Malware Analysis Report

2025-06-16 02:08

Sample ID 231002-jas7tsgb7s
Target file
SHA256 0278cd0d16def73d5d75106ad62ca0d62eadc9b511c59f7c5bbb68c1b0befda8
Tags
amadey dcrat fabookie glupteba healer mystic redline smokeloader @ytlogsbot up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan genda larek
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0278cd0d16def73d5d75106ad62ca0d62eadc9b511c59f7c5bbb68c1b0befda8

Threat Level: Known bad

The file file was found to be: Known bad.

Malicious Activity Summary

amadey dcrat fabookie glupteba healer mystic redline smokeloader @ytlogsbot up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan genda larek

Amadey

Fabookie

Mystic

Modifies Windows Defender Real-time Protection settings

RedLine

SmokeLoader

Glupteba payload

RedLine payload

DcRat

Healer

Detects Healer an antivirus disabler dropper

Detect Fabookie payload

Glupteba

Downloads MZ/PE file

Modifies Windows Firewall

Executes dropped EXE

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Checks computer location settings

Windows security modification

Loads dropped DLL

Checks installed software on the system

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Unsigned PE

Enumerates physical storage devices

Modifies Internet Explorer settings

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Runs net.exe

Modifies system certificate store

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-02 07:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-02 07:28

Reported

2023-10-02 07:30

Platform

win7-20230831-en

Max time kernel

85s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detect Fabookie payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Fabookie

spyware stealer fabookie

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A

Mystic

stealer mystic

RedLine

infostealer redline

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BC10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C15F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C844.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\LI279Qb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F2DE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\LI279Qb.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\BA4A.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup6 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup7 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP007.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup8 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP008.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\PA Previewer\is-2CUB8.tmp C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-LHAJ8.tmp C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-Q4NFD.tmp C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-HLE1D.tmp C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A
File created C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900e033602f5d901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BE4C771-60F5-11EE-A777-4E9D0FD57FD1} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000e4405df767de958c2c28d895c29045b46d4ed1c6666b624d50599ed312d2abed000000000e8000000002000020000000b23d30256ae20bbc79ff8b4ace33443919dfaead2e2537c519c907df7621ab562000000082f4fba5954dea2d20cc6d109978ab69e0ad45c0887fa53e4f24f0c83a4e2e7c40000000f7b25ed5bf1409ae956d4e8ff3b0ff9dca9b96a471e5cb7c573d558296f98234653a0892962c389cff66c18f53e092d2a66c3b11fd763cd90a7061292a074fca C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000a99a679eadd242f456b5c53062107d00449cd78774e425c4e0c8fccac6e0f630000000000e8000000002000020000000c52ed02f4a96c5f0b20105b70cb761309e6806093af32f59adbbb3e28e4140449000000096adf9deb77f7a2280302afcd7e5c531c6cd9343a3e3f490275e13bb951dd3d8e3d902a09264c929a9f42c8e2edab9d6a9cfdb819f68bf3c788a53660792f28b8dd8fd02bc9704dade0f039d7902113f13c3f2ff768a5aee0dc8465b4c263c3d04e16df6be0e19969e843116d9cc672b846527b671823fb980c5d666be724ecf05e8d67a47bd70373b9739139c522ce940000000867918e34b46172415388f1ab9b36fafd4d270bebf97d5ced0d243fce3720bb2a301f660cb50793f1984b29c61df3ad4e0489d897a8b673ac3b9f5d943b54619 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\C4E9.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2376 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 2376 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 2376 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 2376 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 2376 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 2376 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 2376 wrote to memory of 2948 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 2948 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 2948 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 2948 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 2948 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 2948 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 2948 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 2948 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 2664 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 2664 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 2664 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 2664 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 2664 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 2664 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 2664 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 2784 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 2784 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 2784 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 2784 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 2784 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 2784 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 2784 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 2784 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 2784 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 2784 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 2784 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 2784 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 2784 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 2784 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1676 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\SysWOW64\WerFault.exe
PID 1676 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\SysWOW64\WerFault.exe
PID 1676 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\SysWOW64\WerFault.exe
PID 1676 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\SysWOW64\WerFault.exe
PID 1676 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\SysWOW64\WerFault.exe
PID 1676 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\SysWOW64\WerFault.exe
PID 1676 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\SysWOW64\WerFault.exe
PID 1224 wrote to memory of 1800 N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe
PID 1224 wrote to memory of 1800 N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe
PID 1224 wrote to memory of 1800 N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe
PID 1224 wrote to memory of 1800 N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe
PID 1224 wrote to memory of 1800 N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe
PID 1224 wrote to memory of 1800 N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe
PID 1224 wrote to memory of 1800 N/A N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe
PID 1800 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe
PID 1800 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe
PID 1800 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe
PID 1800 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe
PID 1800 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\BA4A.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 284

C:\Users\Admin\AppData\Local\Temp\BA4A.exe

C:\Users\Admin\AppData\Local\Temp\BA4A.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe

C:\Users\Admin\AppData\Local\Temp\BC10.exe

C:\Users\Admin\AppData\Local\Temp\BC10.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 132

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\BF0D.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\C15F.exe

C:\Users\Admin\AppData\Local\Temp\C15F.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 132

C:\Users\Admin\AppData\Local\Temp\C4E9.exe

C:\Users\Admin\AppData\Local\Temp\C4E9.exe

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\LI279Qb.exe

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\LI279Qb.exe

C:\Users\Admin\AppData\Local\Temp\C844.exe

C:\Users\Admin\AppData\Local\Temp\C844.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 280

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\DC41.exe

C:\Users\Admin\AppData\Local\Temp\DC41.exe

C:\Users\Admin\AppData\Local\Temp\ss41.exe

"C:\Users\Admin\AppData\Local\Temp\ss41.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\kos1.exe

"C:\Users\Admin\AppData\Local\Temp\kos1.exe"

C:\Users\Admin\AppData\Local\Temp\F2DE.exe

C:\Users\Admin\AppData\Local\Temp\F2DE.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\set16.exe

"C:\Users\Admin\AppData\Local\Temp\set16.exe"

C:\Users\Admin\AppData\Local\Temp\kos.exe

"C:\Users\Admin\AppData\Local\Temp\kos.exe"

C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp

"C:\Users\Admin\AppData\Local\Temp\is-AI8VI.tmp\is-B77R1.tmp" /SL4 $20250 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 8

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 8

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -i

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -s

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231002072951.log C:\Windows\Logs\CBS\CbsPersist_20231002072951.cab

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {9C556488-3501-47C8-9C3C-A7F64FB35BD3} S-1-5-21-3513876443-2771975297-1923446376-1000:GPFFWLPI\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\gghreba

C:\Users\Admin\AppData\Roaming\gghreba

C:\Users\Admin\AppData\Roaming\cghreba

C:\Users\Admin\AppData\Roaming\cghreba

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Users\Admin\AppData\Roaming\cghreba

C:\Users\Admin\AppData\Roaming\cghreba

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\system32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"

Network

Country Destination Domain Proto
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 www.facebook.com udp
RU 5.42.92.211:80 5.42.92.211 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
RU 5.42.65.80:80 5.42.65.80 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.35:443 facebook.com tcp
NL 157.240.201.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
NL 157.240.201.35:443 fbsbx.com tcp
NL 157.240.201.35:443 fbsbx.com tcp
US 8.8.8.8:53 z.nnnaajjjgc.com udp
FI 77.91.68.78:80 77.91.68.78 tcp
MU 156.236.72.121:443 z.nnnaajjjgc.com tcp
NL 157.240.201.35:443 fbsbx.com tcp
NL 157.240.201.35:443 fbsbx.com tcp
NL 157.240.201.35:443 fbsbx.com tcp
NL 157.240.201.35:443 fbsbx.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.170:80 apps.identrust.com tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 app.nnnaajjjgc.com udp
DE 148.251.234.93:443 iplogger.com tcp
HK 154.221.26.108:80 app.nnnaajjjgc.com tcp
DE 148.251.234.93:443 iplogger.com tcp
MD 176.123.4.46:33783 tcp
US 8.8.8.8:53 www.microsoft.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 65d4c27c-a238-4562-98f4-dc6587f2c326.uuid.ramboclub.net udp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 msdl.microsoft.com udp
US 204.79.197.219:443 msdl.microsoft.com tcp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 vsblobprodscussu5shard30.blob.core.windows.net udp
US 20.150.70.36:443 vsblobprodscussu5shard30.blob.core.windows.net tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp
DE 148.251.234.93:443 iplogger.com tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

