Analysis Overview
SHA256
4a157f54e3aae591837b2d7284a4deb8a4976a70a3859512c15c8a48310348d3
Threat Level: Known bad
The file 2a26158906c00b20907085703909a035 was found to be: Known bad.
Malicious Activity Summary
UAC bypass
Detected Djvu ransomware
RedLine
Glupteba payload
SmokeLoader
Glupteba
Windows security bypass
Vidar
Djvu Ransomware
Modifies Windows Firewall
Downloads MZ/PE file
Modifies file permissions
Executes dropped EXE
Loads dropped DLL
Windows security modification
Checks computer location settings
Reads user/profile data of web browsers
Deletes itself
Checks whether UAC is enabled
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Manipulates WinMonFS driver.
Looks up external IP address via web service
Adds Run key to start application
Suspicious use of SetThreadContext
Drops file in System32 directory
Detected potential entity reuse from brand microsoft.
Drops file in Windows directory
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Program Files directory
Program crash
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
Enumerates system info in registry
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Creates scheduled task(s)
Checks SCSI registry key(s)
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies system certificate store
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Uses Task Scheduler COM API
Runs net.exe
Modifies data under HKEY_USERS
System policy modification
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-09-27 14:03
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-09-27 14:03
Reported
2023-09-27 14:06
Platform
win7-20230831-en
Max time kernel
33s
Max time network
154s
Command Line
Signatures
Detected Djvu ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Djvu Ransomware
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
RedLine
SmokeLoader
Vidar
Downloads MZ/PE file
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\F0C7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\F2CB.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\19ae9828-6645-4727-b1f1-2dcdd9fe55ac\\EA8E.exe\" --AutoStart" | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2660 set thread context of 2696 | N/A | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | C:\Users\Admin\AppData\Local\Temp\EA8E.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\1B24.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\EA8E.exe | N/A |
Runs net.exe
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe
"C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe"
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\EE27.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\EE27.dll
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
C:\Users\Admin\AppData\Local\Temp\F2CB.exe
C:\Users\Admin\AppData\Local\Temp\F2CB.exe
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\19ae9828-6645-4727-b1f1-2dcdd9fe55ac" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Users\Admin\AppData\Local\Temp\BF6.exe
C:\Users\Admin\AppData\Local\Temp\BF6.exe
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
C:\Users\Admin\AppData\Local\Temp\1B24.exe
C:\Users\Admin\AppData\Local\Temp\1B24.exe
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
"C:\Users\Admin\AppData\Local\Temp\EA8E.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
"C:\Users\Admin\AppData\Local\Temp\F0C7.exe" --Admin IsNotAutoStart IsNotTask
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
"C:\Users\Admin\AppData\Local\Temp\EA8E.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 128
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\F2CB.exe" -Force
C:\Users\Admin\AppData\Local\Temp\kos1.exe
"C:\Users\Admin\AppData\Local\Temp\kos1.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe"
C:\Users\Admin\AppData\Local\Temp\set16.exe
"C:\Users\Admin\AppData\Local\Temp\set16.exe"
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build3.exe
"C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build3.exe"
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe
"C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
"C:\Users\Admin\AppData\Local\Temp\F0C7.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe
"C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe"
C:\Users\Admin\AppData\Local\Temp\kos.exe
"C:\Users\Admin\AppData\Local\Temp\kos.exe"
C:\Users\Admin\AppData\Local\Temp\is-4C2LS.tmp\is-IU670.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4C2LS.tmp\is-IU670.tmp" /SL4 $301C8 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ServiceModelReg.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 8
C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -i
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 8
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
C:\Users\Admin\AppData\Local\b0344383-1f89-4146-958b-be1fb7e8e0d6\build2.exe
"C:\Users\Admin\AppData\Local\b0344383-1f89-4146-958b-be1fb7e8e0d6\build2.exe"
C:\Users\Admin\AppData\Local\b0344383-1f89-4146-958b-be1fb7e8e0d6\build2.exe
"C:\Users\Admin\AppData\Local\b0344383-1f89-4146-958b-be1fb7e8e0d6\build2.exe"
C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -s
C:\Users\Admin\AppData\Local\b0344383-1f89-4146-958b-be1fb7e8e0d6\build3.exe
"C:\Users\Admin\AppData\Local\b0344383-1f89-4146-958b-be1fb7e8e0d6\build3.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Windows\system32\taskeng.exe
taskeng.exe {ED3BA545-736E-4478-92B7-6FEEDD62955C} S-1-5-21-3185155662-718608226-894467740-1000:YETUIZPU\Admin:Interactive:[1]
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | potunulit.org | udp |
| US | 188.114.96.0:80 | potunulit.org | tcp |
| BG | 193.42.32.101:80 | 193.42.32.101 | tcp |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| RU | 79.137.192.18:80 | 79.137.192.18 | tcp |
| US | 8.8.8.8:53 | alayyadcare.com | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| PS | 213.6.54.58:443 | alayyadcare.com | tcp |
| PS | 213.6.54.58:443 | alayyadcare.com | tcp |
| US | 8.8.8.8:53 | z.nnnaajjjgc.com | udp |
| MU | 156.236.72.121:443 | z.nnnaajjjgc.com | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | apps.identrust.com | udp |
| NL | 88.221.25.169:80 | apps.identrust.com | tcp |
| US | 8.8.8.8:53 | colisumy.com | udp |
| AR | 190.139.250.133:80 | colisumy.com | tcp |
| US | 8.8.8.8:53 | zexeq.com | udp |
| KR | 175.120.254.9:80 | zexeq.com | tcp |
| KR | 175.120.254.9:80 | zexeq.com | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| MU | 156.236.72.121:443 | z.nnnaajjjgc.com | tcp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| NL | 194.169.175.127:80 | host-host-file8.com | tcp |
| AR | 190.139.250.133:80 | colisumy.com | tcp |
| US | 8.8.8.8:53 | t.me | udp |
| NL | 149.154.167.99:443 | t.me | tcp |
| NL | 149.154.167.99:443 | t.me | tcp |
| NL | 149.154.167.99:443 | t.me | tcp |
| NL | 149.154.167.99:443 | t.me | tcp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| JP | 23.207.106.113:443 | steamcommunity.com | tcp |
| KR | 175.120.254.9:80 | zexeq.com | tcp |
| US | 8.8.8.8:53 | learn.microsoft.com | udp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| PL | 146.59.10.173:45035 | tcp | |
| US | 8.8.8.8:53 | app.nnnaajjjgc.com | udp |
| HK | 154.221.26.108:80 | app.nnnaajjjgc.com | tcp |
| DE | 195.201.252.32:80 | 195.201.252.32 | tcp |
