Malware Analysis Report

2025-08-11 02:10

Sample ID 231003-ctbzbsfg3v
Target d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f
SHA256 d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f
Tags
amadey dcrat glupteba healer mystic redline smokeloader @ytlogsbot jordan larek up3 backdoor discovery dropper evasion infostealer loader persistence rat rootkit spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f

Threat Level: Known bad

The file d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer mystic redline smokeloader @ytlogsbot jordan larek up3 backdoor discovery dropper evasion infostealer loader persistence rat rootkit spyware stealer trojan

Amadey

SmokeLoader

Mystic

RedLine payload

Detects Healer an antivirus disabler dropper

Healer

Modifies Windows Defender Real-time Protection settings

Glupteba

RedLine

Glupteba payload

DcRat

Downloads MZ/PE file

Modifies Windows Firewall

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Windows security modification

Loads dropped DLL

Manipulates WinMonFS driver.

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Drops file in System32 directory

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Program crash

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of UnmapMainImage

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Runs net.exe

Checks SCSI registry key(s)

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-03 02:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-03 02:21

Reported

2023-10-03 02:24

Platform

win10v2004-20230915-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1491.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\1491.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\1491.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\1491.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\1491.exe N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2C12.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\kos.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F7C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1038.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13B5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1491.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2C12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ss41.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3143.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\set16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3461.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Program Files (x86)\PA Previewer\previewer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4644.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4644.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\PercentGroupSizes\bvwfdmrdl\IsPublic.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\1491.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\F7C.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\PA Previewer\is-IL5EC.tmp C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-IVDUR.tmp C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-607LE.tmp C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A
File opened for modification C:\Program Files (x86)\PA Previewer\previewer.exe C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A
File created C:\Program Files (x86)\PA Previewer\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A
File created C:\Program Files (x86)\PA Previewer\is-8LJCH.tmp C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1491.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\kos.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4132 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe
PID 4132 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe
PID 4132 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe
PID 4120 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe
PID 4120 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe
PID 4120 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe
PID 1224 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe
PID 1224 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe
PID 1224 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe
PID 4864 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe
PID 4864 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe
PID 4864 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe
PID 4864 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe
PID 4864 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3720 wrote to memory of 960 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1224 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe
PID 1224 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe
PID 1224 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe
PID 4160 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4160 wrote to memory of 1120 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4120 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe
PID 4120 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe
PID 4120 wrote to memory of 1632 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1632 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4132 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe
PID 4132 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe
PID 4132 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe
PID 828 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe C:\Windows\system32\cmd.exe
PID 828 wrote to memory of 376 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe C:\Windows\system32\cmd.exe
PID 376 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 376 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4912 wrote to memory of 3208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4912 wrote to memory of 3208 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 376 wrote to memory of 2760 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 376 wrote to memory of 2760 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 868 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 1300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 1300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 1300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2760 wrote to memory of 1300 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe

"C:\Users\Admin\AppData\Local\Temp\d51025d9d1329afaa23bd71452377672dc61df24f52fa1d50268e363942d042f.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3720 -ip 3720

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 960 -ip 960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 596

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4160 -ip 4160

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 156

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1632 -ip 1632

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 596

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BD83.tmp\BD84.tmp\BD85.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffdaf6a46f8,0x7ffdaf6a4708,0x7ffdaf6a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffdaf6a46f8,0x7ffdaf6a4708,0x7ffdaf6a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,994334542046490581,1895267187621568063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,994334542046490581,1895267187621568063,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\F7C.exe

C:\Users\Admin\AppData\Local\Temp\F7C.exe

C:\Users\Admin\AppData\Local\Temp\1038.exe

C:\Users\Admin\AppData\Local\Temp\1038.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\121E.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\13B5.exe

C:\Users\Admin\AppData\Local\Temp\13B5.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4780 -ip 4780

C:\Users\Admin\AppData\Local\Temp\1491.exe

C:\Users\Admin\AppData\Local\Temp\1491.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 428

C:\Users\Admin\AppData\Local\Temp\1618.exe

C:\Users\Admin\AppData\Local\Temp\1618.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5132 -ip 5132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3752 -ip 3752

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5444 -ip 5444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 600

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdaf6a46f8,0x7ffdaf6a4708,0x7ffdaf6a4718

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffdaf6a46f8,0x7ffdaf6a4708,0x7ffdaf6a4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\2C12.exe