MD5 61841312daa6742993b4126d3ae4f167
SHA1 233d112a31030e6c3093af86d0f461d15fd9c341
SHA256 851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512 b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

MD5 61841312daa6742993b4126d3ae4f167
SHA1 233d112a31030e6c3093af86d0f461d15fd9c341
SHA256 851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512 b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f

\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

MD5 61841312daa6742993b4126d3ae4f167
SHA1 233d112a31030e6c3093af86d0f461d15fd9c341
SHA256 851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512 b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

MD5 61841312daa6742993b4126d3ae4f167
SHA1 233d112a31030e6c3093af86d0f461d15fd9c341
SHA256 851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512 b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f

\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

MD5 b706493ed4d8b02a37d591adb06d73d9
SHA1 cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256 344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA512 7f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

MD5 b706493ed4d8b02a37d591adb06d73d9
SHA1 cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256 344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA512 7f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71

\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

MD5 b706493ed4d8b02a37d591adb06d73d9
SHA1 cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256 344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA512 7f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

MD5 b706493ed4d8b02a37d591adb06d73d9
SHA1 cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256 344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA512 7f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71

\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

MD5 5af6cda954aedb3576dfefc7a4fb7867
SHA1 8727aa8ee58833ea241d484cd5931339bd2e9adb
SHA256 9f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA512 6cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

MD5 5af6cda954aedb3576dfefc7a4fb7867
SHA1 8727aa8ee58833ea241d484cd5931339bd2e9adb
SHA256 9f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA512 6cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790

\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

MD5 5af6cda954aedb3576dfefc7a4fb7867
SHA1 8727aa8ee58833ea241d484cd5931339bd2e9adb
SHA256 9f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA512 6cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

MD5 5af6cda954aedb3576dfefc7a4fb7867
SHA1 8727aa8ee58833ea241d484cd5931339bd2e9adb
SHA256 9f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA512 6cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

MD5 d0ca53edd2573f99ec6b54e391860a7e
SHA1 3f0dd462e293e2bb7bf12c79b1ac32ec00c774e7
SHA256 3939112be72ceafe74305a47754cb2e48b3ebce12068a8fa6d549180ab234f19
SHA512 74d07cdd3c95de593c15e925a6cf38be06b6b14dc47feeedb207b3a0fc69d563f4e5c046c05679331e3d9762197c32432b15f859e4e9ad795c0e3d4c6726b6d0

\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

MD5 d0ca53edd2573f99ec6b54e391860a7e
SHA1 3f0dd462e293e2bb7bf12c79b1ac32ec00c774e7
SHA256 3939112be72ceafe74305a47754cb2e48b3ebce12068a8fa6d549180ab234f19
SHA512 74d07cdd3c95de593c15e925a6cf38be06b6b14dc47feeedb207b3a0fc69d563f4e5c046c05679331e3d9762197c32432b15f859e4e9ad795c0e3d4c6726b6d0

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

MD5 d0ca53edd2573f99ec6b54e391860a7e
SHA1 3f0dd462e293e2bb7bf12c79b1ac32ec00c774e7
SHA256 3939112be72ceafe74305a47754cb2e48b3ebce12068a8fa6d549180ab234f19
SHA512 74d07cdd3c95de593c15e925a6cf38be06b6b14dc47feeedb207b3a0fc69d563f4e5c046c05679331e3d9762197c32432b15f859e4e9ad795c0e3d4c6726b6d0

memory/2772-38-0x0000000000ED0000-0x0000000000EDA000-memory.dmp

memory/2772-39-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

memory/2772-40-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

memory/2772-41-0x000007FEF5440000-0x000007FEF5E2C000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

memory/2524-51-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2524-52-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2524-53-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2524-54-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2524-55-0x0000000000400000-0x0000000000409000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

memory/1224-60-0x0000000002A90000-0x0000000002AA6000-memory.dmp

memory/2524-62-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BA4A.exe

MD5 099b3d4378bb94aa106135ed1fc4d922
SHA1 2f9609032c3aea88a01321ce705a5fcded2a74d8
SHA256 271baf68891b775c19ff448ad18177a1dd25956d7a8d6c9a1a04cd454b84f9db
SHA512 50ce310246854d65e902f0d8e586732e2d94d4b9f713edf4be070a2d1de57bd551f885cc5d3df869180aa0d9e0920ca2d474f3919281025340e750249a06fdfe

C:\Users\Admin\AppData\Local\Temp\BA4A.exe

MD5 099b3d4378bb94aa106135ed1fc4d922
SHA1 2f9609032c3aea88a01321ce705a5fcded2a74d8
SHA256 271baf68891b775c19ff448ad18177a1dd25956d7a8d6c9a1a04cd454b84f9db
SHA512 50ce310246854d65e902f0d8e586732e2d94d4b9f713edf4be070a2d1de57bd551f885cc5d3df869180aa0d9e0920ca2d474f3919281025340e750249a06fdfe

\Users\Admin\AppData\Local\Temp\BA4A.exe

MD5 099b3d4378bb94aa106135ed1fc4d922
SHA1 2f9609032c3aea88a01321ce705a5fcded2a74d8
SHA256 271baf68891b775c19ff448ad18177a1dd25956d7a8d6c9a1a04cd454b84f9db
SHA512 50ce310246854d65e902f0d8e586732e2d94d4b9f713edf4be070a2d1de57bd551f885cc5d3df869180aa0d9e0920ca2d474f3919281025340e750249a06fdfe

\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe

MD5 a67fb4171f897930464e5f48ca226432
SHA1 596933d03d071a6653c67e01cc047c934649aba2
SHA256 28038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA512 6ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52

\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe

MD5 a67fb4171f897930464e5f48ca226432
SHA1 596933d03d071a6653c67e01cc047c934649aba2
SHA256 28038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA512 6ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe

MD5 a67fb4171f897930464e5f48ca226432
SHA1 596933d03d071a6653c67e01cc047c934649aba2
SHA256 28038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA512 6ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Gs2nk2Lc.exe

MD5 a67fb4171f897930464e5f48ca226432
SHA1 596933d03d071a6653c67e01cc047c934649aba2
SHA256 28038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA512 6ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52

C:\Users\Admin\AppData\Local\Temp\BC10.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

C:\Users\Admin\AppData\Local\Temp\BC10.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe

MD5 24a8217ddd7bb28c2aabe78e51ae4b7c
SHA1 3a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA256 8a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA512 5a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903

\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe

MD5 24a8217ddd7bb28c2aabe78e51ae4b7c
SHA1 3a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA256 8a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA512 5a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe

MD5 24a8217ddd7bb28c2aabe78e51ae4b7c
SHA1 3a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA256 8a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA512 5a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IN4Tk4cT.exe

MD5 24a8217ddd7bb28c2aabe78e51ae4b7c
SHA1 3a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA256 8a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA512 5a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903

\Users\Admin\AppData\Local\Temp\BC10.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

\Users\Admin\AppData\Local\Temp\BC10.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

\Users\Admin\AppData\Local\Temp\BC10.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe

MD5 852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1 d58b19886548efa210002ff03eb900c336c5d2e2
SHA256 ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512 ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4

\Users\Admin\AppData\Local\Temp\BC10.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe

MD5 852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1 d58b19886548efa210002ff03eb900c336c5d2e2
SHA256 ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512 ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4

\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe

MD5 852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1 d58b19886548efa210002ff03eb900c336c5d2e2
SHA256 ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512 ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\cY6Eg9xY.exe

MD5 852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1 d58b19886548efa210002ff03eb900c336c5d2e2
SHA256 ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512 ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4

C:\Users\Admin\AppData\Local\Temp\BF0D.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe

MD5 7f6112421b9caa7f2b9f690297d3dc26
SHA1 de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256 753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA512 0f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb

\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe

MD5 7f6112421b9caa7f2b9f690297d3dc26
SHA1 de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256 753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA512 0f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe

MD5 7f6112421b9caa7f2b9f690297d3dc26
SHA1 de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256 753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA512 0f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\Ps1dG7Lt.exe

MD5 7f6112421b9caa7f2b9f690297d3dc26
SHA1 de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256 753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA512 0f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb

C:\Users\Admin\AppData\Local\Temp\BF0D.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe

MD5 6de25e4bd7e214f28e993a708dd8a3fe
SHA1 c7dde639c9b312d47acf3ff82a965a321294622b
SHA256 e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA512 93b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7

\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe

MD5 6de25e4bd7e214f28e993a708dd8a3fe
SHA1 c7dde639c9b312d47acf3ff82a965a321294622b
SHA256 e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA512 93b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe

MD5 6de25e4bd7e214f28e993a708dd8a3fe
SHA1 c7dde639c9b312d47acf3ff82a965a321294622b
SHA256 e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA512 93b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\IM2ly51.exe

MD5 6de25e4bd7e214f28e993a708dd8a3fe
SHA1 c7dde639c9b312d47acf3ff82a965a321294622b
SHA256 e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA512 93b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7

C:\Users\Admin\AppData\Local\Temp\C15F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

C:\Users\Admin\AppData\Local\Temp\C15F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

\Users\Admin\AppData\Local\Temp\C15F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

\Users\Admin\AppData\Local\Temp\C15F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

\Users\Admin\AppData\Local\Temp\C15F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

C:\Users\Admin\AppData\Local\Temp\C4E9.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/1740-187-0x00000000010D0000-0x00000000010DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C4E9.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\C4E9.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

\Users\Admin\AppData\Local\Temp\C15F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

memory/1740-189-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

C:\Users\Admin\AppData\Local\Temp\IXP008.TMP\Jn21gx.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

C:\Users\Admin\AppData\Local\Temp\IXP007.TMP\LI279Qb.exe

MD5 30dd294af58c1b8e5b95055f90755d5a
SHA1 84dfdbaf07fc2803450a3857e81128c86da01aaf
SHA256 8bdbc5b417eb2e0931735842f6e9d656704e36e37ae15c84ad5f36f2e8170ad2
SHA512 9b0010115567db9c019c32d02809fd72d631b50efedba77a333dbdb65ffa6a6a56b2130e7bd45db93e283863691206b96ff9ef2babed414dede5995df9f73f29

C:\Users\Admin\AppData\Local\Temp\CabC9B5.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarCE0E.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1547699099c3e235a439bacb042069cf
SHA1 23ddd757517d42d9c356114785d31b0e9ff39084
SHA256 90827de84894eff7428677113dd1b4923b7b67bdc3185553bc78d0221c04c097
SHA512 8e7db10d8d0414ab2c6630bbf0d9f956c6347865229307b7876addfe0531d1030c95b9633cb581ddd2b7f2819f780395f9974fedfd1aca5fc5dc8d2555b00af0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 97b990d6276f8be5b2d67f7c44d81070
SHA1 c068b7e5a0185333171191129c6dc2dc2c97cd2a
SHA256 6da290868f939901639d9353867bb877ac614510736ce4a9fc585e2b71f0bdc7
SHA512 43b2b013d9fa59802f950cdc2d69ea7dc7b8a32972dd4a8c66df17168ad9a15eb82046126cbb8c71735c66a70ef4b9a238ef315689d5fdd22803257296ea5f45

C:\Users\Admin\AppData\Local\Temp\ss41.exe

MD5 83330cf6e88ad32365183f31b1fd3bda
SHA1 1c5b47be2b8713746de64b39390636a81626d264
SHA256 7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512 e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

memory/336-351-0x00000000FFFC0000-0x000000010002A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 528b5dc5ede359f683b73a684b9c19f6
SHA1 8bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA256 3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA512 87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

memory/560-370-0x0000000000220000-0x0000000000229000-memory.dmp

memory/2276-372-0x00000000041F0000-0x00000000045E8000-memory.dmp

memory/2416-371-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2416-369-0x0000000000400000-0x0000000000409000-memory.dmp

memory/560-368-0x0000000002770000-0x0000000002870000-memory.dmp

memory/2276-373-0x00000000041F0000-0x00000000045E8000-memory.dmp

memory/2416-366-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 7ea584dc49967de03bebdacec829b18d
SHA1 3d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA256 79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512 ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

memory/2276-376-0x00000000045F0000-0x0000000004EDB000-memory.dmp

memory/1740-379-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XQ8ZHSDO\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

memory/1740-513-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

memory/1600-523-0x0000000001030000-0x00000000011A4000-memory.dmp

memory/1224-533-0x0000000002AD0000-0x0000000002AE6000-memory.dmp

memory/2416-534-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1600-541-0x0000000070380000-0x0000000070A6E000-memory.dmp

memory/2060-542-0x0000000000D00000-0x0000000000EBD000-memory.dmp

memory/1244-544-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1244-543-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1244-548-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2276-550-0x0000000000400000-0x000000000298D000-memory.dmp

memory/2060-552-0x0000000000D00000-0x0000000000EBD000-memory.dmp

memory/1244-551-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1244-553-0x0000000000400000-0x0000000000430000-memory.dmp

memory/1244-563-0x0000000070380000-0x0000000070A6E000-memory.dmp

memory/1244-572-0x0000000000440000-0x0000000000446000-memory.dmp

memory/560-678-0x0000000002770000-0x0000000002870000-memory.dmp

memory/3040-680-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 66260afe58f13a06656086e51a3c8986
SHA1 be327a5ab26564e694feed941dddf9d79b88db07
SHA256 a8ce78ff1429666b2cf8be487fa95990630c389c3e4b925f0bf62b98a2c7b0a9
SHA512 ffba1783ed02c4e524059b0b672a9da893d4bb7669a4c5fc10123b8c59383d3d92a106058d158177e56a14081480397cb4bac84fc40959af3580a30a69a00514

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7925a882addb4810e643a6e97ed6e33a
SHA1 066a6d3aae3786dca0a2dc24dec3a45a1873dfc5
SHA256 56ce49a6c0ea760a2ae595e3c113c9073dd8b36c11e057f9f61c69617232a4ec
SHA512 4f16e39e365834366417400c3673b19386dab20000ef572254e832423502b376f2a7fb3db8f2abc66515e7ef294d6fe73fe23bdd9b6bcd9911b3f7d5ec2dc566

memory/1600-726-0x0000000070380000-0x0000000070A6E000-memory.dmp

memory/348-725-0x00000000009F0000-0x00000000009F8000-memory.dmp

memory/2276-727-0x0000000000400000-0x000000000298D000-memory.dmp

memory/348-749-0x000007FEF5330000-0x000007FEF5D1C000-memory.dmp

C:\Program Files (x86)\PA Previewer\previewer.exe

MD5 27b85a95804a760da4dbee7ca800c9b4
SHA1 f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256 f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512 e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

memory/2276-752-0x00000000045F0000-0x0000000004EDB000-memory.dmp

memory/1756-753-0x0000000003810000-0x0000000003A01000-memory.dmp

memory/1928-754-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/1928-755-0x0000000000AB0000-0x0000000000CA1000-memory.dmp

memory/1928-757-0x0000000000AB0000-0x0000000000CA1000-memory.dmp

memory/348-756-0x0000000000410000-0x0000000000490000-memory.dmp

memory/2276-760-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afaf81fffcecc8ef49f9cec3669c7c30
SHA1 050c614037a5404510a04bd906e79cfb8a098430
SHA256 6f2649b4313937ac133b3f43b83836085b59b06f72d9164d7e599bb76846720f
SHA512 a3aca5702356b12c9b52579e8983e105d2d860d5f9754cea30f1ff41340e03f252d6d40013159ad556cbf52d5f55313497f6e69a0f2e7a7668e71ac63a7e1e8f

memory/1928-807-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/1928-810-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/1928-809-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/1244-811-0x0000000070380000-0x0000000070A6E000-memory.dmp

memory/2864-812-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/2864-813-0x0000000000BB0000-0x0000000000DA1000-memory.dmp

memory/3040-814-0x0000000000400000-0x0000000000413000-memory.dmp

memory/1244-815-0x0000000000660000-0x00000000006A0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 648026b318624c1ad8e61a6c95d0f299
SHA1 293369c6d5fcef7681c8cd16a532bd5dbd9eebd2
SHA256 cbcec5a6593f7b1e03bbf823837f9c8554751e042592973eb592852ef87ede28
SHA512 7848b74b8b4c81efc04eadefa23505d93633d0cfc9bee998abf9a4ed3ee19f04664a81fd569a0ff96d44cdb8f72af6d3758992fa561ec835abad9eb1bb9eb854