| US | 8.8.8.8:53 | iplogger.com | udp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
Files
memory/2548-0-0x0000000000220000-0x0000000000235000-memory.dmp
memory/2548-1-0x0000000000240000-0x0000000000249000-memory.dmp
memory/2548-2-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2548-5-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2548-7-0x0000000000240000-0x0000000000249000-memory.dmp
memory/1348-3-0x00000000026C0000-0x00000000026D6000-memory.dmp
memory/2548-8-0x0000000000220000-0x0000000000235000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/2660-18-0x0000000000220000-0x00000000002B2000-memory.dmp
memory/2660-19-0x0000000000220000-0x00000000002B2000-memory.dmp
memory/2696-25-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2660-20-0x0000000003E70000-0x0000000003F8B000-memory.dmp
memory/2696-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/2660-26-0x0000000000220000-0x00000000002B2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
C:\Users\Admin\AppData\Local\Temp\EE27.dll
| MD5 | 1ab6c1d7f480fa84080c5ea04328841c |
| SHA1 | 4e98a73776cdb17fcbef5d3c24c2c809443317e0 |
| SHA256 | 71998d732d2df7220d044181117be67b53bc1566d66dcf4a4ace737112915a1f |
| SHA512 | 34766634f8bdb7ea1e2bd64db0719697b1550b854d059f84e0b97ac30cbc8a76b50537459d8845087d5cbcd4f55c2cc344a904b6239630587e204e8a9b7b8fb2 |
memory/2696-31-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2696-32-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
\Users\Admin\AppData\Local\Temp\EE27.dll
| MD5 | 1ab6c1d7f480fa84080c5ea04328841c |
| SHA1 | 4e98a73776cdb17fcbef5d3c24c2c809443317e0 |
| SHA256 | 71998d732d2df7220d044181117be67b53bc1566d66dcf4a4ace737112915a1f |
| SHA512 | 34766634f8bdb7ea1e2bd64db0719697b1550b854d059f84e0b97ac30cbc8a76b50537459d8845087d5cbcd4f55c2cc344a904b6239630587e204e8a9b7b8fb2 |
C:\Users\Admin\AppData\Local\Temp\F2CB.exe
| MD5 | f62db17095733535b6cfd2d07d7fd994 |
| SHA1 | cb75466f4814f879f640e95fa8b88b4c6e8dd0c5 |
| SHA256 | 9fe3bfd40d042b7a7e2d46578d5f889a90d0b0a36c233063f59fbdbb1fc5570c |
| SHA512 | 76f8889cfb56d70d8d3605b50d186e90e16ba53ad1de283e95c1d0d9e6f158d0c267d9377fe2a7498bbaec3ca030347bead67299c5ee9aa9faf531f5db0d2516 |
C:\Users\Admin\AppData\Local\Temp\F2CB.exe
| MD5 | f62db17095733535b6cfd2d07d7fd994 |
| SHA1 | cb75466f4814f879f640e95fa8b88b4c6e8dd0c5 |
| SHA256 | 9fe3bfd40d042b7a7e2d46578d5f889a90d0b0a36c233063f59fbdbb1fc5570c |
| SHA512 | 76f8889cfb56d70d8d3605b50d186e90e16ba53ad1de283e95c1d0d9e6f158d0c267d9377fe2a7498bbaec3ca030347bead67299c5ee9aa9faf531f5db0d2516 |
memory/2500-52-0x0000000010000000-0x00000000102A9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CabFAD5.tmp
| MD5 | f3441b8572aae8801c04f3060b550443 |
| SHA1 | 4ef0a35436125d6821831ef36c28ffaf196cda15 |
| SHA256 | 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf |
| SHA512 | 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9 |
memory/2352-63-0x00000000000B0000-0x0000000000130000-memory.dmp
memory/2352-67-0x0000000073630000-0x0000000073D1E000-memory.dmp
memory/2500-68-0x0000000000190000-0x0000000000196000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\TarFF89.tmp
| MD5 | 9441737383d21192400eca82fda910ec |
| SHA1 | 725e0d606a4fc9ba44aa8ffde65bed15e65367e4 |
| SHA256 | bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5 |
| SHA512 | 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf |
C:\Users\Admin\AppData\Local\Temp\BF6.exe
| MD5 | 46ec3f1333f627b301fa9c871343bc9a |
| SHA1 | 59483a7dd5c33a5a14c4da9441230f7810cd4329 |
| SHA256 | 9b9cbe098bcd6261d2ec404c6da54c7977f7d9919b3daac26c72fa30fa8aafe6 |
| SHA512 | b64ba101fb60943980826d3b4597fdada8670beb2a927d0a022901c09be1833cfa83b990a67bbada136108146b301436bd6ebdf90b0d36a5c01978ca95413e1d |
C:\Users\Admin\AppData\Local\Temp\BF6.exe
| MD5 | 46ec3f1333f627b301fa9c871343bc9a |
| SHA1 | 59483a7dd5c33a5a14c4da9441230f7810cd4329 |
| SHA256 | 9b9cbe098bcd6261d2ec404c6da54c7977f7d9919b3daac26c72fa30fa8aafe6 |
| SHA512 | b64ba101fb60943980826d3b4597fdada8670beb2a927d0a022901c09be1833cfa83b990a67bbada136108146b301436bd6ebdf90b0d36a5c01978ca95413e1d |
memory/2724-88-0x0000000073630000-0x0000000073D1E000-memory.dmp
memory/2724-89-0x00000000008E0000-0x0000000000F74000-memory.dmp
memory/1072-90-0x0000000000350000-0x00000000003E2000-memory.dmp
memory/1072-91-0x0000000001E60000-0x0000000001F7B000-memory.dmp
\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/2020-94-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/2020-96-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/2020-99-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2696-100-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2020-101-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\19ae9828-6645-4727-b1f1-2dcdd9fe55ac\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 09d2bae3b05f4c92b25a8c6225df6483 |
| SHA1 | ff084d8a1f43903b95bf9144b3719126a3d40cc8 |
| SHA256 | a282e51236ad1fb5eb73b2d8d8cb022213cda792705d8f595b504e2b6d2e00c5 |
| SHA512 | 2151cb657a649acbc7009b20a0101f4d196a2c3cf4793885f95e8b865fb6da424a17fa139b97e312e2157a559beb5be63c824841c871114fec949d810c92bd2c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ebd0b1cddd1f5d7ac247bb383bf88f7b |
| SHA1 | 740e41379692de2270610103893b759028461b59 |
| SHA256 | 974574441cfb362e0570a2c7a8aab46dfdbce149fa993eb8d7ed5dcbceca6c26 |
| SHA512 | 4d6d726ca54a48bfed411d235c6843890b101ef13ba0e473d339304d22fba5981fd843fcdc14c01950624335164664068c5915d25987e7cb2efe0d8f2eed3451 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 5d9d2ef175d167a4e7e26ba684444ce2 |
| SHA1 | 67a6a97cb700b65751a05518775f67a4de2266d1 |
| SHA256 | ff32c95489e039c767f75ca657cca88340b66ef293c51365104eb23ccdc7cbbc |
| SHA512 | a13a3d9016285d5adee2fdba7d4282fa6cee1cf3fb2dff803176432b5d7daabc656db04c67eb6fb3625e959b3f106ddefbc9e39278b48b4080a3708d2c475510 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | c0419d05ad443966df72dd199ad71dd8 |
| SHA1 | 0ba0b1ddfbd9e45879342dba9191efbc478edf05 |
| SHA256 | 49e4e0f0690e9d8e830bd520e4cd37e616a530274c6b9ce978f11c122c19696b |
| SHA512 | e63bd124dd8d1b8993b42507a81e39c74edabfc5798cef0869638f3c2ee95a4646aab829d0d974e7912d7fa127f1098d98b92d31b4b01e1d4b4ddfd8e6e84c91 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 94e27f69dbb00e1b698890c69a3fdf1c |
| SHA1 | 26569129c19d3659cff7660c5618d4ce77a91102 |
| SHA256 | 167496c293945651535fb682cf8e59752b8a59d29a41d09400c8d99246b0e79f |
| SHA512 | 83b2481ecfc5e79998790dc9b6843d2b69401c518629e0c0eb287ccd039869e6b48de6f0d9e1d334c5777ccd7a921605e0a1d3e31cf15f356ad20039218410c3 |
memory/2352-116-0x0000000073630000-0x0000000073D1E000-memory.dmp
memory/1348-117-0x000007FEF5CC0000-0x000007FEF5E03000-memory.dmp
memory/1348-118-0x000007FF4C5E0000-0x000007FF4C5EA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1B24.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
C:\Users\Admin\AppData\Local\Temp\1B24.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/2352-126-0x0000000004F30000-0x0000000004F70000-memory.dmp
\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/2696-129-0x0000000000400000-0x0000000000537000-memory.dmp
memory/584-132-0x0000000000290000-0x0000000000322000-memory.dmp
\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/584-141-0x0000000000290000-0x0000000000322000-memory.dmp
