lokibot | hxxps://bazaar[.]abuse[.]ch/download/0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650/

Analysis

max time kernel
252s
max time network
251s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
02-08-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/download/0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650/

Score

10^/10

lokibot collection credential_access discovery execution spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://161.35.102.56/~nikol/?p=8254674426

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5472	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2720	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
5592	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
5600	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2720 set thread context of 5600	2720	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe	114

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000236b8eb4ede4da01b4daaeaef4e4da01f6769b9d1ae5da0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.zip:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5504	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
1648	msedge.exe
1648	msedge.exe
1296	identity_helper.exe
1296	identity_helper.exe
3860	msedge.exe
3860	msedge.exe
904	msedge.exe
904	msedge.exe
2720	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
2720	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
5472	powershell.exe
5472	powershell.exe
5472	powershell.exe
5532	msedge.exe
5532	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeRestorePrivilege	3796	7zG.exe
Token: 35	3796	7zG.exe
Token: SeSecurityPrivilege	3796	7zG.exe
Token: SeSecurityPrivilege	3796	7zG.exe
Token: SeDebugPrivilege	2720	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeDebugPrivilege	5600	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
Token: SeRestorePrivilege	3720	7zG.exe
Token: 35	3720	7zG.exe
Token: SeSecurityPrivilege	3720	7zG.exe
Token: SeSecurityPrivilege	3720	7zG.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
3796	7zG.exe
3720	7zG.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5532	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2492	1648	msedge.exe	78
PID 1648 wrote to memory of 2492	1648	msedge.exe	78
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 1320	1648	msedge.exe	79
PID 1648 wrote to memory of 4448	1648	msedge.exe	80
PID 1648 wrote to memory of 4448	1648	msedge.exe	80
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81
PID 1648 wrote to memory of 716	1648	msedge.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1287768749-810021449-2672985988-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bazaar.abuse.ch/download/0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd63973cb8,0x7ffd63973cc8,0x7ffd63973cd8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4104 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2332 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,2747357529366399171,17028554908682200220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4900

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15012:190:7zEvent25387
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3796

C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
"C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xAZabUFhB.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5472
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xAZabUFhB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA498.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5504
- C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
  "C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe"
  2⤵
  - Executes dropped EXE
  PID:5592
- C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe
  "C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:5600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4984

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap14768:190:7zEvent9196
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\182c0861-d07c-4f44-8443-7d96268aaa4c.tmp

Filesize
1KB

MD5
26681e7ff750621ae1d2dcb0f3d2c33d

SHA1
7751040aab7df72f5295ace456196e947347914c

SHA256
d69a2e2d8725665dd3df087cf0f24cd911666f045aa89e4337b5e85c188641c5

SHA512
f73aa63662523e88d1a9115992a12cdc67f6ef126dbd8c876b8a8657ee00890fb5f4749ff9906c1320a608615212b7eff42d6affc58368a2bc08d7fbf62efc48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
27KB

MD5
6b5c5bc3ac6e12eaa80c654e675f72df

SHA1
9e7124ce24650bc44dc734b5dc4356a245763845

SHA256
d1d3f1ebec67cc7dc38ae8a3d46a48f76f39755bf7d78eb1d5f20e0608c40b81

SHA512
66bd618ca40261040b17d36e6ad6611d8180984fd7120ccda0dfe26d18b786dbf018a93576ebafe00d3ce86d1476589c7af314d1d608b843e502cb481a561348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
a58d8095f4b91f97d1c3de905f59bcdc

SHA1
0202f9f92bce865c4bbb12be673184e58934c654

SHA256
9e2472aa8e18fba6fe377afa5002144d90c9a47173e29a319524d9d2a5010197

SHA512
abfd172cda4b6e8df9b9e1147f9cc140da79328c0215b29723bb9a2e9f530ee4b8bafe261701597a22807ed0f38aa639f4fc99b3bb6a171a0721503db466fca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
b70f1d416eeca469506db38c870e4e2a