memory/2276-850-0x0000000000400000-0x000000000298D000-memory.dmp

memory/1756-853-0x0000000000400000-0x00000000004B0000-memory.dmp

memory/336-855-0x0000000003440000-0x00000000035B1000-memory.dmp

memory/336-858-0x00000000035C0000-0x00000000036F1000-memory.dmp

memory/348-878-0x000007FEF5330000-0x000007FEF5D1C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f38a2e328f8866fe9eb59b8801969e34
SHA1 8acc8e814247d5d100dbaff59f867cee3776c4c2
SHA256 fd1550cff0908722f8392997317c46e07ef7468976b92127bac10f36cb925b0e
SHA512 fa16dc81536d49839ddb00c5b99390ccd8b1df689c20d3901124772418e6b62c29c114030efa1a0520ae267c3275626aa530b3d70987fea9ff038b8e54001280

memory/1756-895-0x0000000003810000-0x0000000003A01000-memory.dmp

memory/348-896-0x0000000000410000-0x0000000000490000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25649c2b540a25f619d841835ae3e8ed
SHA1 63104441eb09f40d2289582670338a7c57aba3f3
SHA256 cb3ef88b5391daf5f818ebc4495b141a19a41663de130a337b775ac09a0b0ec2
SHA512 96a689f2e1695cd3c7ee31415ede70675c0af5a19ff4e023c62c1e223c8fb929ff801b5a7882c561f1687eb0fb5350a44775857a98657b11cc7801fd3a9f9767

memory/2864-934-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/1756-939-0x0000000003810000-0x0000000003A01000-memory.dmp

memory/2864-940-0x0000000000BB0000-0x0000000000DA1000-memory.dmp

memory/2276-959-0x0000000000400000-0x000000000298D000-memory.dmp

memory/1244-961-0x0000000000660000-0x00000000006A0000-memory.dmp

memory/336-966-0x00000000035C0000-0x00000000036F1000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 730240f7dccbaee54e37719ecd337f93
SHA1 9fc83dae0511b74ec836868ca605978360590d86
SHA256 e464c260a39927bb50b3f36e99c7ef1c2b627ffc30f5009cbf8c6420d259d43f
SHA512 b0d3cc46430ac94bbc141dc3fe7665b64c4f3f33250ad8d7878797a944f80c9af7c2eef7e75e304bb395f72992e392b1482805a2ca17fdd575d9c1856c0846ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 72162aa44da076c92421b1f3c5286b94
SHA1 d65a1bf94ec49aeaae96bc4e524654f9cead8b81
SHA256 9bf080aac5447c44d2f9908aa6e055a94932e49be2ec9f69655722583610835c
SHA512 f56fc668bc5b20349621eccb0238a2645d546414ed4271c8c0a663de4c70ae84a876534bf67ccef3ef88c0b9371585abcc2c0980c6678d0f115f371856d70d95

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e493c75b6d420a47339e7566455d8461
SHA1 1864c6a4ab12adf153ca164e30dd14247f8b698a
SHA256 c2fde9d06716ebd26795223bc9e8f007689ea4323c35d7c58e5d2aecde4a61ab
SHA512 5ef5fc9e9eb11025423c296d69ae70512cb119e7ec9e45b8d762641e6697117554e594d9deff1f1f5d6f35d309db4e8ebc4a854177c1634c27148ab7166844df

memory/2276-1152-0x0000000000400000-0x000000000298D000-memory.dmp

memory/1756-1154-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/2864-1177-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/2488-1178-0x0000000004320000-0x0000000004718000-memory.dmp

memory/2488-1180-0x0000000004320000-0x0000000004718000-memory.dmp

memory/2276-1179-0x0000000000400000-0x000000000298D000-memory.dmp

memory/2488-1181-0x0000000000400000-0x000000000298D000-memory.dmp

memory/1244-1184-0x0000000070380000-0x0000000070A6E000-memory.dmp

memory/2864-1186-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/2488-1191-0x0000000000400000-0x000000000298D000-memory.dmp

memory/2052-1192-0x0000000004430000-0x0000000004828000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 930c4941e976d8d266d6efcca1db7e74
SHA1 5dc348ab9c83026107c745e97f6c25565824616b
SHA256 f713e28a7bcb57ae2f0cf153896e97bede2732fc42f173d821e488eeab2d0681
SHA512 a6ccb0a9f92b69d2b6750de8bf214d7071bada76eb1683568067b562c519c159e33af60f431a532def715b6b9dccb511cd9efe893c7443e1a1e9134e3d206188

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c346193e539a66bbcf10402d8ff33eaf
SHA1 a90c1a553767f8486761e75d07a423669cba4009
SHA256 20e7853367c1703625d1388c574d4bdbb7c15ecf50aaf4b3423ccbd2e4635fd7
SHA512 6fed1d6d99887c9e3fc96c44a0d3cb443f779578d88ec430f484d87fab9a08b7df339437bb642dfe389aa46f85d862d673eea6e46b254a84b26fef7d4b33011b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f135544d113852f1dd98840afdc6dda3
SHA1 b0fb996ad1cd392bc58309ee0cceacba14bb8c3f
SHA256 9998c54734bbc02f2c1560ded4360dba9b0fac10c53b7e6f1b3825c4f32d0014
SHA512 e44dc67331f06339ecb8af73eaade09e9fa4ebdfc393bda1488d815973a8b187b087ceb8e99b529f8b2bbd6ffa4a733c9a653eb7aca555caf3f3275bac7c7913

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 bbd1b8e36aac5d912338a8bb8cb7ac99
SHA1 78c5b61ddb4724dc3d4162422d797c236fdbb63a
SHA256 c1c89f053300fe0dd8f316d49df6b4b1f45998f52f7084efc8ec96c4283d30d7
SHA512 9ea3c8ac17f00f0e4744c34830fb19d69cc5fe25fa9bf70b2267aff6c8aeaf297ae236ab58eee8ef67dbe714a46c25584d6a38d6ad877befa3edc1da9d3d6e71

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7d35d01731c3df3a044d8501b895a78f
SHA1 4ee29835660d816dd9e2f42f199faf2acb6cc314
SHA256 52a23275e2826447a018ca25ca038335106f8849a401432f5db9aaa1db00c405
SHA512 7f7dfa5f1f8f8753a7620bfa6fd3f1e68816dd7a30e4309c68a8d7a363336432761c8ca48d9fe0db89202e23ed9f263f7d9fb2de6a029eb6567eceff31433a9f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 85c67e18bddf1e744463b8fb8c4bbf38
SHA1 36839d5f602f50019f13bde77705af7fdcd54f11
SHA256 ed1875f9e95908115475b4384c24bc655719c29bcde34278db92dfead6046ea5
SHA512 c197ec3c5fd9bbd23fd38290f1da1b47b6073f48c84278a43a68f55828ae371f627b94f524c7651696a00e93760601a05640c43740a384df9906a915755ebff6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 64fb5291a1abd2f210f4c33ef288f004
SHA1 ca7a655a9668ee4dd7abd1cc9c335e9ebc186f22
SHA256 3065f2b36ab25925f434e558b666bdbad4f4a063cf696fd49e822aa4dff3faea
SHA512 6914801a26e135d6675c30a6272fa15c72f05597aeb68c425fc40da49d7b7211e5493e8056d9f73fc8f3f915510762c07761686008eaac2f48fbc67412a9a256

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bd138e970fc2e4155ec2d4df4ddd77f8
SHA1 662db856fa8860ae40f1b3601bcea447c66d68ac
SHA256 a52eaa5c8f67ebc54b3184ac5c8621bc72bef011c5519469b991c5a7395ea64f
SHA512 5d4f2cccad7155a6b78dd92da5ca591a1682cbd8538ed575b3c69982e00690ce976d430e0a542e8eab9e73a2b287f0bcc06c0fffb4bc6f28bd546f663f75a9a9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0229908ae0a25a7985a66a96afd248e3
SHA1 d9ee19a510cc4d5fd4230a1da5c38bdc97220079
SHA256 adc77a3a9c15fca7dd2e38dd31794f3e428718b5ba8dc533c473973bd25bb42b
SHA512 ada9f0a641ab56fd2e3b6a96ca601ab6c1e6ce7a332bfd3da4c9e07b7837d975d02a0b3765c6176a70ddc11c0a4b1b63723a8a099932756807a070a1c4ba7291