memory/2020-136-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/396-143-0x0000000000400000-0x0000000000430000-memory.dmp
memory/396-144-0x0000000000400000-0x0000000000430000-memory.dmp
memory/396-145-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2724-135-0x0000000073630000-0x0000000073D1E000-memory.dmp
memory/396-147-0x0000000000400000-0x0000000000430000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
memory/396-163-0x0000000000400000-0x0000000000430000-memory.dmp
\Users\Admin\AppData\Local\Temp\1B24.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
memory/2020-169-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2140-171-0x0000000000400000-0x0000000000537000-memory.dmp
\Users\Admin\AppData\Local\Temp\1B24.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
\Users\Admin\AppData\Local\Temp\1B24.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
memory/396-173-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2352-172-0x0000000000720000-0x0000000000780000-memory.dmp
memory/1932-165-0x00000000FFED0000-0x00000000FFF72000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
memory/2140-162-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
memory/396-183-0x0000000073630000-0x0000000073D1E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EA8E.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/396-152-0x0000000000400000-0x0000000000430000-memory.dmp
memory/396-151-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2500-185-0x00000000023B0000-0x00000000024AE000-memory.dmp
memory/396-184-0x00000000003F0000-0x00000000003F6000-memory.dmp
memory/2352-187-0x0000000000620000-0x000000000063A000-memory.dmp
memory/2440-188-0x0000000002630000-0x0000000002730000-memory.dmp
memory/2440-189-0x0000000000220000-0x0000000000229000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
memory/2232-194-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2500-196-0x00000000024B0000-0x0000000002594000-memory.dmp
memory/2352-198-0x0000000004F30000-0x0000000004F70000-memory.dmp
memory/2232-201-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2500-204-0x00000000024B0000-0x0000000002594000-memory.dmp
memory/2232-203-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
memory/2500-212-0x00000000024B0000-0x0000000002594000-memory.dmp
memory/2068-221-0x0000000004490000-0x0000000004888000-memory.dmp
memory/2068-223-0x0000000004490000-0x0000000004888000-memory.dmp
\Users\Admin\AppData\Local\Temp\kos1.exe
| MD5 | 85b698363e74ba3c08fc16297ddc284e |
| SHA1 | 171cfea4a82a7365b241f16aebdb2aad29f4f7c0 |
| SHA256 | 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe |
| SHA512 | 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796 |
C:\Users\Admin\AppData\Local\Temp\kos1.exe
| MD5 | 85b698363e74ba3c08fc16297ddc284e |
| SHA1 | 171cfea4a82a7365b241f16aebdb2aad29f4f7c0 |
| SHA256 | 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe |
| SHA512 | 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796 |
memory/2068-228-0x0000000004890000-0x000000000517B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\kos1.exe
| MD5 | 85b698363e74ba3c08fc16297ddc284e |
| SHA1 | 171cfea4a82a7365b241f16aebdb2aad29f4f7c0 |
| SHA256 | 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe |
| SHA512 | 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796 |
memory/2584-230-0x0000000000390000-0x0000000000504000-memory.dmp
memory/2140-232-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/1348-277-0x0000000003930000-0x0000000003946000-memory.dmp
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe
| MD5 | dcd1bd0f92fe24bf269f0e3ace8de280 |
| SHA1 | 73c06bb4010b87a83e07bcaf3d181e68d24da11f |
| SHA256 | fc0757507960b91ab61afe79de7e316fabde48f983a8a497a709c19c99012456 |
| SHA512 | 2846a18a6687b26a4ec7267b16f139a10c1ace288f5bc893a5e600f07dc9714517f2610f33518afda41707a31a68cf0cbcd4b838568bba6f1833edc7300d6ceb |
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/2232-279-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2140-248-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe
| MD5 | dcd1bd0f92fe24bf269f0e3ace8de280 |
| SHA1 | 73c06bb4010b87a83e07bcaf3d181e68d24da11f |
| SHA256 | fc0757507960b91ab61afe79de7e316fabde48f983a8a497a709c19c99012456 |
| SHA512 | 2846a18a6687b26a4ec7267b16f139a10c1ace288f5bc893a5e600f07dc9714517f2610f33518afda41707a31a68cf0cbcd4b838568bba6f1833edc7300d6ceb |
\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe
| MD5 | dcd1bd0f92fe24bf269f0e3ace8de280 |
| SHA1 | 73c06bb4010b87a83e07bcaf3d181e68d24da11f |
| SHA256 | fc0757507960b91ab61afe79de7e316fabde48f983a8a497a709c19c99012456 |
| SHA512 | 2846a18a6687b26a4ec7267b16f139a10c1ace288f5bc893a5e600f07dc9714517f2610f33518afda41707a31a68cf0cbcd4b838568bba6f1833edc7300d6ceb |
\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
memory/2516-241-0x0000000000400000-0x0000000000408000-memory.dmp
\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build2.exe
| MD5 | dcd1bd0f92fe24bf269f0e3ace8de280 |
| SHA1 | 73c06bb4010b87a83e07bcaf3d181e68d24da11f |
| SHA256 | fc0757507960b91ab61afe79de7e316fabde48f983a8a497a709c19c99012456 |
| SHA512 | 2846a18a6687b26a4ec7267b16f139a10c1ace288f5bc893a5e600f07dc9714517f2610f33518afda41707a31a68cf0cbcd4b838568bba6f1833edc7300d6ceb |
memory/2516-284-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2140-259-0x0000000000400000-0x0000000000537000-memory.dmp
\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/2516-290-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2584-233-0x0000000073630000-0x0000000073D1E000-memory.dmp
\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
C:\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
C:\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
\Users\Admin\AppData\Local\Temp\1B24.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
memory/2724-344-0x0000000073630000-0x0000000073D1E000-memory.dmp
C:\Users\Admin\AppData\Local\a360c0ea-d6e9-4a06-a4ba-edcd7518ea80\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/2352-348-0x0000000073630000-0x0000000073D1E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
\Users\Admin\AppData\Local\Temp\F0C7.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/1636-404-0x00000000027A2000-0x00000000027D1000-memory.dmp
memory/2584-405-0x0000000073630000-0x0000000073D1E000-memory.dmp
memory/1664-412-0x0000000000C50000-0x0000000000C58000-memory.dmp
memory/1124-437-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2532-500-0x00000000027B2000-0x00000000027E1000-memory.dmp
memory/2532-501-0x0000000000230000-0x0000000000281000-memory.dmp
memory/2088-530-0x0000000000400000-0x00000000005F1000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | b41866880ff5c0a91432a2572a23ebb2 |
| SHA1 | 57a70a569b1e769ed084d83eccee9ce6c55d0497 |
| SHA256 | e5e05110965c5659654a0c317c0ceff31d714f7c2a2cdc004951a2771547b586 |
| SHA512 | eacfa5c81631d4affa4c8319cce4bd988b2b161761aace08a466148bc0fd1d196c429a867b9a3f9785a2c1ee639f9ea29bbbb45c44762219a939d61b1b93f73a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d0b49dafd9cf98a4e1c86e499fbc9ff8 |
| SHA1 | d71b1e5f6570cd6160538d8d3902e6d87303250b |
| SHA256 | d32eeecee9c7578ac7c1aca92530c77927d07e9f12d5dfd02b9e3dbc97aa639e |
