eb0b519961e029aff2996d

Download Submit
\??\pipe\LOCAL\crashpad_2780_HXRKVPEWZFDAQYRB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_3284_QHTKAYISOHCSEERR

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_4624_MJLBTMLOYWNQCSDI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/868-2041-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/868-2046-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/1444-2036-0x0000000002BC0000-0x0000000002CC0000-memory.dmp

Filesize
1024KB

Download
memory/1444-2039-0x00000000047D0000-0x00000000047D9000-memory.dmp

Filesize
36KB

Download
memory/1936-30-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1936-36-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1936-29-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1936-28-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/1936-58-0x0000000000400000-0x000000000057C000-memory.dmp

Filesize
1.5MB

Download
memory/2004-1079-0x0000000000970000-0x00000000009AE000-memory.dmp

Filesize
248KB

Download
memory/2004-1081-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/2004-1082-0x0000000007A40000-0x0000000007A50000-memory.dmp

Filesize
64KB

Download
memory/2004-1207-0x00000000084F0000-0x0000000008556000-memory.dmp

Filesize
408KB

Download
memory/2004-1378-0x0000000009B90000-0x0000000009BE0000-memory.dmp

Filesize
320KB

Download
memory/2004-1569-0x0000000009EB0000-0x000000000A072000-memory.dmp

Filesize
1.8MB

Download
memory/2004-1572-0x000000000A5B0000-0x000000000AADC000-memory.dmp

Filesize
5.2MB

Download
memory/2004-1683-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/2064-602-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2064-270-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2064-269-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2344-1880-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/2344-2069-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/3132-599-0x0000000000E60000-0x0000000000E76000-memory.dmp

Filesize
88KB

Download
memory/3132-65-0x0000000002FC0000-0x0000000002FD6000-memory.dmp

Filesize
88KB

Download
memory/3224-2049-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/3224-2055-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/4040-2099-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4040-1919-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4464-1099-0x00000200C91B0000-0x00000200C91C0000-memory.dmp

Filesize
64KB

Download
memory/4464-1122-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-2028-0x00000200C91B0000-0x00000200C91C0000-memory.dmp

Filesize
64KB

Download
memory/4464-2020-0x00007FF9E00B0000-0x00007FF9E0B72000-memory.dmp

Filesize
10.8MB

Download
memory/4464-1126-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1093-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4464-1095-0x00000200C8FF0000-0x00000200C90D4000-memory.dmp

Filesize
912KB

Download
memory/4464-1098-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1124-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1100-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1120-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1102-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1096-0x00007FF9E00B0000-0x00007FF9E0B72000-memory.dmp

Filesize
10.8MB

Download
memory/4464-1104-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1106-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1108-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1110-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1112-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1114-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1116-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/4464-1118-0x00000200C8FF0000-0x00000200C90D0000-memory.dmp

Filesize
896KB

Download
memory/5300-2097-0x0000000000E40000-0x0000000000E7C000-memory.dmp

Filesize
240KB

Download
memory/5312-2067-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/5312-2057-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5312-2064-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/5312-2059-0x0000000000610000-0x000000000063E000-memory.dmp

Filesize
184KB

Download
memory/5588-1973-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/6004-67-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/6004-53-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/6060-62-0x0000000007770000-0x0000000007782000-memory.dmp

Filesize
72KB

Download
memory/6060-1080-0x0000000007760000-0x0000000007770000-memory.dmp

Filesize
64KB

Download
memory/6060-35-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/6060-52-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/6060-54-0x0000000007990000-0x0000000007F36000-memory.dmp

Filesize
5.6MB

Download
memory/6060-55-0x00000000074D0000-0x0000000007562000-memory.dmp

Filesize
584KB

Download
memory/6060-57-0x0000000007760000-0x0000000007770000-memory.dmp

Filesize
64KB

Download
memory/6060-61-0x0000000007880000-0x000000000798A000-memory.dmp

Filesize
1.0MB

Download
memory/6060-63-0x00000000077D0000-0x000000000780C000-memory.dmp

Filesize
240KB

Download
memory/6060-59-0x0000000007670000-0x000000000767A000-memory.dmp

Filesize
40KB

Download
memory/6060-64-0x0000000007810000-0x000000000785C000-memory.dmp

Filesize
304KB

Download
memory/6060-60-0x0000000008560000-0x0000000008B78000-memory.dmp

Filesize
6.1MB

Download
memory/6060-846-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/6100-2066-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/6100-1865-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/6548-1909-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/6548-1790-0x0000000074330000-0x0000000074AE1000-memory.dmp

Filesize
7.7MB

Download
memory/6548-1791-0x0000000000A40000-0x00000000019FE000-memory.dmp

Filesize
15.7MB

Download
memory/6576-2031-0x0000000000400000-0x00000000007D1000-memory.dmp

Filesize
3.8MB

Download
memory/6736-453-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-447-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-415-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-454-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-417-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-418-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-445-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-446-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-448-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/6736-449-0x00000236063C0000-0x00000236063C1000-memory.dmp

Filesize
4KB

Download
memory/7712-1085-0x000001393A3D0000-0x000001393A4B8000-memory.dmp

Filesize
928KB

Download
memory/7712-1092-0x0000013954A60000-0x0000013954AAC000-memory.dmp

Filesize
304KB

Download
memory/7712-1086-0x00007FF9E00B0000-0x00007FF9E0B72000-memory.dmp

Filesize
10.8MB

Download
memory/7712-1088-0x0000013954AD0000-0x0000013954AE0000-memory.dmp

Filesize
64KB

Download
memory/7712-1087-0x0000013954980000-0x0000013954A5E000-memory.dmp

Filesize
888KB

Download
memory/7712-1091-0x0000013954C90000-0x0000013954D58000-memory.dmp

Filesize
800KB

Download
memory/7712-1089-0x0000013954AE0000-0x0000013954BC0000-memory.dmp

Filesize
896KB

Download
memory/7712-1090-0x0000013954BC0000-0x0000013954C88000-memory.dmp

Filesize
800KB

Download
memory/7712-1097-0x00007FF9E00B0000-0x00007FF9E0B72000-memory.dmp

Filesize
10.8MB

Download
memory/7868-2058-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/7868-1847-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/7964-2025-0x0000000000400000-0x00000000006ED000-memory.dmp

Filesize
2.9MB

Download
memory/8112-2052-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download