C:\Users\Admin\AppData\Local\Temp\2C12.exe

C:\Users\Admin\AppData\Local\Temp\ss41.exe

"C:\Users\Admin\AppData\Local\Temp\ss41.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\kos1.exe

"C:\Users\Admin\AppData\Local\Temp\kos1.exe"

C:\Users\Admin\AppData\Local\Temp\3143.exe

C:\Users\Admin\AppData\Local\Temp\3143.exe

C:\Users\Admin\AppData\Local\Temp\set16.exe

"C:\Users\Admin\AppData\Local\Temp\set16.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp

"C:\Users\Admin\AppData\Local\Temp\is-RVDSJ.tmp\is-VK7UT.tmp" /SL4 $A0212 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224

C:\Users\Admin\AppData\Local\Temp\kos.exe

"C:\Users\Admin\AppData\Local\Temp\kos.exe"

C:\Users\Admin\AppData\Local\Temp\3461.exe

C:\Users\Admin\AppData\Local\Temp\3461.exe

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -i

C:\Windows\SysWOW64\net.exe

"C:\Windows\system32\net.exe" helpmsg 8

C:\Program Files (x86)\PA Previewer\previewer.exe

"C:\Program Files (x86)\PA Previewer\previewer.exe" -s

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1600 -ip 1600

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 helpmsg 8

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 792

C:\Users\Admin\AppData\Local\Temp\4644.exe

C:\Users\Admin\AppData\Local\Temp\4644.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13392817905272511816,11194576015589324661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\4644.exe

C:\Users\Admin\AppData\Local\Temp\4644.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\PercentGroupSizes\bvwfdmrdl\IsPublic.exe

C:\Users\Admin\AppData\Local\PercentGroupSizes\bvwfdmrdl\IsPublic.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
NL 157.240.201.35:443 fbcdn.net tcp
US 8.8.8.8:53 15.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.78:80 77.91.68.78 tcp
US 8.8.8.8:53 78.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 z.nnnaajjjgc.com udp
MU 156.236.72.121:443 z.nnnaajjjgc.com tcp
US 95.214.25.204:80 95.214.25.204 tcp
US 8.8.8.8:53 121.72.236.156.in-addr.arpa udp
US 8.8.8.8:53 204.25.214.95.in-addr.arpa udp
US 8.8.8.8:53 147.174.42.23.in-addr.arpa udp
NL 89.208.107.31:80 89.208.107.31 tcp
US 8.8.8.8:53 68.121.18.2.in-addr.arpa udp
MD 176.123.4.46:33783 tcp
US 8.8.8.8:53 31.107.208.89.in-addr.arpa udp
US 8.8.8.8:53 46.4.123.176.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 app.nnnaajjjgc.com udp
HK 154.221.26.108:80 app.nnnaajjjgc.com tcp
US 8.8.8.8:53 108.26.221.154.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 a3656bf3-726e-4439-8a89-76c9f91e4fb6.uuid.ramboclub.net udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 server6.ramboclub.net udp
US 8.8.8.8:53 stun.ipfire.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.48:443 server6.ramboclub.net tcp
US 8.8.8.8:53 mastertryprice.com udp
US 172.67.212.103:443 mastertryprice.com tcp
US 8.8.8.8:53 44.27.3.81.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 48.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 103.212.67.172.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 datasheet.fun udp
US 172.67.166.109:80 datasheet.fun tcp
US 8.8.8.8:53 109.166.67.172.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe

MD5 96af9133792dc4e02de159fbda465cf4
SHA1 ad9d9fe5fa7b23c7aed6b636c1601577970de549
SHA256 ea68b70fe518f47c2bb7cb514596839a896ed25d55214fecae506679e3679cd5
SHA512 499d5295e8929ce23787f21d6a7d07f515fccb664c61dd4d95445d985d1a2373ee6deaf187c6cb898dea58db8e507fa41960aea8497e4fd307587cf21963497f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\QI9Qx37.exe

MD5 96af9133792dc4e02de159fbda465cf4
SHA1 ad9d9fe5fa7b23c7aed6b636c1601577970de549
SHA256 ea68b70fe518f47c2bb7cb514596839a896ed25d55214fecae506679e3679cd5
SHA512 499d5295e8929ce23787f21d6a7d07f515fccb664c61dd4d95445d985d1a2373ee6deaf187c6cb898dea58db8e507fa41960aea8497e4fd307587cf21963497f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe

MD5 fc320e1b20590be22d97b7c89c0c2e75
SHA1 85ebbd8b9649b247e2488dfbec023d1cc0e5c751
SHA256 2a87aa174f7c8b50a954e409c01be776313b9f384ad7ba6b28303ec5a0059e12
SHA512 36a673db60ee8c776274e58db7227768bf042b96774aa96848741f8c2b4c9d790bccc9ac18a8123523934ae4acb020c9827946463ea0cceb9c92ad6695c0ae88

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ms6Bx31.exe

MD5 fc320e1b20590be22d97b7c89c0c2e75
SHA1 85ebbd8b9649b247e2488dfbec023d1cc0e5c751
SHA256 2a87aa174f7c8b50a954e409c01be776313b9f384ad7ba6b28303ec5a0059e12
SHA512 36a673db60ee8c776274e58db7227768bf042b96774aa96848741f8c2b4c9d790bccc9ac18a8123523934ae4acb020c9827946463ea0cceb9c92ad6695c0ae88

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe

MD5 43f9412eaa6c70d994fcdd7d51efa67d
SHA1 d6d41c78efd4812a30e079d880cd5705e8f8b62f
SHA256 e10353dc6552cb69bbec2147cf4d4a2568ff7bbef4a034d39372cca7e581201a
SHA512 21c4a480b120489fcff67ede383a639a6457e60f0c356aaf84093ccc16365a68121dc3978c97fd94037a05579eebd5659c8d1f630e0a2f97c9042017bb523c10

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\LF7qB85.exe

MD5 43f9412eaa6c70d994fcdd7d51efa67d
SHA1 d6d41c78efd4812a30e079d880cd5705e8f8b62f
SHA256 e10353dc6552cb69bbec2147cf4d4a2568ff7bbef4a034d39372cca7e581201a
SHA512 21c4a480b120489fcff67ede383a639a6457e60f0c356aaf84093ccc16365a68121dc3978c97fd94037a05579eebd5659c8d1f630e0a2f97c9042017bb523c10

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe

MD5 8d38686fc833ff41fe3eced61d4028e8
SHA1 11116ae4c396f902f1903500b729014157456ff3
SHA256 408c28a92c3ad3ab64abe3f09bb27ee159eb16ae9ddf6bec0fe25946624d3226
SHA512 9110834c975826ccd843d60ee16f799a7134de67037c330bace168e5e5a3f4161aa926ed992f243a6ae65252abdaf75ab23806745dadc4f678fa7bb6ee0c137a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Sk15zV3.exe

MD5 8d38686fc833ff41fe3eced61d4028e8
SHA1 11116ae4c396f902f1903500b729014157456ff3
SHA256 408c28a92c3ad3ab64abe3f09bb27ee159eb16ae9ddf6bec0fe25946624d3226
SHA512 9110834c975826ccd843d60ee16f799a7134de67037c330bace168e5e5a3f4161aa926ed992f243a6ae65252abdaf75ab23806745dadc4f678fa7bb6ee0c137a

memory/448-28-0x00000000003A0000-0x00000000003AA000-memory.dmp

memory/448-29-0x00007FFDADFC0000-0x00007FFDAEA81000-memory.dmp

memory/448-31-0x00007FFDADFC0000-0x00007FFDAEA81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe

MD5 8e7a5cc6a54cc8c2a8b72af2f707a094
SHA1 29ce2edf1a18fa78e76df02329da32da7227e93b
SHA256 a2ee2beb38b0358fb7aad0015f1a296ec1a3206d9219823b53e76d9777180a82
SHA512 ada7de8affde14e9b8e640305b3baaf0cb723a3d93c85c3f5d5ef2e31542822ac9e6b6d88ecc128b848a8e6bf2af90feb44e0cf0643a5c2d37fa143c5f319438