| SHA512 | b9e4b226dd6d9b53d18a090d1689a578dea575e2517bc0c1a8fdae8a50447d96ae91023d5ecd92ea1353b3cc73bf2a628daefbe16c0712cd0dea02235d42591d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ce4568ca1ca493c3c6f4f99a7559f59a |
| SHA1 | 39375a8aa2dbdf1a26610e0e5fb32c85442fc11d |
| SHA256 | c3f0c00e27ecf5416efc23ba2ff7d9f5dd3ee43a6107605afadeb992b0d18884 |
| SHA512 | 6d8e811f06269dca131c3e838827f99c2c35a1bb2e62cc8803b406cf2e9b5ba407eb333615968a3b9a46702a8c2f0f951f98d7b4d36bc9af75500e1d06026e97 |
memory/1760-685-0x000000006AF90000-0x000000006B53B000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c7621c2ec4737ab2d597a06f85534caa |
| SHA1 | ab5f9b67ec71be5486496b7957934ae596f4a714 |
| SHA256 | c2f59e855f282242cee63b7a606d73dcf337a38b3c8da9f2dfe6abbdc0d5bf22 |
| SHA512 | 6325fa1931e06cc6fa3f495a2bb644f944198f093459bda44c5757a8b7f6c05777ef21f628e5572c7fabe049c66fd905738cff202891e47072993411315bc0a9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0791f174d557a70041204c41cdec1a9d |
| SHA1 | a4772dc19f7fa8ca0aa6c3c256c6facfd312b0c6 |
| SHA256 | 47f54deec3804257252f76a1cfeaa49cfe441cdbcc67aa5a9e822f8d0139f490 |
| SHA512 | f5b201627e0c364e1e0fb5ffcbe2795445c273b2bf8008f91bd8b8f89200b146b985a129cc1dde01ce7001298991805e2577518a459f8bb32f99924bd83b9c9c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 59ebc691ca681e19a1c6f5e47b835f35 |
| SHA1 | f3822a5e83a82ea098a5d43715274faf99b6f93a |
| SHA256 | 7ad56778160f1dd46dcad8396ca3a8654f35c172460ebef706d6dca8649b7636 |
| SHA512 | adbe2a900ae102e26d90d5fc5e48530503f900ffe2466d08ad8c1aaa81a1e21b6824fbde32947c9a7e4bd34c4b60d5e0ae3681fc1126b8cba74edb2a97a7e65c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 85b4a0586b365637f11eb2c69f3a366a |
| SHA1 | fb9607230d1c77b99f5292fa424a0bb81797c855 |
| SHA256 | 3793eec10b8bc860efa2294d525e7bed6084ea4fd30bbf2436ed7f6ad1dc66d8 |
| SHA512 | 30dd6b777eaec0fdc012a3eb0b88237e2e09d7fb9ae7c99d2363f67a8f9aad936e0c1c330bba4b5497f1bcbbc3ed930709dcd6885c6f4692085f4ba2ad6126aa |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 02b037764c151bb38e18066e6b66ddb2 |
| SHA1 | b268a9763d13a17cf41b5bcc175fb51d84d0df92 |
| SHA256 | b2bbdbfe36ec42689570a705fb9a84c2a15dafffe5cbd644fbfed35a3490469f |
| SHA512 | 9253cd69fd15dfd5dd263962260209ea42c8239417e04f1f95c81ea999afdcceb56ecb0e60e02fa4915004972a48ff90eb9c268a9334afd717ec86589d15a15e |
memory/396-877-0x0000000073630000-0x0000000073D1E000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7277dc37b820ece6ebe4296cb0c28ce4 |
| SHA1 | e71a075ac2267ec3b0232d0629cfaff66f6e6817 |
| SHA256 | 4a855ed5b36eb0ba0d95c4cd61bfbc9aac3c2c44ca09ce8f7323490ff5953328 |
| SHA512 | 415f91afdb12730be907e4155d827098a03be166dd3aa46691b43b5d8e8310ed49b351e06d2573bd62ed3ffc01d6ccb23d9cb39b8a576c1701bb0dede87a1664 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-09-27 14:03
Reported
2023-09-27 14:06
Platform
win10v2004-20230915-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
Detected Djvu ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Djvu Ransomware
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RedLine
SmokeLoader
UAC bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\D4D7.exe = "0" | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
Downloads MZ/PE file
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\kos.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\CDDF.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\E42A.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\kos1.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\D17B.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Reads user/profile data of web browsers
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\D4D7.exe = "0" | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" | C:\Windows\rss\csrss.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ddb6e504-4303-4c8d-b1f3-e6c7ca623ab9\\CDDF.exe\" --AutoStart" | C:\Users\Admin\AppData\Local\Temp\CDDF.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Checks installed software on the system
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
Manipulates WinMonFS driver.
| Description | Indicator | Process | Target |
| File opened for modification | \??\WinMonFS | C:\Windows\rss\csrss.exe | N/A |
Detected potential entity reuse from brand microsoft.
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File created | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File created | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4676 set thread context of 1020 | N/A | C:\Users\Admin\AppData\Local\Temp\CDDF.exe | C:\Users\Admin\AppData\Local\Temp\CDDF.exe |
| PID 4496 set thread context of 3248 | N/A | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe |
| PID 3444 set thread context of 772 | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe |
| PID 3796 set thread context of 1784 | N/A | C:\Users\Admin\AppData\Local\Temp\D17B.exe | C:\Users\Admin\AppData\Local\Temp\D17B.exe |
| PID 4492 set thread context of 4880 | N/A | C:\Users\Admin\AppData\Local\Temp\F255.exe | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe |
| PID 2248 set thread context of 4036 | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | C:\Users\Admin\AppData\Local\Temp\CDDF.exe |
| PID 2808 set thread context of 2424 | N/A | C:\Users\Admin\AppData\Local\Temp\D17B.exe | C:\Users\Admin\AppData\Local\Temp\D17B.exe |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\PA Previewer\is-PMNKL.tmp | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| File created | C:\Program Files (x86)\PA Previewer\is-Q7FO0.tmp | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| File opened for modification | C:\Program Files (x86)\PA Previewer\unins000.dat | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| File opened for modification | C:\Program Files (x86)\PA Previewer\previewer.exe | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| File created | C:\Program Files (x86)\PA Previewer\unins000.dat | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| File created | C:\Program Files (x86)\PA Previewer\is-IJB2I.tmp | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
| File created | C:\Program Files (x86)\PA Previewer\is-OHME1.tmp | C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\rss | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| File created | C:\Windows\rss\csrss.exe | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\F255.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\CDDF.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\D17B.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\system32\svchost.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\system32\svchost.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\system32\svchost.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Runs net.exe
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| N/A | N/A | C:\Windows\system32\svchost.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\kos.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\PA Previewer\previewer.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\PA Previewer\previewer.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\D4D7.exe | N/A |
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe
"C:\Users\Admin\AppData\Local\Temp\2a26158906c00b20907085703909a035.exe"