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9f1e887caa6414b20413ab1830330821
SHA1 df5d62c6fc19cc95f6543fb759a783d7f3ee3ef4
SHA256 677c45da8796a5ebd0d93e3d8f7fcb0f814daa5252e73ee6066ea32ca066297a
SHA512 bb9588c35bacf3ef833fc28d8c6d994c6752d362397804541a59a8493ab54f1b46ee8242f4fb5a971f3a098413e056c7bace7112e5605882a7750601168c8301

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B9T67D7I\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

MD5 1afff8d5352aecef2ecd47ffa02d7f7d
SHA1 8b115b84efdb3a1b87f750d35822b2609e665bef
SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512 e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-02 07:28

Reported

2023-10-02 07:30

Platform

win10v2004-20230915-en

Max time kernel

62s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\254A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\254A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\254A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\254A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\254A.exe N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4075.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1E80.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1FA9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IM2ly51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\243F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\254A.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\277D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LI279Qb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Lj226Mc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4075.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4B34.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4FD9.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\254A.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1E80.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-LKJQN.tmp C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-M2DPI.tmp C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-V8UBU.tmp C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-RH315.tmp C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\254A.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3400 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 3400 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 3400 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe
PID 3708 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 3708 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 3708 wrote to memory of 3988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe
PID 3988 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 3988 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 3988 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe
PID 3948 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 3948 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe
PID 3948 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 3948 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 3948 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe
PID 3476 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3476 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3476 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3476 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3476 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3476 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3988 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe
PID 3988 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe
PID 3988 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe
PID 4492 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4492 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3708 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe
PID 3708 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe
PID 3708 wrote to memory of 4896 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4896 wrote to memory of 3164 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3400 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe
PID 3400 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe
PID 3400 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe
PID 2368 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe C:\Windows\system32\cmd.exe
PID 2368 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe C:\Windows\system32\cmd.exe
PID 4652 wrote to memory of 4904 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4652 wrote to memory of 4904 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4652 wrote to memory of 4856 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4652 wrote to memory of 4856 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4904 wrote to memory of 2552 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4904 wrote to memory of 2552 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4856 wrote to memory of 4892 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4856 wrote to memory of 4892 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4856 wrote to memory of 2140 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4856 wrote to memory of 2140 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4856 wrote to memory of 2140 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4856 wrote to memory of 2140 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3476 -ip 3476

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 592

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4492 -ip 4492

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1472 -ip 1472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4896 -ip 4896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 156

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\CE4C.tmp\CE4D.tmp\CE4E.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffcd46946f8,0x7ffcd4694708,0x7ffcd4694718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x174,0x178,0x17c,0x150,0x180,0x7ffcd46946f8,0x7ffcd4694708,0x7ffcd4694718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,2400787646775097580,9822134710294118223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,2400787646775097580,9822134710294118223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1E80.exe

C:\Users\Admin\AppData\Local\Temp\1E80.exe

C:\Users\Admin\AppData\Local\Temp\1FA9.exe

C:\Users\Admin\AppData\Local\Temp\1FA9.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2102.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IM2ly51.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IM2ly51.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exe

C:\Users\Admin\AppData\Local\Temp\243F.exe

C:\Users\Admin\AppData\Local\Temp\243F.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1836 -ip 1836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 280

C:\Users\Admin\AppData\Local\Temp\254A.exe

C:\Users\Admin\AppData\Local\Temp\254A.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exe

C:\Users\Admin\AppData\Local\Temp\277D.exe

C:\Users\Admin\AppData\Local\Temp\277D.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4108 -ip 4108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 404

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LI279Qb.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LI279Qb.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd46946f8,0x7ffcd4694708,0x7ffcd4694718

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5504 -ip 5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd46946f8,0x7ffcd4694708,0x7ffcd4694718

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 140

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Lj226Mc.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Lj226Mc.exe

C:\Users\Admin\AppData\Local\Temp\4075.exe

C:\Users\Admin\AppData\Local\Temp\4075.exe

C:\Users\Admin\AppData\Local\Temp\ss41.exe

"C:\Users\Admin\AppData\Local\Temp\ss41.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\kos1.exe

"C:\Users\Admin\AppData\Local\Temp\kos1.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\4B34.exe

C:\Users\Admin\AppData\Local\Temp\4B34.exe

C:\Users\Admin\AppData\Local\Temp\set16.exe

"C:\Users\Admin\AppData\Local\Temp\set16.exe"

C:\Users\Admin\AppData\Local\Temp\kos.exe

"C:\Users\Admin\AppData\Local\Temp\kos.exe"

C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp

"C:\Users\Admin\AppData\Local\Temp\is-C17N1.tmp\is-EAC3S.tmp" /SL4 $E0200 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224

C:\Users\Admin\AppData\Local\Temp\4FD9.exe

C:\Users\Admin\AppData\Local\Temp\4FD9.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 8

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -i

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -s

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6016209968791966494,7288063149863621283,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Roaming\jubvihw

C:\Users\Admin\AppData\Roaming\jubvihw

C:\Users\Admin\AppData\Roaming\cdbvihw

C:\Users\Admin\AppData\Roaming\cdbvihw

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
NL 104.85.1.163:80 www.microsoft.com tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 163.1.85.104.in-addr.arpa udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 15.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 z.nnnaajjjgc.com udp
MU 156.236.72.121:443 z.nnnaajjjgc.com tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 121.72.236.156.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
MD 176.123.4.46:33783 tcp
US 8.8.8.8:53 46.4.123.176.in-addr.arpa udp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 app.nnnaajjjgc.com udp
HK 154.221.26.108:80 app.nnnaajjjgc.com tcp
US 8.8.8.8:53 108.26.221.154.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

MD5 61841312daa6742993b4126d3ae4f167
SHA1 233d112a31030e6c3093af86d0f461d15fd9c341
SHA256 851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512 b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ay6lL22.exe

MD5 61841312daa6742993b4126d3ae4f167
SHA1 233d112a31030e6c3093af86d0f461d15fd9c341
SHA256 851fcac47381d066915761750df5ccf83d493c597fc60ec9dcf65bba16e0c806
SHA512 b261afce2247b3e5aeb49f4956dddb6204adf370be5b57fe4f33e8e3b3c054aad1713c8ef6829d2bed08953d14fc89720f1d2f69d0ce924788a8ece67206a38f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

MD5 b706493ed4d8b02a37d591adb06d73d9
SHA1 cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256 344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA512 7f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Ry5ac36.exe

MD5 b706493ed4d8b02a37d591adb06d73d9
SHA1 cb9dcff12282d4699784d4e4f72809cc4dabab03
SHA256 344d6421de7f538849e61df2abc739f19d09dbc3807c26e0d0ec2a4a2d5153ce
SHA512 7f7061fda4ae4a460d08a2182a1abdf40f4f5c26684d63b5b22055859be16163070665f66d0f9895549fddf12607b2b06008d229dc6b79eda1d8023286a8ee71

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

MD5 5af6cda954aedb3576dfefc7a4fb7867
SHA1 8727aa8ee58833ea241d484cd5931339bd2e9adb
SHA256 9f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA512 6cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sr4xY60.exe

MD5 5af6cda954aedb3576dfefc7a4fb7867
SHA1 8727aa8ee58833ea241d484cd5931339bd2e9adb
SHA256 9f77e2c85eefacf19de48d05416a98ab2c5544e8481e4bb851e4a92705d3b75c
SHA512 6cdd491eaf37a9ff178232bd3fdddeaf7c93c095a515fa6da94b85596d18f76f7eadf5b9873422694d3d2476f41de6b8e2a0ba4e314b62eb16036ed133091790

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

MD5 d0ca53edd2573f99ec6b54e391860a7e
SHA1 3f0dd462e293e2bb7bf12c79b1ac32ec00c774e7
SHA256 3939112be72ceafe74305a47754cb2e48b3ebce12068a8fa6d549180ab234f19
SHA512 74d07cdd3c95de593c15e925a6cf38be06b6b14dc47feeedb207b3a0fc69d563f4e5c046c05679331e3d9762197c32432b15f859e4e9ad795c0e3d4c6726b6d0