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2RU8189.exe

MD5 8e7a5cc6a54cc8c2a8b72af2f707a094
SHA1 29ce2edf1a18fa78e76df02329da32da7227e93b
SHA256 a2ee2beb38b0358fb7aad0015f1a296ec1a3206d9219823b53e76d9777180a82
SHA512 ada7de8affde14e9b8e640305b3baaf0cb723a3d93c85c3f5d5ef2e31542822ac9e6b6d88ecc128b848a8e6bf2af90feb44e0cf0643a5c2d37fa143c5f319438

memory/960-35-0x0000000000400000-0x0000000000428000-memory.dmp

memory/960-36-0x0000000000400000-0x0000000000428000-memory.dmp

memory/960-37-0x0000000000400000-0x0000000000428000-memory.dmp

memory/960-39-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe

MD5 733f82299ddfa98a1fa8cfea0c410957
SHA1 5d284754150200a7afd33e9da347393621c66a3d
SHA256 e62220c07c2ce48bda11900c634e84aaa49666ef8a0aca725494eb8b5eaa6294
SHA512 4e508482ee30c3f818dc4c4924c1f75567c38c013c8ebddf948d984235218e86ce86d531a75db66e473105337bfeca03c099bdd495e6803d9e945c0488266d9f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3pA35yN.exe

MD5 733f82299ddfa98a1fa8cfea0c410957
SHA1 5d284754150200a7afd33e9da347393621c66a3d
SHA256 e62220c07c2ce48bda11900c634e84aaa49666ef8a0aca725494eb8b5eaa6294
SHA512 4e508482ee30c3f818dc4c4924c1f75567c38c013c8ebddf948d984235218e86ce86d531a75db66e473105337bfeca03c099bdd495e6803d9e945c0488266d9f

memory/1120-43-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1120-44-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe

MD5 0533a3cf5671c21a02704509ecfe5b3f
SHA1 7d06757242c912c23bea042cad74facfc244b8b5
SHA256 c2c29147050fa3429fa43948265c44d03b0fb8dd0e989e9884edb9a566c17b1a
SHA512 7a09f106db430379b9046df58fab1ed42a11b24dbaf5b16886472f6d13807773950fad8ee0bee6e1cc744bbe0aaaf3c6d2706af1a78792a0f19f756b37fc0a38

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4ft934pu.exe

MD5 0533a3cf5671c21a02704509ecfe5b3f
SHA1 7d06757242c912c23bea042cad74facfc244b8b5
SHA256 c2c29147050fa3429fa43948265c44d03b0fb8dd0e989e9884edb9a566c17b1a
SHA512 7a09f106db430379b9046df58fab1ed42a11b24dbaf5b16886472f6d13807773950fad8ee0bee6e1cc744bbe0aaaf3c6d2706af1a78792a0f19f756b37fc0a38

memory/5020-48-0x0000000000400000-0x000000000043E000-memory.dmp

memory/5020-49-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5020-50-0x00000000079C0000-0x0000000007F64000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe

MD5 a1fc3315e60fea9dc70f3c2e61e8005d
SHA1 ca458bf80bba7cf7e38d184cc2847d68c0d5aee2
SHA256 fedbecd82bf34a231d026fa28ac5314c83838ec8141f4e1eb55e252863afd7e1
SHA512 2f01f34628c266348187723f21215473e271c7a71d0f1174c155c85d0459281668a1e744886c653505b77b5856a37d9f23084ebab1b819ed5fc5a3fbbbde6dd8

memory/5020-53-0x00000000074B0000-0x0000000007542000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5WF6ut9.exe

MD5 a1fc3315e60fea9dc70f3c2e61e8005d
SHA1 ca458bf80bba7cf7e38d184cc2847d68c0d5aee2
SHA256 fedbecd82bf34a231d026fa28ac5314c83838ec8141f4e1eb55e252863afd7e1
SHA512 2f01f34628c266348187723f21215473e271c7a71d0f1174c155c85d0459281668a1e744886c653505b77b5856a37d9f23084ebab1b819ed5fc5a3fbbbde6dd8

C:\Users\Admin\AppData\Local\Temp\BD83.tmp\BD84.tmp\BD85.bat

MD5 5a115a88ca30a9f57fdbb545490c2043
SHA1 67e90f37fc4c1ada2745052c612818588a5595f4
SHA256 52c4113e7f308faa933ae6e8ff5d1b955ba62d1edac0eb7c972caa26e1ae4e2d
SHA512 17c399dad7b7343d5b16156e4d83de78ff5755d12add358bd2987ed4216dd13d24cfec9ecdb92d9d6723bb1d20d8874c0bad969dbec69eed95beb7a2817eb4fe

memory/5020-57-0x0000000007620000-0x0000000007630000-memory.dmp

memory/5020-58-0x00000000075B0000-0x00000000075BA000-memory.dmp

memory/5020-59-0x0000000008590000-0x0000000008BA8000-memory.dmp

memory/5020-60-0x0000000007F70000-0x000000000807A000-memory.dmp

memory/5020-61-0x0000000007780000-0x0000000007792000-memory.dmp

memory/5020-62-0x00000000077E0000-0x000000000781C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0987267c265b2de204ac19d29250d6cd
SHA1 247b7b1e917d9ad2aa903a497758ae75ae145692
SHA256 474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264
SHA512 3b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5

memory/5020-66-0x0000000007830000-0x000000000787C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