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\D022.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\D022.dll
C:\Users\Admin\AppData\Local\Temp\D17B.exe
C:\Users\Admin\AppData\Local\Temp\D17B.exe
C:\Users\Admin\AppData\Local\Temp\D4D7.exe
C:\Users\Admin\AppData\Local\Temp\D4D7.exe
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\ddb6e504-4303-4c8d-b1f3-e6c7ca623ab9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\D4D7.exe" -Force
C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
C:\Users\Admin\AppData\Local\Temp\E42A.exe
C:\Users\Admin\AppData\Local\Temp\E42A.exe
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\kos1.exe
"C:\Users\Admin\AppData\Local\Temp\kos1.exe"
C:\Users\Admin\AppData\Local\Temp\F255.exe
C:\Users\Admin\AppData\Local\Temp\F255.exe
C:\Users\Admin\AppData\Local\Temp\D17B.exe
C:\Users\Admin\AppData\Local\Temp\D17B.exe
C:\Users\Admin\AppData\Local\Temp\set16.exe
"C:\Users\Admin\AppData\Local\Temp\set16.exe"
C:\Users\Admin\AppData\Local\Temp\kos.exe
"C:\Users\Admin\AppData\Local\Temp\kos.exe"
C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp
"C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp" /SL4 $E0212 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -i
C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" helpmsg 8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4492 -ip 4492
C:\Program Files (x86)\PA Previewer\previewer.exe
"C:\Program Files (x86)\PA Previewer\previewer.exe" -s
C:\Users\Admin\AppData\Local\Temp\D17B.exe
"C:\Users\Admin\AppData\Local\Temp\D17B.exe" --Admin IsNotAutoStart IsNotTask
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 136
C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 helpmsg 8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\EF56.exe
C:\Users\Admin\AppData\Local\Temp\EF56.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
"C:\Users\Admin\AppData\Local\Temp\CDDF.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
"C:\Users\Admin\AppData\Local\Temp\CDDF.exe" --Admin IsNotAutoStart IsNotTask
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4036 -ip 4036
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 568
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ngen.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd755246f8,0x7ffd75524708,0x7ffd75524718
C:\Users\Admin\AppData\Local\Temp\D17B.exe
"C:\Users\Admin\AppData\Local\Temp\D17B.exe" --Admin IsNotAutoStart IsNotTask
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2424 -ip 2424
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 572
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ngen.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd755246f8,0x7ffd75524708,0x7ffd75524718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,8768007642636305453,15666233319896569866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.22.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 54.120.234.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 155.245.36.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 135.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 119.110.54.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | potunulit.org | udp |
| US | 188.114.96.0:80 | potunulit.org | tcp |
| US | 8.8.8.8:53 | 0.96.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| BG | 193.42.32.101:80 | 193.42.32.101 | tcp |
| US | 8.8.8.8:53 | 254.217.0.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 101.32.42.193.in-addr.arpa | udp |
| RU | 79.137.192.18:80 | 79.137.192.18 | tcp |
| US | 8.8.8.8:53 | 101.15.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.192.137.79.in-addr.arpa | udp |
| US | 8.8.8.8:53 | alayyadcare.com | udp |
| PS | 213.6.54.58:443 | alayyadcare.com | tcp |
| US | 8.8.8.8:53 | 58.54.6.213.in-addr.arpa | udp |
| US | 8.8.8.8:53 | z.nnnaajjjgc.com | udp |
| MU | 156.236.72.121:443 | z.nnnaajjjgc.com | tcp |
| US | 8.8.8.8:53 | 121.72.236.156.in-addr.arpa | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | 147.174.42.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.175.53.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | iplogger.com | udp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| US | 8.8.8.8:53 | 93.234.251.148.in-addr.arpa | udp |
| PL | 146.59.10.173:45035 | tcp | |
| US | 8.8.8.8:53 | 254.177.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 173.10.59.146.in-addr.arpa | udp |
| US | 8.8.8.8:53 | app.nnnaajjjgc.com | udp |
| HK | 154.221.26.108:80 | app.nnnaajjjgc.com | tcp |
| US | 8.8.8.8:53 | 108.26.221.154.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 163.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | learn.microsoft.com | udp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| US | 8.8.8.8:53 | 28.246.36.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.2.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | js.monitor.azure.com | udp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 13.107.246.67:443 | wcpstatic.microsoft.com | tcp |
| US | 13.107.246.67:443 | wcpstatic.microsoft.com | tcp |
| US | 8.8.8.8:53 | mscom.demdex.net | udp |
| US | 8.8.8.8:53 | target.microsoft.com | udp |
| US | 8.8.8.8:53 | microsoftmscompoc.tt.omtrdc.net | udp |
| IE | 54.78.244.229:443 | mscom.demdex.net | tcp |
| US | 8.8.8.8:53 | 67.246.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 229.244.78.54.in-addr.arpa | udp |
| US | 13.107.246.67:443 | wcpstatic.microsoft.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| NL | 194.169.175.127:80 | host-host-file8.com | tcp |
| US | 8.8.8.8:53 | 829d5ed1-5213-41af-bd75-f6d0e0e6ed83.uuid.cdneurops.health | udp |
| US | 8.8.8.8:53 | 127.175.169.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.178.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.202.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gudintas.at | udp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | 200.24.88.115.in-addr.arpa | udp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | 120.208.253.8.in-addr.arpa | udp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | server3.cdneurops.health | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | stun3.l.google.com | udp |
| US | 8.8.8.8:53 | 126.177.238.8.in-addr.arpa | udp |
| US | 162.159.134.233:443 | cdn.discordapp.com | tcp |
| SG | 74.125.24.127:19302 | stun3.l.google.com | udp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | 127.24.125.74.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.134.159.162.in-addr.arpa | udp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| KR | 115.88.24.200:80 | gudintas.at | tcp |
| US | 8.8.8.8:53 | datasheet.fun | udp |
| US | 172.67.166.109:80 | datasheet.fun | tcp |
| US | 8.8.8.8:53 | 109.166.67.172.in-addr.arpa | udp |
| N/A | 127.0.0.1:443 | tcp | |
| N/A | 127.0.0.1:443 | tcp | |
| N/A | 127.0.0.1:443 | tcp | |
| US | 8.8.8.8:53 | 5.173.189.20.in-addr.arpa | udp |
Files
memory/2268-0-0x00000000005E0000-0x00000000005F5000-memory.dmp
memory/2268-1-0x0000000000720000-0x0000000000729000-memory.dmp
memory/2268-2-0x0000000000400000-0x000000000044A000-memory.dmp
memory/3252-3-0x00000000030A0000-0x00000000030B6000-memory.dmp
memory/2268-4-0x0000000000400000-0x000000000044A000-memory.dmp
memory/2268-8-0x0000000000720000-0x0000000000729000-memory.dmp