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\0004180.exe

MD5 d0ca53edd2573f99ec6b54e391860a7e
SHA1 3f0dd462e293e2bb7bf12c79b1ac32ec00c774e7
SHA256 3939112be72ceafe74305a47754cb2e48b3ebce12068a8fa6d549180ab234f19
SHA512 74d07cdd3c95de593c15e925a6cf38be06b6b14dc47feeedb207b3a0fc69d563f4e5c046c05679331e3d9762197c32432b15f859e4e9ad795c0e3d4c6726b6d0

memory/1912-28-0x00000000009E0000-0x00000000009EA000-memory.dmp

memory/1912-29-0x00007FFCD2FC0000-0x00007FFCD3A81000-memory.dmp

memory/1912-31-0x00007FFCD2FC0000-0x00007FFCD3A81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\8620214.exe

MD5 5eb083e864de9176aef7782341c8f7cd
SHA1 83ac8880ce41c4ca35cba91a5ccc6d14d0e90d13
SHA256 27096dae0858172c7f4a562e55a10e0e1630ac050b6b7ee160c7541461d74f4b
SHA512 e285590fa81b66b9cc7f8ff1804ace3803659b89e5f68b6edfbd793977838f0a5d9b83ddd29c1991832218bbd2fece24b307f696c26bb5e419fd36307619957e

memory/3912-35-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3912-36-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe

MD5 834d615f463f293bce13357a6dc509ae
SHA1 0abb45ba1d8e9a7d858db3dfac4c7097551b0b77
SHA256 6dcea16ada6ebb3e334ee94ed52d85e139ca06496de1e6b8da320a9f1b762e25
SHA512 1a49d0de326004b8e66484c7b034781605ae3946402b15f382e6c1150ae5f96b6130b3e5f163072a032b96223ac37b945c0e3d76693f1af21392f39ceb656c74

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Hq80FT3.exe

MD5 834d615f463f293bce13357a6dc509ae
SHA1 0abb45ba1d8e9a7d858db3dfac4c7097551b0b77
SHA256 6dcea16ada6ebb3e334ee94ed52d85e139ca06496de1e6b8da320a9f1b762e25
SHA512 1a49d0de326004b8e66484c7b034781605ae3946402b15f382e6c1150ae5f96b6130b3e5f163072a032b96223ac37b945c0e3d76693f1af21392f39ceb656c74

memory/1472-40-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1472-41-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1472-42-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1472-44-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe

MD5 fac2a62a7ac2bdb7ca84bd505d29a72e
SHA1 a35e400030ff0d25096e347916d053ad6f74b9e3
SHA256 d70c1d81046d4de5bd5077d6eda5561ac862da802aff5383bbf909661a7b8cef
SHA512 dcbb5ba644ab0b1ecea20e250c37547eb1f511e87333f917eacab43b2a851c64e1b45c4833739924f3ae8f4c6ea7a75f8ed889c059c8178520c1df665fe99bf5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yx387MX.exe

MD5 fac2a62a7ac2bdb7ca84bd505d29a72e
SHA1 a35e400030ff0d25096e347916d053ad6f74b9e3
SHA256 d70c1d81046d4de5bd5077d6eda5561ac862da802aff5383bbf909661a7b8cef
SHA512 dcbb5ba644ab0b1ecea20e250c37547eb1f511e87333f917eacab43b2a851c64e1b45c4833739924f3ae8f4c6ea7a75f8ed889c059c8178520c1df665fe99bf5

memory/3164-48-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3164-49-0x0000000074150000-0x0000000074900000-memory.dmp

memory/3164-50-0x0000000007A50000-0x0000000007FF4000-memory.dmp

memory/3164-51-0x0000000007540000-0x00000000075D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe

MD5 74382ae3fbf697a0e1a7148a3a73f2b9
SHA1 49ca121aca985e9d57d9806106c6bc8c19bfc6cf
SHA256 bbaaf3ebdf3226d835973f3f58d8e9471f27bfb1976b4d11ed8ef216bff59bdf
SHA512 13ac5423e4c41e46de440827f58f812d4013af8f5768f40116b2da5c7ded0ef58096410dd58a49115d729f0bdb63ad72d073ccb861889fe6cefd1537c9f014ba

memory/3164-54-0x00000000050F0000-0x0000000005100000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zIR4cS5.exe

MD5 74382ae3fbf697a0e1a7148a3a73f2b9
SHA1 49ca121aca985e9d57d9806106c6bc8c19bfc6cf
SHA256 bbaaf3ebdf3226d835973f3f58d8e9471f27bfb1976b4d11ed8ef216bff59bdf
SHA512 13ac5423e4c41e46de440827f58f812d4013af8f5768f40116b2da5c7ded0ef58096410dd58a49115d729f0bdb63ad72d073ccb861889fe6cefd1537c9f014ba

memory/3164-57-0x0000000007700000-0x000000000770A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CE4C.tmp\CE4D.tmp\CE4E.bat

MD5 5a115a88ca30a9f57fdbb545490c2043
SHA1 67e90f37fc4c1ada2745052c612818588a5595f4
SHA256 52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA512 17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

memory/3164-59-0x0000000008620000-0x0000000008C38000-memory.dmp

memory/3164-60-0x00000000078A0000-0x00000000079AA000-memory.dmp

memory/3164-61-0x00000000077D0000-0x00000000077E2000-memory.dmp

memory/3164-62-0x0000000007830000-0x000000000786C000-memory.dmp

memory/3164-63-0x00000000079B0000-0x00000000079FC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6351be8b63227413881e5dfb033459cc
SHA1 f24489be1e693dc22d6aac7edd692833c623d502
SHA256 e24cda01850900bdb3a4ae5f590a76565664d7689026c146eb96bcd197dac88b
SHA512 66e249488a2f9aa020834f3deca7e4662574dcab0cbb684f21f295f46d71b11f9494b075288189d9df29e4f3414d4b86c27bf8823005d400a5946d7b477f0aef

memory/3204-67-0x0000000003160000-0x0000000003176000-memory.dmp

memory/3912-70-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

\??\pipe\LOCAL\crashpad_4856_CJFOLURXIRJPGLWK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_4904_AQVNWOMWUZYVCAJJ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d63bad5620ed5fde97279c0794005ab5
SHA1 e06f1830800a31ff3d863940d4423001f1847f69
SHA256 1f308881ee629e63f09f9d58cee6e8b8e5ad71773a751c9f205220aa5e8f97d3
SHA512 2d60bbadad1c82443b4b3768c1a6cfbf6f747db24da019639decde73b6958498fa1b6c96fbefa72c8b071e9a5234777bec9ea7f955dc22f8488af6384ba3c9aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 91c264af3ff675801e245d722da3308c
SHA1 71b7dbcf1d84bf9ebed571b25b4ee13d0e32d77c
SHA256 629903d0800b3fb73d61a81d2b91a99b2d3dda88924e8d1e11bc16fde9428a2d
SHA512 99d72f88a90a478993c6c7fe68ffdd4c8afa1583e09c4dfdda63cabd0524e25df7f437901c36604a3fafc7a8e431695da6c8b294fc0d64371dfe6f674b5c2e81

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/3164-220-0x0000000074150000-0x0000000074900000-memory.dmp

memory/3164-225-0x00000000050F0000-0x0000000005100000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d63bad5620ed5fde97279c0794005ab5
SHA1 e06f1830800a31ff3d863940d4423001f1847f69
SHA256 1f308881ee629e63f09f9d58cee6e8b8e5ad71773a751c9f205220aa5e8f97d3
SHA512 2d60bbadad1c82443b4b3768c1a6cfbf6f747db24da019639decde73b6958498fa1b6c96fbefa72c8b071e9a5234777bec9ea7f955dc22f8488af6384ba3c9aa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7da7274dbd5899944a12d66c4937a5a4
SHA1 196a7507b3082b37faac24f5f1fecacacd72a625
SHA256 6828f6dcdac819bb813e66d8c7cd60d3a4637d3ec2423eb5ca9ac0fff69b5961
SHA512 55ccac9a2fd5dd66e60f627e6840738d0370a1fd846196860830cb11628f7b916be934ff172ac63578ec8734b5060e96388b583b8cb434d2c177c356d6a28a57

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 18d281d09da4274aa5f67616f06e4700
SHA1 df75fc4b75854b91db8f411666228a67c266d7e0
SHA256 e40129fd44e11af7db394a725878b4eecf6af4f5aef7662501996d5fdcc492b6
SHA512 ecf3b7c1b335e13b634918964dfee6f9b182f44ae84b20e26493c9eb7818db75143c16e631e7f8f39691b00c2158ef8cee98420fcfbd352171dd17dedb34a7d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 699e3636ed7444d9b47772e4446ccfc1
SHA1 db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA256 9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512 d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Temp\1E80.exe