SHA1
7ac4224a9afe8c6cc4835a57dd1268338f2daa98

SHA256
03cc4758b2d507168d5b4922b0f04ed6bfca10826a4ec8fd09041a48ef5ad741

SHA512
dd2750a2712962568ffe43aeb41506fe28a8917554049878d64e00c280b9e93117437490f2534535c28c5ccc60a79db8a3b5f9047d842653c3a75f759a118b09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
740123cf23cd5629f58134e5eb67b64c

SHA1
afca3aaba8249520726a47b256ae38ccdec7fa52

SHA256
6f2045b56c19aa6eae826bef4959d2baf4e9934399092d68c4789362282f0e39

SHA512
7431befcab35c5570f486b827684ed39ea134762ed18d2c86fd6e26231c9b1bb10148280581b3d01b6185d85b02af3886137d81337aefa78be0fd046148a97ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
f11d5d833c40658f25339700ea4df373

SHA1
1e10e4fe76b4f63b6ee8801fac4d78f8ef6a3d13

SHA256
37f73f4d2343d1c723853e2eaa2c23d3a4c3510357fe24239bf227f9cef6430a

SHA512
b2c2578e1049e33753bc1cb4dc75ef5e651ed53aaa9bf80c949bef314909d90ee687d2d4e2b4018c5248e85f11bfcf90b7d20364916e64aa76c600a8041e19fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
91f033bdecf60bdbbf8517b61d70553e

SHA1
24f09eb9cc382aab07ce08a77d45ace53531a960

SHA256
fdf8a0067fa78e289d14e7b4638ca22019e72ff93ef4d73a3552be344c67a941

SHA512
3569bd7eea4f2b30429f9368fd4e6923582affddd6858c9d8f5924949b90e404f6797c6881aaa83ef4b63126987e8267682f7b6a84266c4c2c6e4cb01fc93b15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a15f39b600b30fb58fab2f25588ea267

SHA1
eff0633c483da40046df2e0e0f2551cf88194cd4

SHA256
f4f77e3acba580a48dc6e74bf04da9778712c423d21128748b9e8289ec848235

SHA512
5b89a346c5bdcd233216c4b46e2f1c50d36eb6eb96f6ddb4e97979b3dbdd1cc7ffa588f8ecca13832e8acf378879632fe76d33a3c4637c1f0874a00727fb1eb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
efc94c7ab3d5559a9498e5b06fd9a131

SHA1
f04fe4e5bcef113e1be5f2c68afa53f5bb96ebe6

SHA256
62c59b0702f3d281bbcaa6415f44cfba55b4fbc07eeaf5c2eba1c8d1b286e281

SHA512
4b26d9fc829acd5d9d9aeaec03e894bcc408d3df4e8a45e37f65dc57ae044d0d11b012869ab5d51edcd7179900626bec08a7e057b2e4645158dcaaa21509e1dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b44dd53b1a9b5c2db72338eeffcb7b03

SHA1
7dcea7fd24e0c8a99d93126919b3cd7008b9c49d

SHA256
bf83fa5e991f3df9ada010a0b443008d5512606e1ebd14bfb192fa9d2573ca7d

SHA512
570c20dfde500804d55afa6aa19035804f03b4900e4a16feca7e6fdb60a749df5d2a15641ce8138269d04e2c3c977d2ce933fc9ae897066b54d85d89930e81e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e2f4e8873f8919cb6447838adbe04ddc

SHA1
9481e2e1a993318bc09d4c1c42de28623e0befea

SHA256
36cfcd3235b1e90fbfcd654e3b0aa779234248bf163a52a40e7ff624aa03e411

SHA512
cda7a595c66284f0712f706bbb3754220604fa2255d6b7bca62fb8096a6847d4f480830172f9334229efa04a130ff99cdd1486169719b4f7acaf6be46ce0217e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
677783fa021b50944477ce490b3ec614

SHA1
68d78270b0c02565f794d93176aa854e7b170cd4

SHA256
b967c91996634c13c196d33febf5d92850c6dc1ca1af5c3cdb5d0d6c544bd91c

SHA512
aa66cde7e194859fb106b23d1fe8b0484e93874eb79e666470302662dc33338c6f95311a212f223770b19509be58333b814d8ebb95989ff954ee05eab3ecc8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7d65f4997c61d822ee524029d28f3c57