memory/2268-7-0x00000000005E0000-0x00000000005F5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/4676-17-0x0000000004250000-0x00000000042ED000-memory.dmp
memory/4676-18-0x0000000004310000-0x000000000442B000-memory.dmp
memory/1020-19-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/1020-21-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1020-23-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\D022.dll
| MD5 | 1ab6c1d7f480fa84080c5ea04328841c |
| SHA1 | 4e98a73776cdb17fcbef5d3c24c2c809443317e0 |
| SHA256 | 71998d732d2df7220d044181117be67b53bc1566d66dcf4a4ace737112915a1f |
| SHA512 | 34766634f8bdb7ea1e2bd64db0719697b1550b854d059f84e0b97ac30cbc8a76b50537459d8845087d5cbcd4f55c2cc344a904b6239630587e204e8a9b7b8fb2 |
memory/1020-24-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\D022.dll
| MD5 | 1ab6c1d7f480fa84080c5ea04328841c |
| SHA1 | 4e98a73776cdb17fcbef5d3c24c2c809443317e0 |
| SHA256 | 71998d732d2df7220d044181117be67b53bc1566d66dcf4a4ace737112915a1f |
| SHA512 | 34766634f8bdb7ea1e2bd64db0719697b1550b854d059f84e0b97ac30cbc8a76b50537459d8845087d5cbcd4f55c2cc344a904b6239630587e204e8a9b7b8fb2 |
C:\Users\Admin\AppData\Local\Temp\D17B.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
C:\Users\Admin\AppData\Local\Temp\D17B.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/4040-31-0x0000000010000000-0x00000000102A9000-memory.dmp
memory/4040-32-0x0000000001340000-0x0000000001346000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\D4D7.exe
| MD5 | f62db17095733535b6cfd2d07d7fd994 |
| SHA1 | cb75466f4814f879f640e95fa8b88b4c6e8dd0c5 |
| SHA256 | 9fe3bfd40d042b7a7e2d46578d5f889a90d0b0a36c233063f59fbdbb1fc5570c |
| SHA512 | 76f8889cfb56d70d8d3605b50d186e90e16ba53ad1de283e95c1d0d9e6f158d0c267d9377fe2a7498bbaec3ca030347bead67299c5ee9aa9faf531f5db0d2516 |
C:\Users\Admin\AppData\Local\Temp\D4D7.exe
| MD5 | f62db17095733535b6cfd2d07d7fd994 |
| SHA1 | cb75466f4814f879f640e95fa8b88b4c6e8dd0c5 |
| SHA256 | 9fe3bfd40d042b7a7e2d46578d5f889a90d0b0a36c233063f59fbdbb1fc5570c |
| SHA512 | 76f8889cfb56d70d8d3605b50d186e90e16ba53ad1de283e95c1d0d9e6f158d0c267d9377fe2a7498bbaec3ca030347bead67299c5ee9aa9faf531f5db0d2516 |
memory/4496-38-0x00000000727C0000-0x0000000072F70000-memory.dmp
memory/4496-39-0x0000000000F10000-0x0000000000F90000-memory.dmp
memory/4496-43-0x0000000005ED0000-0x0000000006474000-memory.dmp
memory/4496-44-0x0000000005A20000-0x0000000005ABC000-memory.dmp
memory/4496-45-0x0000000005800000-0x0000000005892000-memory.dmp
memory/4496-49-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/4496-50-0x00000000058A0000-0x00000000058AA000-memory.dmp
memory/4496-52-0x00000000059C0000-0x0000000005A20000-memory.dmp
memory/4496-53-0x0000000005BB0000-0x0000000005BCA000-memory.dmp
memory/3248-54-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4496-57-0x00000000727C0000-0x0000000072F70000-memory.dmp
memory/3852-61-0x00000000027B0000-0x00000000027E6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E42A.exe
| MD5 | 46ec3f1333f627b301fa9c871343bc9a |
| SHA1 | 59483a7dd5c33a5a14c4da9441230f7810cd4329 |
| SHA256 | 9b9cbe098bcd6261d2ec404c6da54c7977f7d9919b3daac26c72fa30fa8aafe6 |
| SHA512 | b64ba101fb60943980826d3b4597fdada8670beb2a927d0a022901c09be1833cfa83b990a67bbada136108146b301436bd6ebdf90b0d36a5c01978ca95413e1d |
memory/3852-63-0x00000000727A0000-0x0000000072F50000-memory.dmp
memory/1408-62-0x00000000001D0000-0x0000000000864000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\E42A.exe
| MD5 | 46ec3f1333f627b301fa9c871343bc9a |
| SHA1 | 59483a7dd5c33a5a14c4da9441230f7810cd4329 |
| SHA256 | 9b9cbe098bcd6261d2ec404c6da54c7977f7d9919b3daac26c72fa30fa8aafe6 |
| SHA512 | b64ba101fb60943980826d3b4597fdada8670beb2a927d0a022901c09be1833cfa83b990a67bbada136108146b301436bd6ebdf90b0d36a5c01978ca95413e1d |
memory/1408-65-0x00000000727A0000-0x0000000072F50000-memory.dmp
memory/3852-66-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3852-68-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/3852-67-0x0000000005290000-0x00000000058B8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
memory/3336-77-0x00007FF625960000-0x00007FF625A02000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\aafg31.exe
| MD5 | 4c6c11197bbcbdf3a66c9dc1fd7b542f |
| SHA1 | 78912bac8af6ed28ba23e58d5e63614444ef64e1 |
| SHA256 | 830b8d661d5e404c05d5b2b2f5361ab2da6fecc90a561de81354e7840bfc5b63 |
| SHA512 | 5fd8e96127ec349585e7c925f2692cafa6b5a2bfbd963acea96aa03179e6ea641b4b0fd7e279f63c0102ae93518e90da74e644150cb92a36f7503b6ab9e74948 |
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkc3djdi.t4i.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
memory/3852-98-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/3852-94-0x0000000005AC0000-0x0000000005AE2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
memory/3852-103-0x0000000005C40000-0x0000000005CA6000-memory.dmp
memory/3852-113-0x0000000005CB0000-0x0000000006004000-memory.dmp
memory/772-116-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EF56.exe
| MD5 | 28c04223bb90a55c51453576deb7e844 |
| SHA1 | 3a5ef5a914764d8704e7479895d96d306cc174eb |
| SHA256 | c318f9be84ca730ca7c03435e8ec1bc06c46d2dc350bb4b4927a1b1af0d1f9f1 |
| SHA512 | d955f52472974be65028c3cde00ad517f6c02e9e4dba63643709fbfea9d4ac0457fc3a73989a1e709326053778837d02375e446f7df24b3723c45a8625c72cfc |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | bb924d501954bee604c97534385ecbda |
| SHA1 | 05a480d2489f18329fb302171f1b077aa5da6fd2 |
| SHA256 | c69c012e1a7a4bd10e44563b48329341f3172715ed3c18b40cb6d05a7f704372 |
| SHA512 | 23a0464bace69318a013e9e4e9dc34dcf232897fb7a3cf8af33d9bc9e3bbb209e9b7198e9d43cb97a174a45ad82f9c7d52ddadf5b069281092fab0aa2d3d58e0 |
memory/772-122-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
C:\Users\Admin\AppData\Local\Temp\F255.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
memory/1584-142-0x00000000727A0000-0x0000000072F50000-memory.dmp
memory/1408-143-0x00000000727A0000-0x0000000072F50000-memory.dmp
memory/1584-137-0x0000000000040000-0x00000000001B4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\kos1.exe
| MD5 | 85b698363e74ba3c08fc16297ddc284e |
| SHA1 | 171cfea4a82a7365b241f16aebdb2aad29f4f7c0 |
| SHA256 | 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe |
| SHA512 | 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796 |
C:\Users\Admin\AppData\Local\Temp\kos1.exe
| MD5 | 85b698363e74ba3c08fc16297ddc284e |
| SHA1 | 171cfea4a82a7365b241f16aebdb2aad29f4f7c0 |
| SHA256 | 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe |
| SHA512 | 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
C:\Users\Admin\AppData\Local\Temp\kos1.exe
| MD5 | 85b698363e74ba3c08fc16297ddc284e |
| SHA1 | 171cfea4a82a7365b241f16aebdb2aad29f4f7c0 |
| SHA256 | 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe |
| SHA512 | 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796 |
memory/4040-144-0x0000000003400000-0x00000000034E4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\EF56.exe
| MD5 | 28c04223bb90a55c51453576deb7e844 |
| SHA1 | 3a5ef5a914764d8704e7479895d96d306cc174eb |
| SHA256 | c318f9be84ca730ca7c03435e8ec1bc06c46d2dc350bb4b4927a1b1af0d1f9f1 |
| SHA512 | d955f52472974be65028c3cde00ad517f6c02e9e4dba63643709fbfea9d4ac0457fc3a73989a1e709326053778837d02375e446f7df24b3723c45a8625c72cfc |