MD5 099b3d4378bb94aa106135ed1fc4d922
SHA1 2f9609032c3aea88a01321ce705a5fcded2a74d8
SHA256 271baf68891b775c19ff448ad18177a1dd25956d7a8d6c9a1a04cd454b84f9db
SHA512 50ce310246854d65e902f0d8e586732e2d94d4b9f713edf4be070a2d1de57bd551f885cc5d3df869180aa0d9e0920ca2d474f3919281025340e750249a06fdfe

C:\Users\Admin\AppData\Local\Temp\1E80.exe

MD5 099b3d4378bb94aa106135ed1fc4d922
SHA1 2f9609032c3aea88a01321ce705a5fcded2a74d8
SHA256 271baf68891b775c19ff448ad18177a1dd25956d7a8d6c9a1a04cd454b84f9db
SHA512 50ce310246854d65e902f0d8e586732e2d94d4b9f713edf4be070a2d1de57bd551f885cc5d3df869180aa0d9e0920ca2d474f3919281025340e750249a06fdfe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zYV35OO.exe

MD5 1cc82a989aa185bc3ec20ac7c0f5b2bd
SHA1 cc9f19e35e75ca0ad8509393c03812a4d4495f6a
SHA256 fd5ca9431ede48010e4043f6d1ec3377584f332bbf4f5040ca2352af5e8834f5
SHA512 12d338e13539b137bd8446d8d4526194296295ff1c55cb6ff943ead716a8334c8ed7c6fad52f64873bc2448b08f3aa692998b994075c0c7466662caa41c26c63

C:\Users\Admin\AppData\Local\Temp\1FA9.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exe

MD5 a67fb4171f897930464e5f48ca226432
SHA1 596933d03d071a6653c67e01cc047c934649aba2
SHA256 28038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA512 6ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gs2nk2Lc.exe

MD5 a67fb4171f897930464e5f48ca226432
SHA1 596933d03d071a6653c67e01cc047c934649aba2
SHA256 28038eb5c01bf791e49727f20826e6fad223d116b70238261696539425719669
SHA512 6ffa5b0a6ff9c514c001dc407c4ca5ba69c5bb9337296387dde3fba167e5b7935885565dab84260e8d2ad380a6dff83e92a0650272563c48bcb38923b09d6c52

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exe

MD5 24a8217ddd7bb28c2aabe78e51ae4b7c
SHA1 3a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA256 8a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA512 5a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903

C:\Users\Admin\AppData\Local\Temp\1FA9.exe

MD5 681a1edcbe145ff2480a0eff775117f0
SHA1 9d3ac177ae0166f168b06711c10495065ac460f5
SHA256 c55d8e4cc82489e37fdef80c7c9438e99d43f877bcdeb0fefa9cd077fdd4ee41
SHA512 4abe92527b95af849140c2fa8c192d0bf14adb1d5ddd5d339d6047b5b8371fa2b8a856490902ba06bf9c6cabae257cadc0be525ea76d6202da020ca698fa23e4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exe

MD5 852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1 d58b19886548efa210002ff03eb900c336c5d2e2
SHA256 ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512 ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cY6Eg9xY.exe

MD5 852c0f3c1b7ce4d69fffd93b5e02a93f
SHA1 d58b19886548efa210002ff03eb900c336c5d2e2
SHA256 ddbfe58547bb89c62e41eb7e04df2db155ae635a410982eccdd03364d72570fa
SHA512 ea9820107653520c862447f51c600094e37c6ef711eb55c071f830d0c559b34cb535099083d03b52efb322bf1426ebdc42c6645e70ccf9c151edf447538a2df4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exe

MD5 7f6112421b9caa7f2b9f690297d3dc26
SHA1 de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256 753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA512 0f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Ps1dG7Lt.exe

MD5 7f6112421b9caa7f2b9f690297d3dc26
SHA1 de8a94e43e7943fef6a2d5e27b87a334fb30fb89
SHA256 753df5549a1e75d223204cf4f8979bbaad9086a0cdf3182cac159550e98f12c0
SHA512 0f8de918907e1ea96c1758c4157ce85ef10039ebdb901f65c7a68cc7696bbf6d1b085d2f650677b9337407cc8409b7fd4b3d224e52d6efb42b234b1df058a1bb

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IM2ly51.exe

MD5 6de25e4bd7e214f28e993a708dd8a3fe
SHA1 c7dde639c9b312d47acf3ff82a965a321294622b
SHA256 e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA512 93b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\IM2ly51.exe

MD5 6de25e4bd7e214f28e993a708dd8a3fe
SHA1 c7dde639c9b312d47acf3ff82a965a321294622b
SHA256 e8e358201efff005592a27f48dcafb7cfe9a12bb2840ce96350eab806ef00003
SHA512 93b3c6b5380c3d4e59c5da69ba7f17d2246e1f9fe8351ca3877bcaf8fe6701dce845f064cb2a2e3a25a0b329d8c665a2fa15933543cae850a220cc3179ac38f7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IN4Tk4cT.exe

MD5 24a8217ddd7bb28c2aabe78e51ae4b7c
SHA1 3a521565cd894883b72b73bdfc2053aa1a60bbf6
SHA256 8a379a26434d4c79d0dd51288fbeb8227f665cdfb02742de105a9b1a7f8f1d7b
SHA512 5a17a45a5e8ac9b0bf76686751fe061482f4b43eb23b2f954b26c49313013ea419921eb46d6e98d84056767e1af72cb105c1cf3bf39c1ab5583c8f325df8a903

C:\Users\Admin\AppData\Local\Temp\2102.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\243F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

memory/2412-307-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2412-309-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2412-308-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\243F.exe

MD5 e807b615389cd0c7d8d2334b0eb6fd86
SHA1 f84e547a8e30c1a31ecf3e0f71f98bd3f246e74f
SHA256 512ac913ac02033f24682c72c5ba10d3d304e9dbfec5ce0f528bd9024851dbcc
SHA512 97814ec9ec09438f6f83d3ac4d6793a4b2338585f5945e90ba3f2faf656a756c99701366b0b9e947269158b8455742ae3e74a91fdda7c8f1f8863e5563045069

C:\Users\Admin\AppData\Local\Temp\254A.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

C:\Users\Admin\AppData\Local\Temp\254A.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\Jn21gx.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

memory/5152-320-0x00007FFCCECA0000-0x00007FFCCF761000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\254A.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\277D.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

C:\Users\Admin\AppData\Local\Temp\277D.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

memory/5336-327-0x0000000074150000-0x0000000074900000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 06e9db049239b88264bb41e6c189c2db
SHA1 6c2028fd438f4a298535ce0a4f1273d5b325e008
SHA256 b221c79a82cf13f8c59431aad31a64d7619b05f76c9b69895afcb425f121c74c
SHA512 a09cccaebb53a6ebf1559ffa151b2893a2ec974b72465c0dd34409df86d20b9a38d3d398ca8789744b5c1007423ec994cf74ba369e2e53d47eaf0330c5bad50d

memory/5336-329-0x00000000077B0000-0x00000000077C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LI279Qb.exe

MD5 30dd294af58c1b8e5b95055f90755d5a
SHA1 84dfdbaf07fc2803450a3857e81128c86da01aaf
SHA256 8bdbc5b417eb2e0931735842f6e9d656704e36e37ae15c84ad5f36f2e8170ad2
SHA512 9b0010115567db9c019c32d02809fd72d631b50efedba77a333dbdb65ffa6a6a56b2130e7bd45db93e283863691206b96ff9ef2babed414dede5995df9f73f29