SHA1
29841a8d86a4a16ff3a966cb8591c8b883409eef

SHA256
76b7be24b9f7c4aa743a4b800c00757fdeab413c59fd18b32c43a4fcc2d4d223

SHA512
5b84c8291ccc00dd155bd1e0ad6d37004864c593e9692b8bf2d5154dfcb467647cc38b8b4fedac9133dbe4eec2691d513ade9f83468816da187abcc2143f71a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c2a10fd9d3a294e8c5c5eb30069f3d4a

SHA1
f86b1ada0bee316698c0839db523e8d957e7600a

SHA256
4f14e183d7bfdf71ececcf6edf95fe0847364743ea07809749fa3b4f7450699f

SHA512
86adb45ab1223d4efd1824b2db6dc77cb8f49acb6caf9d83626a1428c786cb29d361fbef0c4576858412577bc40de2b0d16ff568f8255c7dba8dc8b184a5ee13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
de50b6bd01bc2c0e85b235cef83c7b70

SHA1
0895c1fa0c53b0545c705159feef58d629aa4aeb

SHA256
9a62233111ae191264793e71b3e8ab8bec0da9bc2369b2698b84d3fea01c2a82

SHA512
f17d9cedf7e9696324970f7d36f0bb9dbd7c2823b2edf2504f053d8f1449d19313ad0f7ce9d676c006ba71a6112b8169c8d09dedbfcb996b4c644fe087d6449a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fedd.TMP

Filesize
48B

MD5
daba7fe98d25b255d7c09c27b448743e

SHA1
295cc722107fb70d5503d3f2f9b6a36ffe1ef0ca

SHA256
5742cf4e05c07a386c5aa938b2d329834770b5538cf99b9a4aca11979b78e4e0

SHA512
6b3cd8102feed362ac2ff3e6d66ca87609ae407ed1afe9c2295ab0f112fe79e0d75a45c3f38c2d549637dd0a99e77dd781ab6dfff76e50effed1981b25a6945d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
368B

MD5
2605bc777563ad42f260b5a73716ad53

SHA1
504ac6eced97046d10ffd5291d3cca2cef9444d3

SHA256
4c7514256a020db55433d841daa9e46abc68f537c949d0817a182326b2161bd6

SHA512
76153461f7e4305039b5fdcdad08a8539fc410972a5cb93031fad80255c414828a7110ac876c87d5c1b53fb7551909ffd9e81f135ef209b491d5a3b19417328a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
e969c62d80ec3e7b7db9bda7c58a5b4f

SHA1
639a72ccf14394baf31838cad15a186bdc02f471

SHA256
090c00b9f66d4c641b0dd7a59950ce4155f21ab992b51430e67cb9fa32bb86ef

SHA512
85bc370ec0516261b646ca3b7f34d8c4c50929594bf1d67f7fe93a4d81186cc2b24eb72c7de8fb9c6a4b38c619b1daa3cbdeb97d622db83064271eedbbb08196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f136.TMP

Filesize
368B

MD5
f85e03087c92129701e97aa1f3e7440b

SHA1
1d2e8a51a58d321e84c4805884cd876929ca7809

SHA256
1a2b8968d1336d4c6b221bec206d958e0226c8aae2da0894d59e73998e42e3e5

SHA512
90e2e76c2222e552666fc9965014f83c3a07c6556c3095e44af19e311068ef51086d8112aebdc99ae826679cd390e62d27a61d00f3836e53b90c7338afcb0f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7f5ab1f2d2c0d0c375da6d0babf9b504

SHA1
c7ac92d5e7c93bf7846d262b504bb2f48f33ea39

SHA256
094143ecd0a862f3e4a14c276ab7303519bdab6880ab3b9e248ad7ef71337e63

SHA512
1fe1075eb4be2ea894446ba119145747feaf9fd79bff0b73d2e70a2451187fc6270727c8848997be103e8b1901e01c630153b10a1981f48dcbb8bc30656c4da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5106ac8ac6b0252efe95fa107178500b