\??\pipe\LOCAL\crashpad_2760_RBEZLYDYIGSYFTKA

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

\??\pipe\LOCAL\crashpad_4912_VKMQSEWFMNBJUQQG

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 26836db1765b4aac2e6540ac732dddb5
SHA1 f0e3b50c7b239245909d8db9311c9a408b199ba2
SHA256 d42b37ba3a164609c1462a8cf0a2a805aab2e4fcce843b07cd9326e58b6c0986
SHA512 22bf5f9e3d8b514b8b4fd5936963560bcccaff23671692896b59bf0c719d9236596ab1c4b6c5b5a024d176003b5f04e4a22eb73b96f7b114c208eb894dd21280

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 87a75ef3b9dadaf626d2ffc82485f4ab
SHA1 b1c6406bc464efafe2fb8c3d6b8e3b16aa94744b
SHA256 4b24b2bfa1cea087d7836378f9dd9de9b5d42e56cf42658d5532c07e1ec596f5
SHA512 5de190d270c394ebbc3ff68542edc49ec07d4fc05485eb38f78f80104c0a5dc3ec6d599c17eaa24318b11b1a1dde07f8fc69f734bd6430bbea124589c61dc9d1

memory/3224-123-0x0000000002730000-0x0000000002746000-memory.dmp

memory/1120-125-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/5020-217-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5020-223-0x0000000007620000-0x0000000007630000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 26836db1765b4aac2e6540ac732dddb5
SHA1 f0e3b50c7b239245909d8db9311c9a408b199ba2
SHA256 d42b37ba3a164609c1462a8cf0a2a805aab2e4fcce843b07cd9326e58b6c0986
SHA512 22bf5f9e3d8b514b8b4fd5936963560bcccaff23671692896b59bf0c719d9236596ab1c4b6c5b5a024d176003b5f04e4a22eb73b96f7b114c208eb894dd21280

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 734313a836a702c7183f76803b069a4b
SHA1 44c1ef467ba649b0243c7c731c0a91029f9d688e
SHA256 013184949c83bacd23c948e7f1ac6a0b98254619700669a9f81118e4d1957555
SHA512 86ff27a583638147a8d63967d7ad3847a9357f4348e2719080eca726e9ec571d2c6b81e722cd5a5bb40a0a7899170a88d94a3457ff4b3662a26b72468600634f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4c736e6c9c9dd96015a8eec509225e10
SHA1 35055afcc70178274b3f424efca3c9d6119aea09
SHA256 a75328fd8f448a3b2f00992d5fcd0ec6f0f5c076acb26835405d8dcf4880d5dc
SHA512 fa76fbf3b16bafcd4f7c26eac070ec9de18b3e813d0b5196ae7499f5da8d4d0e0c51ff04f4847adfbe570c469b5db34a5f263c20c08eb9718d8709ab5053f6ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 4a078fb8a7c67594a6c2aa724e2ac684
SHA1 92bc5b49985c8588c60f6f85c50a516fae0332f4
SHA256 c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee
SHA512 188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Temp\F7C.exe

MD5 909384c7ef81db1527d9cb6cbd8c8d7d
SHA1 6ab955c83ea48bf53b8f11078112a5b28688c30b
SHA256 ac8001de55e1a4a06142ad8d837f53409472f68bb146557e0fdcfccc7a32423d
SHA512 66be360c9c0895c7d4609f673b2c6822fd45ae1b6c6904e9dd0f5cb69ed4885126392b37d4e035f1f3a16fb2ac61e1d3e0fdc8a4b8cffdd8379fccc7dfe174ed