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\LI279Qb.exe

MD5 30dd294af58c1b8e5b95055f90755d5a
SHA1 84dfdbaf07fc2803450a3857e81128c86da01aaf
SHA256 8bdbc5b417eb2e0931735842f6e9d656704e36e37ae15c84ad5f36f2e8170ad2
SHA512 9b0010115567db9c019c32d02809fd72d631b50efedba77a333dbdb65ffa6a6a56b2130e7bd45db93e283863691206b96ff9ef2babed414dede5995df9f73f29

memory/5128-430-0x0000000074150000-0x0000000074900000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

memory/5128-432-0x0000000007510000-0x0000000007520000-memory.dmp

memory/5772-482-0x0000000000A40000-0x0000000000A7E000-memory.dmp

memory/5772-483-0x0000000074150000-0x0000000074900000-memory.dmp

memory/5152-486-0x00007FFCCECA0000-0x00007FFCCF761000-memory.dmp

memory/5772-487-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ss41.exe

MD5 83330cf6e88ad32365183f31b1fd3bda
SHA1 1c5b47be2b8713746de64b39390636a81626d264
SHA256 7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512 e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 528b5dc5ede359f683b73a684b9c19f6
SHA1 8bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA256 3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA512 87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 7ea584dc49967de03bebdacec829b18d
SHA1 3d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA256 79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512 ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

memory/5836-511-0x00007FF781840000-0x00007FF7818AA000-memory.dmp

memory/5336-523-0x00000000077B0000-0x00000000077C0000-memory.dmp

memory/5900-527-0x0000000002730000-0x0000000002739000-memory.dmp

memory/6140-526-0x0000000000630000-0x00000000007A4000-memory.dmp

memory/5900-524-0x00000000025B0000-0x00000000026B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos1.exe

MD5 85b698363e74ba3c08fc16297ddc284e
SHA1 171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA256 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA512 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

memory/5336-502-0x0000000074150000-0x0000000074900000-memory.dmp

memory/572-528-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6140-530-0x0000000074150000-0x0000000074900000-memory.dmp

memory/6104-531-0x0000000004570000-0x0000000004972000-memory.dmp

memory/572-532-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5128-536-0x0000000074150000-0x0000000074900000-memory.dmp

memory/6104-533-0x0000000004A80000-0x000000000536B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\set16.exe

MD5 22d5269955f256a444bd902847b04a3b
SHA1 41a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256 ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512 d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

memory/5276-545-0x0000000000400000-0x0000000000413000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos.exe

MD5 076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA1 7b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256 d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA512 75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

memory/4280-557-0x0000000000380000-0x0000000000388000-memory.dmp

memory/6140-561-0x0000000074150000-0x0000000074900000-memory.dmp

memory/5152-562-0x00007FFCCECA0000-0x00007FFCCF761000-memory.dmp

memory/6104-560-0x0000000000400000-0x000000000298D000-memory.dmp

memory/1156-580-0x0000000000630000-0x0000000000660000-memory.dmp

memory/4280-576-0x00007FFCCECA0000-0x00007FFCCF761000-memory.dmp

memory/4280-581-0x000000001B010000-0x000000001B020000-memory.dmp

memory/4176-579-0x0000000000710000-0x0000000000711000-memory.dmp

memory/5204-584-0x0000000000C00000-0x0000000000DBD000-memory.dmp

memory/5128-588-0x0000000007510000-0x0000000007520000-memory.dmp

memory/1156-594-0x0000000000B20000-0x0000000000B26000-memory.dmp

memory/5204-595-0x0000000000C00000-0x0000000000DBD000-memory.dmp

memory/5276-590-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5584-603-0x00000000007E0000-0x000000000083A000-memory.dmp

memory/1156-605-0x0000000074150000-0x0000000074900000-memory.dmp

memory/5584-608-0x0000000000400000-0x000000000046A000-memory.dmp

memory/5584-609-0x0000000074150000-0x0000000074900000-memory.dmp

memory/1156-618-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 ec6aae2bb7d8781226ea61adca8f0586
SHA1 d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256 b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512 aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

memory/5772-620-0x0000000074150000-0x0000000074900000-memory.dmp

memory/3204-622-0x00000000033D0000-0x00000000033E6000-memory.dmp

memory/572-624-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5772-628-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6195574c9302ec9d7028ee4eb3ee2dc4
SHA1 36ba1b5db42eb80f277ae26b3792c8dc19e55b6b
SHA256 4c57039bfe50d3468749ad59d13485353b8ae65a868f539daf87fe15131bc639
SHA512 d20421715c980b88cb6544264aacf553454a4be8b89a8d30adc429cd29628c1c92d95de41a9656f209663d43e2bd3885522718f8366ad9a593370bec6d73b99c

memory/6104-641-0x0000000004570000-0x0000000004972000-memory.dmp

memory/3436-642-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/3436-643-0x0000000000400000-0x00000000005F1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8eaa0593fc99c1a10e417a1a99658f3e
SHA1 433c518273dbc77a2224da829e55bb5673521866
SHA256 1bb8ad071b99c5c0b5dd93235750e8e94e15a918e9ea1b215936734231e29ba5
SHA512 cd127424f25038cd9b9309e0c65ea976d600d5850779675f59f142f3076fd3ae85153b3ef71344eca600445ed5a714b0abd885fba29c869d5b11a86d64469e34

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586750.TMP

MD5 f712ca3d6ef1d1726944f39294f98494
SHA1 0c1e282938c05c8f953b5481e0e55404a933d7e2
SHA256 b2c372febfa00aa097003e2acbae97cb4afea94885999d20524c58e346d6d0f6
SHA512 ea16ff213fdf6fbb324c828eb2b1cedbaa2e6b80de320ec62614ed1137657519bcb910a8412be25f9294f3d60b2df10309dbd320c536298ea9af27c4b3d782ae

memory/5584-653-0x0000000008140000-0x00000000081A6000-memory.dmp

memory/3436-655-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/6104-656-0x0000000004A80000-0x000000000536B000-memory.dmp

memory/4280-657-0x00007FFCCECA0000-0x00007FFCCF761000-memory.dmp

memory/6104-658-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5236-659-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/4176-661-0x0000000000710000-0x0000000000711000-memory.dmp

memory/6104-662-0x0000000000400000-0x000000000298D000-memory.dmp

memory/4176-676-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 bca60585f2549d8ff07ca37f4d7a81c2
SHA1 72849899380b7fd225f2552329a61b5e0a1f1906
SHA256 dcb63caefcb7e4200926915f8b154e59303fdb31751a8c63b79e5ba0b4bb1949
SHA512 8e55410b8ebb8254e426d57f4d5ccfbac0f489f5d6abd9a57443150db1b154dcb5300a1e22c3c1d95d1e398f49dba8d79ccd082e3f2f21249fb8a1b92b28940d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d3b8e4755afedb521842558269f69dda
SHA1 98fd63b27f91543f26c0069748e28d23180ac1ca
SHA256 2b96e7ec1945c44dc17a00f7a1d8230a688666b97bb071b5be644428dbd32647
SHA512 b79e7cddf89294b2ad86cf7e9cbdcd8d644196d769be6457ce9ee623b6d5c2321e25c7919b8ed6b04aec7bea1259ce6442ffba2ad5d5d5141fcfa83ae508b7db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c53e98f3913927395569d3411b6c9fae
SHA1 be6c290bee5ca2bf970a79db34399967d22e62f3
SHA256 d977ec2469979e60d4400d4d39fe9f78e3103649ac608f1e7863a5edaf053b46
SHA512 7af2f144f382a17807df30d73aa373abbbb43662d7d13a2e880b10851872e5b9fc49d8f3b870063bc21d4b896a9eff0434d680c76d81d3328d5f86d1c780786f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ee22b8d1fc41303498567d4ba28ddba4
SHA1 d5a6695afe35309eb2dad83ca456421052fc9b1d
SHA256 a8473b7655a05e83903f9d0eaa9fa1acf853d1898feef363d1a53bd7b663bcd5
SHA512 494877855c52ded0c032d4c7e62fbc517795eb441cae5b2ac04083a89a1b92dc8a3f0c2c18d0f5097348aac6cb9bd957284e155095e8f781e12f1bb16481abc4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 0ae288e5115cab46e3b93d828932f4b4
SHA1 fd608616824795f05b5d58b2254e253240a95eaf
SHA256 c9f8fa96dbddb69636b2c4e7a3f0867396c3890282d97c73f8bdae3efa0f0f8a
SHA512 8ec47046724cee6caa2f0156a5cff7637a7d0bb56e03d892ee4124f3d7a67eb2dfd5a32631e717b7ee3cb857029970c0de657bbac7a726c69cbd3aebc48c93c8

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nahobtas.cu2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/6104-842-0x0000000000400000-0x000000000298D000-memory.dmp

memory/6104-896-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5236-908-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/4928-920-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5236-945-0x0000000000400000-0x00000000005F1000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

memory/4928-981-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4