SHA1
06a44a211e30027d39d0b1045849c02d6e0d9636

SHA256
4e366a3dd9103588883dd075f66d53923481e0048f3e375630689e1759e29d4c

SHA512
19e30b6c4bd7ec2e84cf4b20a0b3da935e949720ee3e2901b89bca32fed6e36f27b61a0e47f74845aff8deca22606592c39d71263a58f24836798e356d0de9c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a8ef11536e834badbd024d96a0826334

SHA1
46bf616a1cf75c696821557a0a647e84ad390faa

SHA256
8d040d98a86f678bdbe529ad3ed89fa85552d087950cb8ecec98636a99d57b5a

SHA512
a1a2eb63d4e0e42044ac36dade5fe7f97e55fb5057dffc9478fb3e12123da0347bfeb4d18172f21e46dad8942b3870806f9cfb47203c3094f572b562301696dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fe7f6c99bc9b46ccac46e3e0017334e0

SHA1
88ea2c7155af78db725b856c1a0355058225b804

SHA256
60c33c4736c7a9f572ebcc1ea0db0f3dfec77c62936b0364e77c592bea521a57

SHA512
9e0b54a68128e06d0fde44fe8b623f0c3928f739d228774163cffae6779a109f4fc9dbde49020c7656004bed960320e40672d9bc8997aca214ff7f4f057dfe5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ysaysyl.bed.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA498.tmp

Filesize
1KB

MD5
c83226607084c6a3889b6a4131dd65d1

SHA1
ce3530aa75de56d93698c59224591b9232e937cc

SHA256
474da7956dee9c6c0b4702db7a3f21b5b697ec1cf10b5ff06c131fbb5f68235c

SHA512
3c9ecfc2960dd13d71b05a7f5fb108f6803bb3a87f08dbb1a205277936097e30c4d55c91ae6512a36d27619b9fbab50b5f7ac5aae8e2e4fbb21ff741ce3d9966

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1287768749-810021449-2672985988-1000\0f5007522459c86e95ffcc62f32308f1_ecb443ad-7c99-4a47-9f82-4d321990d32e

Filesize
46B

MD5
d898504a722bff1524134c6ab6a5eaa5

SHA1
e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

SHA256
878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

SHA512
26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1287768749-810021449-2672985988-1000\0f5007522459c86e95ffcc62f32308f1_ecb443ad-7c99-4a47-9f82-4d321990d32e

Filesize
46B

MD5
c07225d4e7d01d31042965f048728a0a

SHA1
69d70b340fd9f44c89adb9a2278df84faa9906b7

SHA256
8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

SHA512
23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Download Submit
C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.exe

Filesize
480KB

MD5
6290e8c6864aba9ef50803c9438c3276

SHA1
078739cb7a123491a2d32704af94a06a203a0bea

SHA256
0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650

SHA512
c2c8a3bb4882bbe683642123128c604a1a68344c4579f2c99b830c043edc1cec946bbb6972c0f5b81b05bd682601f1730a8333f281f7907fb362e831f0f1fc41

Download Submit
C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.zip

Filesize
457KB

MD5
b44cf9e85efbd4522bd69aa8d73d4d07

SHA1
b8a247ff7de7c71d0258278968d973901abb6712

SHA256
015c7cf52de35a73b07a40146a59b5b14800a0767ea371c406ac4dee48a93c4b

SHA512
554d361c73a052175edc5ff086bdb369d8bf28b9ee9f10caf5e3519254664a21881ba27ad4d2dbaf7452baa9611ed3c45bfd9b008afb740915fdf01a1e2725d5

Download Submit
C:\Users\Admin\Downloads\0a9a1a3c031e0eb6c938510830144f26f88effe94230b1467e09123393b99650.zip:Zone.Identifier