C:\Users\Admin\AppData\Local\Temp\F7C.exe

MD5 909384c7ef81db1527d9cb6cbd8c8d7d
SHA1 6ab955c83ea48bf53b8f11078112a5b28688c30b
SHA256 ac8001de55e1a4a06142ad8d837f53409472f68bb146557e0fdcfccc7a32423d
SHA512 66be360c9c0895c7d4609f673b2c6822fd45ae1b6c6904e9dd0f5cb69ed4885126392b37d4e035f1f3a16fb2ac61e1d3e0fdc8a4b8cffdd8379fccc7dfe174ed

C:\Users\Admin\AppData\Local\Temp\1038.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6by93GN.exe

MD5 9c46d9382e13e4af151690bc11a1549b
SHA1 9b1f5cff12fe100302c8cb6d5cedc73b98d5ec7d
SHA256 c3c48bea2d57adbd90cfbbdc23927c95834471819fa1bc371779b75b08048e8c
SHA512 07d235969d353629b5e04fcabe88988f4d3cb1938b1c2a14c04013e3d4cdabd8f4a77009eb2d7d100797349b39ea5f23237df72262f4b790bc87615ff132a4cc

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

MD5 a9b08e94fc90554bd84d182c57e2196c
SHA1 e55cdab307dd8d0235b503b3786c7b263b781027
SHA256 6c95645f753aa3e8ae9226e136159062bf46c46e4876e879e87f4d8287d116f4
SHA512 d40e38f189fc9596419009b12b5c911d033e4625a070114bda5214dc0f3c39511737602f21fa123fdbc9a5b3be93a197ac52b2bb8fbe53bd399a7e17f271b5dd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vn8zv7Uh.exe

MD5 a9b08e94fc90554bd84d182c57e2196c
SHA1 e55cdab307dd8d0235b503b3786c7b263b781027
SHA256 6c95645f753aa3e8ae9226e136159062bf46c46e4876e879e87f4d8287d116f4
SHA512 d40e38f189fc9596419009b12b5c911d033e4625a070114bda5214dc0f3c39511737602f21fa123fdbc9a5b3be93a197ac52b2bb8fbe53bd399a7e17f271b5dd

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

MD5 b4f1d87ae6c7a45f3bceadc6737af426
SHA1 f925c6efe9388a3f8699c415e28626b21407c9a0
SHA256 460094d3170a050b32d594c27fdcff23ec94b09852d00c3f61363f414650986c
SHA512 136a0c1989d674acb8e44157de49fb6bfa773723027b27c0a520cee88bdcc8c8d181850525aa9086002453373a03fdfadd7d5b60a81ffe61672078d29ab7c2bd

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\aY2kr8VV.exe

MD5 b4f1d87ae6c7a45f3bceadc6737af426
SHA1 f925c6efe9388a3f8699c415e28626b21407c9a0
SHA256 460094d3170a050b32d594c27fdcff23ec94b09852d00c3f61363f414650986c
SHA512 136a0c1989d674acb8e44157de49fb6bfa773723027b27c0a520cee88bdcc8c8d181850525aa9086002453373a03fdfadd7d5b60a81ffe61672078d29ab7c2bd

C:\Users\Admin\AppData\Local\Temp\1038.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

MD5 9bd55fe1a9594ee2269332cdfd3c35de
SHA1 9bbb7d6d0bd0221e13942820f9fc14cfd5c1a5c6
SHA256 1ddd2c24bedbb000cbbf2033b8ad90f0c003b6043c3ce010f138d6bd89cc76cd
SHA512 e9ffbeab7a76c8e3d499ea0625ce774fb8e8f0dc3844b62352846354a619d8a1ffa659a19b9527e65805e2911a78f9642c29131c7b13590387850185962a4865

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Rz9SE5IY.exe

MD5 9bd55fe1a9594ee2269332cdfd3c35de
SHA1 9bbb7d6d0bd0221e13942820f9fc14cfd5c1a5c6
SHA256 1ddd2c24bedbb000cbbf2033b8ad90f0c003b6043c3ce010f138d6bd89cc76cd
SHA512 e9ffbeab7a76c8e3d499ea0625ce774fb8e8f0dc3844b62352846354a619d8a1ffa659a19b9527e65805e2911a78f9642c29131c7b13590387850185962a4865

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

MD5 79d64b0a10fdc66eddeea9b88b2ecc63
SHA1 2981bfe928f4cccb01d67ef15d87581c57235236
SHA256 0e864b45df18a1e00f77abe9005c087d3a393b6d99c80aa556249c2a12f1387c
SHA512 f1552d58154bd618f287f79cc49cca5ac59dfafde5e34933203b93348d766c40990ee4c8390b54205d961ab0b3c4b8a8133ac31f329468fe4e52a08d2ef0f799