memory/3016-145-0x0000000004860000-0x0000000004C64000-memory.dmp
memory/3444-112-0x0000000002800000-0x0000000002809000-memory.dmp
memory/4040-148-0x0000000010000000-0x00000000102A9000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F255.exe
| MD5 | 91bcd7b719ed166914dccdca25b28e14 |
| SHA1 | 2cc7758c97bbe851cadcdbd6a3158358b690d97f |
| SHA256 | 76caf7bc6b371e4caf0b0216d6d04f9497f8c3cec68f6528bae429d2f92c638b |
| SHA512 | 5442042ce0c38637da8e55c65028c8c0392b282776ae206e2bc5e455158f3d69de4ecd43ab79ebb70257a28414afc2c17fdb8390a0902b989ae67257cc0070d0 |
memory/1784-162-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\D17B.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/3796-164-0x0000000002300000-0x000000000241B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\kos.exe
| MD5 | 076ab7d1cc5150a5e9f8745cc5f5fb6c |
| SHA1 | 7b40783a27a38106e2cc91414f2bc4d8b484c578 |
| SHA256 | d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90 |
| SHA512 | 75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b |
memory/3016-185-0x0000000000400000-0x0000000002985000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp
| MD5 | 2fba5642cbcaa6857c3995ccb5d2ee2a |
| SHA1 | 91fe8cd860cba7551fbf78bc77cc34e34956e8cc |
| SHA256 | ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa |
| SHA512 | 30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c |
memory/1584-189-0x00000000727A0000-0x0000000072F50000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-A3KRA.tmp\is-NJA0H.tmp
| MD5 | 2fba5642cbcaa6857c3995ccb5d2ee2a |
| SHA1 | 91fe8cd860cba7551fbf78bc77cc34e34956e8cc |
| SHA256 | ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa |
| SHA512 | 30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c |
C:\Users\Admin\AppData\Local\Temp\is-JIO5U.tmp\_isetup\_isdecmp.dll
| MD5 | b4786eb1e1a93633ad1b4c112514c893 |
| SHA1 | 734750b771d0809c88508e4feb788d7701e6dada |
| SHA256 | 2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f |
| SHA512 | 0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6 |
memory/116-210-0x000000001AE80000-0x000000001AE90000-memory.dmp
memory/3016-218-0x0000000004C70000-0x000000000555B000-memory.dmp
memory/772-217-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3252-216-0x00000000031B0000-0x00000000031C6000-memory.dmp
memory/3852-215-0x00000000066D0000-0x000000000671C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\is-JIO5U.tmp\_isetup\_iscrypt.dll
| MD5 | a69559718ab506675e907fe49deb71e9 |
| SHA1 | bc8f404ffdb1960b50c12ff9413c893b56f2e36f |
| SHA256 | 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc |
| SHA512 | e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63 |
C:\Users\Admin\AppData\Local\Temp\is-JIO5U.tmp\_isetup\_isdecmp.dll
| MD5 | b4786eb1e1a93633ad1b4c112514c893 |
| SHA1 | 734750b771d0809c88508e4feb788d7701e6dada |
| SHA256 | 2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f |
| SHA512 | 0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 09d2bae3b05f4c92b25a8c6225df6483 |
| SHA1 | ff084d8a1f43903b95bf9144b3719126a3d40cc8 |
| SHA256 | a282e51236ad1fb5eb73b2d8d8cb022213cda792705d8f595b504e2b6d2e00c5 |
| SHA512 | 2151cb657a649acbc7009b20a0101f4d196a2c3cf4793885f95e8b865fb6da424a17fa139b97e312e2157a559beb5be63c824841c871114fec949d810c92bd2c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 6df71a15d9158376443809637766e0d4 |
| SHA1 | 323317178094e651d685045ed0aaeddb984d24e2 |
| SHA256 | c9acaebe1cb649c1afaeefb253f8a13c7ccc6a12cae775359e13d8d450b515a6 |
| SHA512 | c85a4cda5ce62afe673fde054f33976814eda2016811f9466bb91fdac9858cc42ed775bdfbfe72ab93cde03327995c7250443dc8c61c2ad475c2541081906983 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | c0419d05ad443966df72dd199ad71dd8 |
| SHA1 | 0ba0b1ddfbd9e45879342dba9191efbc478edf05 |
| SHA256 | 49e4e0f0690e9d8e830bd520e4cd37e616a530274c6b9ce978f11c122c19696b |
| SHA512 | e63bd124dd8d1b8993b42507a81e39c74edabfc5798cef0869638f3c2ee95a4646aab829d0d974e7912d7fa127f1098d98b92d31b4b01e1d4b4ddfd8e6e84c91 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 858c7b3a83364e729e6304fe9aec4f10 |
| SHA1 | 1c4c1313899dce5f02ba9e307f1502a58e033171 |
| SHA256 | 0ed4986538541f8e50b2fb9990841d8aedf7fe6d482a0db27854ab7a5fb180de |
| SHA512 | 87a1e058f7359e5274c40a1978286b8976ce5f267bbe5d0be2a3c1cae318e1a309e666cd6d850a5d982761fef6bc4a418572c0c44f9f989359a7232c8ea4bc3a |
memory/3852-194-0x00000000060F0000-0x000000000610E000-memory.dmp
memory/116-193-0x00007FFD72970000-0x00007FFD73431000-memory.dmp
memory/116-183-0x0000000000170000-0x0000000000178000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\kos.exe
| MD5 | 076ab7d1cc5150a5e9f8745cc5f5fb6c |
| SHA1 | 7b40783a27a38106e2cc91414f2bc4d8b484c578 |
| SHA256 | d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90 |
| SHA512 | 75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b |
C:\Users\Admin\AppData\Local\Temp\kos.exe
| MD5 | 076ab7d1cc5150a5e9f8745cc5f5fb6c |
| SHA1 | 7b40783a27a38106e2cc91414f2bc4d8b484c578 |
| SHA256 | d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90 |
| SHA512 | 75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b |
memory/4040-170-0x0000000003400000-0x00000000034E4000-memory.dmp
memory/4908-168-0x0000000000400000-0x0000000000413000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
memory/1784-165-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
memory/1784-160-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4040-158-0x0000000003400000-0x00000000034E4000-memory.dmp
memory/4908-229-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1784-234-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4200-236-0x0000000000630000-0x0000000000631000-memory.dmp
C:\Program Files (x86)\PA Previewer\previewer.exe
| MD5 | 27b85a95804a760da4dbee7ca800c9b4 |
| SHA1 | f03136226bf3dd38ba0aa3aad1127ccab380197c |
| SHA256 | f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245 |
| SHA512 | e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7 |
memory/4880-238-0x0000000000400000-0x0000000000430000-memory.dmp
memory/3852-245-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/4880-246-0x0000000000ED0000-0x0000000000ED6000-memory.dmp
memory/3852-249-0x00000000027F0000-0x0000000002800000-memory.dmp
memory/4880-251-0x00000000727A0000-0x0000000072F50000-memory.dmp
memory/4880-254-0x0000000005580000-0x0000000005B98000-memory.dmp
memory/1836-253-0x0000000000400000-0x00000000005F1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\D17B.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/4880-261-0x0000000004FA0000-0x0000000004FB2000-memory.dmp
memory/4880-262-0x0000000004CD0000-0x0000000004CE0000-memory.dmp
memory/1836-263-0x0000000000400000-0x00000000005F1000-memory.dmp
C:\Users\Admin\AppData\Local\ddb6e504-4303-4c8d-b1f3-e6c7ca623ab9\CDDF.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/4880-256-0x0000000005070000-0x000000000517A000-memory.dmp
memory/1784-255-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
| MD5 | ec6aae2bb7d8781226ea61adca8f0586 |
| SHA1 | d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3 |
| SHA256 | b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599 |
| SHA512 | aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7 |
C:\Program Files (x86)\PA Previewer\previewer.exe