Filesize
202B

MD5
1a623f6829afccf632a1ab12e8640be8

SHA1
4a030dad9b9925ccd67b6bf4a3308a202bafd7fb

SHA256
2e1fa67ce4a575b3c75184b98c807f5f7d77ab206018aa6cbcbbd9b764d021e9

SHA512
4028b93f6dc7e0ed856dd4345c6c819d04806abd056482da2a2a524eb90e12c890eb53f0bd9adda8679f88857f41b21a9da995f7a867fcc6ab87af23f35c014b

Download Submit
memory/2720-157-0x0000000000BA0000-0x0000000000C1E000-memory.dmp

Filesize
504KB

Download
memory/2720-158-0x0000000005C40000-0x00000000061E6000-memory.dmp

Filesize
5.6MB

Download
memory/2720-220-0x0000000007150000-0x00000000071AA000-memory.dmp

Filesize
360KB

Download
memory/2720-166-0x0000000005950000-0x000000000595A000-memory.dmp

Filesize
40KB

Download
memory/2720-219-0x0000000007110000-0x000000000711A000-memory.dmp

Filesize
40KB

Download
memory/2720-218-0x0000000007100000-0x0000000007108000-memory.dmp

Filesize
32KB

Download
memory/2720-159-0x0000000005730000-0x00000000057C2000-memory.dmp

Filesize
584KB

Download
memory/2720-160-0x00000000061F0000-0x0000000006547000-memory.dmp

Filesize
3.3MB

Download
memory/2720-168-0x0000000006C60000-0x0000000006C72000-memory.dmp

Filesize
72KB

Download
memory/2720-167-0x0000000005A30000-0x0000000005ACC000-memory.dmp

Filesize
624KB

Download
memory/5472-238-0x00000000050A0000-0x00000000050C2000-memory.dmp

Filesize
136KB

Download
memory/5472-296-0x0000000006250000-0x000000000626E000-memory.dmp

Filesize
120KB

Download
memory/5472-318-0x0000000007270000-0x0000000007281000-memory.dmp

Filesize
68KB

Download
memory/5472-335-0x00000000072A0000-0x00000000072AE000-memory.dmp

Filesize
56KB

Download
memory/5472-336-0x00000000072B0000-0x00000000072C5000-memory.dmp

Filesize
84KB

Download
memory/5472-339-0x00000000073B0000-0x00000000073CA000-memory.dmp

Filesize
104KB

Download
memory/5472-340-0x00000000073A0000-0x00000000073A8000-memory.dmp

Filesize
32KB

Download
memory/5472-307-0x00000000070E0000-0x00000000070EA000-memory.dmp

Filesize
40KB

Download
memory/5472-304-0x0000000006FE0000-0x0000000006FFA000-memory.dmp

Filesize
104KB

Download
memory/5472-301-0x0000000007620000-0x0000000007C9A000-memory.dmp

Filesize
6.5MB

Download
memory/5472-297-0x0000000006ED0000-0x0000000006F74000-memory.dmp

Filesize
656KB

Download
memory/5472-317-0x00000000072F0000-0x0000000007386000-memory.dmp

Filesize
600KB

Download
memory/5472-287-0x0000000072390000-0x00000000723DC000-memory.dmp

Filesize
304KB

Download
memory/5472-286-0x0000000006270000-0x00000000062A4000-memory.dmp

Filesize
208KB

Download
memory/5472-246-0x0000000005D50000-0x0000000005D9C000-memory.dmp

Filesize
304KB

Download
memory/5472-245-0x0000000005D20000-0x0000000005D3E000-memory.dmp

Filesize
120KB

Download
memory/5472-244-0x00000000059C0000-0x0000000005D17000-memory.dmp

Filesize
3.3MB

Download
memory/5472-242-0x0000000005780000-0x00000000057E6000-memory.dmp

Filesize
408KB

Download
memory/5472-243-0x0000000005950000-0x00000000059B6000-memory.dmp

Filesize
408KB

Download
memory/5472-225-0x0000000002500000-0x0000000002536000-memory.dmp

Filesize
216KB

Download
memory/5472-231-0x00000000050E0000-0x000000000570A000-memory.dmp

Filesize
6.2MB

Download
memory/5600-230-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/5600-228-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download