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\mB2nO8vz.exe

MD5 79d64b0a10fdc66eddeea9b88b2ecc63
SHA1 2981bfe928f4cccb01d67ef15d87581c57235236
SHA256 0e864b45df18a1e00f77abe9005c087d3a393b6d99c80aa556249c2a12f1387c
SHA512 f1552d58154bd618f287f79cc49cca5ac59dfafde5e34933203b93348d766c40990ee4c8390b54205d961ab0b3c4b8a8133ac31f329468fe4e52a08d2ef0f799

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\121E.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\13B5.exe

MD5 dd08f0cd460c196d6083e8d2fb76de29
SHA1 7e7b2f2dc1f035cdc9ea637cd1f8795ab1d48a6e
SHA256 143c070f9595a87a72e28d8a64b14cb6ec73a62eff911a1c5d3ebbfa99803100
SHA512 ca52df2798bc9f16faea6212675f22335dfd13a5fc79d929faa384d13a63606728cfbd5f4aad6cb749b9fce962607e931e76b3e40fb7d082ab90eb228af2c3f6

memory/5176-304-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5176-305-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5176-307-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1491.exe

MD5 cb71132b03f15b037d3e8a5e4d9e0285
SHA1 95963fba539b45eb6f6acbd062c48976733519a1
SHA256 7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512 d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

memory/5248-312-0x0000000000890000-0x000000000089A000-memory.dmp

memory/5248-314-0x00007FFDABAD0000-0x00007FFDAC591000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1mI85mj9.exe

MD5 5940df80cc0ffbb340e1d0165c0143ae
SHA1 895fce0d888aee0fdd28b95d3784ab3bb58ac4c9
SHA256 2c1fd1969c29699f2787dffe166c2225b028e7acd4efd2d83b9528825813d669
SHA512 3ab655fd14bb222558abb2c128bb21fa2b1adb0510cc1b3ec8400102d1a85af33c96c208db5c514346f0562806aaa35e37afc8840990284f2492d6a3f450b7d7

C:\Users\Admin\AppData\Local\Temp\13B5.exe

MD5 dd08f0cd460c196d6083e8d2fb76de29
SHA1 7e7b2f2dc1f035cdc9ea637cd1f8795ab1d48a6e
SHA256 143c070f9595a87a72e28d8a64b14cb6ec73a62eff911a1c5d3ebbfa99803100
SHA512 ca52df2798bc9f16faea6212675f22335dfd13a5fc79d929faa384d13a63606728cfbd5f4aad6cb749b9fce962607e931e76b3e40fb7d082ab90eb228af2c3f6

C:\Users\Admin\AppData\Local\Temp\1491.exe

MD5 cb71132b03f15b037d3e8a5e4d9e0285
SHA1 95963fba539b45eb6f6acbd062c48976733519a1
SHA256 7f7d4ba0b7b46eff509b3aa2105d10d25f79e13ef3c1b1ec9c889cf2f0f1d373
SHA512 d140809bcac5b6b47f710c18ca1df1a3dd9b9adb95dbc368049cdc91874070c9a9f67137941ab17147143ebfabb81de7f1e697e42b0a28d51776b2f9c48cba4a

C:\Users\Admin\AppData\Local\Temp\1618.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\1618.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

memory/5444-323-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5444-324-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5436-325-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5176-326-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5444-329-0x0000000000400000-0x0000000000428000-memory.dmp

memory/5436-331-0x00000000073B0000-0x00000000073C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bd59a6b3207f99fc3435baf3c22bc4e
SHA1 ae90587beed289f177f4143a8380ba27109d0a6f
SHA256 08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512 ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe

MD5 d864744ea23807cf528a1a508c2bdc3e
SHA1 a6c19194b0bdac075563109000c3e182f86f6155
SHA256 426a88a033bd62b047fd132f323987c440c10881e4c2843adbf59c1ce43f87ff
SHA512 7e06a9f47ca41272981cf6d17d9025497bea27769ca0535c684463d450595c9c728a8832ea7ebdf262efaf0fe6d4ce1622e9cc205afe72b52e7b6b04f38533a0