| MD5 | 27b85a95804a760da4dbee7ca800c9b4 |
| SHA1 | f03136226bf3dd38ba0aa3aad1127ccab380197c |
| SHA256 | f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245 |
| SHA512 | e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7 |
memory/3496-247-0x0000000000400000-0x00000000005F1000-memory.dmp
C:\ProgramData\ContentDVSvc\ContentDVSvc.exe
| MD5 | 27b85a95804a760da4dbee7ca800c9b4 |
| SHA1 | f03136226bf3dd38ba0aa3aad1127ccab380197c |
| SHA256 | f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245 |
| SHA512 | e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7 |
C:\Program Files (x86)\PA Previewer\previewer.exe
| MD5 | 27b85a95804a760da4dbee7ca800c9b4 |
| SHA1 | f03136226bf3dd38ba0aa3aad1127ccab380197c |
| SHA256 | f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245 |
| SHA512 | e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7 |
memory/3852-242-0x00000000727A0000-0x0000000072F50000-memory.dmp
memory/3496-237-0x0000000000400000-0x00000000005F1000-memory.dmp
memory/3796-157-0x0000000000650000-0x00000000006E2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\set16.exe
| MD5 | 22d5269955f256a444bd902847b04a3b |
| SHA1 | 41a83de3273270c3bd5b2bd6528bdc95766aa268 |
| SHA256 | ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd |
| SHA512 | d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c |
memory/3444-110-0x0000000002890000-0x0000000002990000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
memory/4040-111-0x0000000003300000-0x00000000033FE000-memory.dmp
memory/1020-104-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3016-272-0x0000000000400000-0x0000000002985000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/1020-296-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4036-308-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\CDDF.exe
| MD5 | 8f2f61172cc6cc8e38e4db6828255e8f |
| SHA1 | d099f9c4d4b798c8cde7c8fd8447fd5fc82ad45d |
| SHA256 | 109ff1b8cc63e26cf45385b2521c9c56dae62d03ed0acbccb577a3ca729d8adc |
| SHA512 | e5290b3cd78698ce14c01a25a8f9c7efe2dff0f38f9c581490ae1aaef25bc971c05aca2d06eae4a4eecbf6033ab6bef9a541c7f1eb332ac0a6808ad4b0b77b57 |
memory/4036-310-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4036-312-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4200-315-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/3016-338-0x0000000000400000-0x0000000002985000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 1222f8c867acd00b1fc43a44dacce158 |
| SHA1 | 586ba251caf62b5012a03db9ba3a70890fc5af01 |
| SHA256 | 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a |
| SHA512 | ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916 |
C:\Users\Admin\AppData\Local\Temp\D17B.exe
| MD5 | e38e0c7603b34e1d6612412537f9ad60 |
| SHA1 | a5c64ee337b723f270912031d6b39a16e118b55b |
| SHA256 | 6b9b65805c8e2e937afd2a1ba7602cbcd80358f2e75e04160e419615e1e1bcdc |
| SHA512 | 9b592034875ebeda47421f7cbd749005a551145aa68c05bade27eed789e26a363fa810df03dad0180327580ca53f6064946511642827f13e8b234f69e9387a5c |
memory/2424-348-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2424-349-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2424-357-0x0000000000400000-0x0000000000537000-memory.dmp
\??\pipe\LOCAL\crashpad_2248_IFXPXKGPENHERHBF
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 0261b6a5dfdb4b286093c345bbab5eb1 |
| SHA1 | c5ea464c7374d61d1883c3220712e217cdfd4755 |
| SHA256 | 36f01eaa16674f85ed9cb200f03c09202483accb601dd21f7a5402543cb49741 |
| SHA512 | 5c8e91fef6b300cf20cc6173150ea4e5c29999a531832b404cad369f29868e9e837e85f880f65e8448a175f4618b9f0963ce00074b81fb0984b7737952e465ea |
memory/3252-369-0x0000000004890000-0x00000000048A6000-memory.dmp
memory/2824-381-0x0000000000400000-0x0000000000450000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 1222f8c867acd00b1fc43a44dacce158 |
| SHA1 | 586ba251caf62b5012a03db9ba3a70890fc5af01 |
| SHA256 | 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a |
| SHA512 | ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 5c492b520bf75df44097dd2d91bb3b99 |
| SHA1 | 0061d14e05d42a568281f3fd98e37df81b8552b0 |
| SHA256 | b3dc6bbdf7e9842ee0d5af6b680b23762e37e9e089889856028409cd2d48581f |
| SHA512 | aab1d5e704ebe41fb44d605b454c396b3d3e3c33a21ec346d99c491e2738a8a538dcc505adff36fc41d40db90da225119a319aa40a86152f3c2e68f0a3674631 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2f813d6be0b446c956abf1d6c0f95fd3 |
| SHA1 | 7ea0fc9e454f01ee24af07ab94d7bf39c8f477f0 |
| SHA256 | 3f6bc156793ae07631d4144ebf4e8ecc45ee8eafd121b540d246d07de7d42b42 |
| SHA512 | 55e4c4707578134436eeb3af8af46823dfcdcdaee9c337e456e48e2fd7d3a4f3bbd330c7bb25d0b9361b6ac997f160ad612e6cd9f377d58f76d588d02a0d6296 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | 15ad31a14e9a92d2937174141e80c28d |
| SHA1 | b09e8d44c07123754008ba2f9ff4b8d4e332d4e5 |
| SHA256 | bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde |
| SHA512 | ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 3d086a433708053f9bf9523e1d87a4e8 |
| SHA1 | b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28 |
| SHA256 | 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69 |
| SHA512 | 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | a671589d4f09c4347fe439b79f331cf5 |
| SHA1 | 136889279a6af135cb8f0a9dad2092a2cea8d061 |
| SHA256 | ddd370601c0fe011e459790c2814fcbd62b90ee142504983845a50e0db9bce11 |
| SHA512 | 112f602a80c7e93e79f45e33e55f7d411b5be2ef1c4d601ef124943baf13821c21b8dca9865e208d696336ca114670837590b40ad42e81cbb3aa3a5815aad536 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 507458de4dd47219bff95637c7ed8af7 |
| SHA1 | a3eab3bc7a206586de8075ff75accac528cddc2f |
| SHA256 | cf4a5fb31696910660146b3a8aa5ed7b9a22bdf134d539d2adf3dcb70bc9948f |
| SHA512 | 62eb23a083005ca43def5b8681f6f351d12ee8d86bafb7c5f32d934aec85f5fb8a5ff3a5980f1d16682607765cf72628a4847c66eec8277330f10c681df339af |
C:\Windows\rss\csrss.exe
| MD5 | 21bdc4635e67b42af297b5d422b47cdc |
| SHA1 | da08dd00ae5bc0da5ec6433569bcc68c4a8a9410 |
| SHA256 | f73bfbd1b920825c536bef691413cd8ae7ea01fb869172da38e4775660e96287 |
| SHA512 | 626aa66348c62b9b7cdb63eb15be3b7cfc9f3d056ad6b05f183e11a5a2e5143448f5797686bbc8039ef6b01e86dd61c3d8639a20dd7298ec4fba9e140329c6a5 |
C:\Users\Admin\AppData\Roaming\hwrgaug
| MD5 | 28c04223bb90a55c51453576deb7e844 |
| SHA1 | 3a5ef5a914764d8704e7479895d96d306cc174eb |
| SHA256 | c318f9be84ca730ca7c03435e8ec1bc06c46d2dc350bb4b4927a1b1af0d1f9f1 |
| SHA512 | d955f52472974be65028c3cde00ad517f6c02e9e4dba63643709fbfea9d4ac0457fc3a73989a1e709326053778837d02375e446f7df24b3723c45a8625c72cfc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 86cbb7c266ce85126e835943141cc796 |
| SHA1 | f7a6280a910f30e4cf4fd61e2f71a7ada658a3b8 |
| SHA256 | 131444b50ef3e1b2793514ae01ffd9c2091459e6b599ffe397bde127b5192edd |
| SHA512 | 9c04f81738bbda961098235b4064e955a13a7b2b37075cc87f9f3ca67860e823c1a0fb93ee41b7b2e87c99aaad90a08264d122193aea8934857000026bd87a13 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | e0c32170e0b9d1adcd719c99d4657a9b |
| SHA1 | fe41f67ac662bb44eba6b649912242a590281c42 |
| SHA256 | 4814019e9178b288e334328b0703109ff98194c243d79d99b6518e537579ade4 |
| SHA512 | be15082a268ad82986dcc998135c5430ab0c1f6b2e3957d5235693d6f88265fb63a7072d4a9ba5447728a08e57c4c6f1207d34630d2bb520d341ae0e84cf881a |