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Dc044iF.exe

MD5 d864744ea23807cf528a1a508c2bdc3e
SHA1 a6c19194b0bdac075563109000c3e182f86f6155
SHA256 426a88a033bd62b047fd132f323987c440c10881e4c2843adbf59c1ce43f87ff
SHA512 7e06a9f47ca41272981cf6d17d9025497bea27769ca0535c684463d450595c9c728a8832ea7ebdf262efaf0fe6d4ce1622e9cc205afe72b52e7b6b04f38533a0

memory/5900-345-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5900-351-0x0000000000B40000-0x0000000000B7E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b39ed2e1c19ab1c9ba1a5271a9ac16b8
SHA1 86f84590cbed6b1e5f124e4b1b0c10b457ac6d7d
SHA256 577eda6062e9746c6dd58d40d348093ce6ea816ac227a9fb9f29e1313d787d65
SHA512 b47de27f5b60c875410a386a45307a805ed32f7ad2c28e0299a0c669280f39ab06b1e31ab18890def2200782e6105b06c18c09692b155d24e7c4a72c2271f51c

memory/5900-409-0x0000000007B90000-0x0000000007BA0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 af81c55c391c396700f495e7f9fe0137
SHA1 5e28069cc1f3cb1e3b7b25ec6dfa32abfe0924e4
SHA256 f91fe4689213fd4c6f432264f124d36251265ccb671f50b5e013e636f67a82cc
SHA512 21b2ddfdde30dc4379255495311754958ecda676d58e0b1aab4d07c77b3030b2ad806ac104a1824a48fea27bbd96b326a3cbbd26716b7889c6bca76eb9976676

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582b32.TMP

MD5 20adc3527a80d45426173e5803298eb3
SHA1 4ea215aea29c5a8c34cbe0a9f68f0a4081a22566
SHA256 0394f239885959bdaafe9698b99c09e655efa8dd07b53dcc252c02b814e3a935
SHA512 a2700ff7dc0c17b0d833afc5c2d0483f1ba1ec9b378fe42d2246fc8f7e23edc4281b38f6420af7cf54b1fc3221af5f7fdbc691d1b711d3ac7ebd156a1ef23a09

C:\Users\Admin\AppData\Local\Temp\ss41.exe

MD5 83330cf6e88ad32365183f31b1fd3bda
SHA1 1c5b47be2b8713746de64b39390636a81626d264
SHA256 7ce942cdc58ba5fa628d97f991c8a794294c2acfb724efbf0ac887c47942a31e
SHA512 e28a9c47f690b0b0f0dd3b946d9cd59c761803f3826a382208a5b92be1293067b37a39f1141ddda13247b96138a108ce2f85b83de0143d48d4acc94f69a11908

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 528b5dc5ede359f683b73a684b9c19f6
SHA1 8bff4feae6dbdaafac1f9f373f15850d08e0a206
SHA256 3a53bd59537190f8dc2c1ce266eb3b6c699c96ee929e2d4f90555fea5c6441f9
SHA512 87cb867d3f47346730ee04b8b611afeac60616040a84c85b1369b739df217a528aa148a807d653d543bcb4ed25dac42ab98ad38d705331725a71ec2d6f010cbb

memory/5196-501-0x00007FF659EF0000-0x00007FF659F5A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 7ea584dc49967de03bebdacec829b18d
SHA1 3d47f0e88c7473bedeed2f14d7a8db1318b93852
SHA256 79232c763bddf5c7fc4ca2e1597b8a5cd38902241d689ac1e69f7418a8077a53
SHA512 ed57aca6b892cb0229708690df16739e0a976ce28112128c9b4f4e4f06019c4fbe6675cb82a639837ae3374acdc0ee9fdb86b5b28151ccc8c7ed2aeff350fcb0

memory/3360-522-0x0000000000C50000-0x0000000000DC4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos1.exe

MD5 85b698363e74ba3c08fc16297ddc284e
SHA1 171cfea4a82a7365b241f16aebdb2aad29f4f7c0
SHA256 78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe
SHA512 7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

memory/5208-514-0x0000000002840000-0x0000000002940000-memory.dmp

memory/5208-520-0x00000000026C0000-0x00000000026C9000-memory.dmp

memory/4832-525-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5248-524-0x00007FFDABAD0000-0x00007FFDAC591000-memory.dmp

memory/4832-523-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3360-528-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5436-531-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5436-533-0x00000000073B0000-0x00000000073C0000-memory.dmp

memory/3032-532-0x0000000000630000-0x00000000007ED000-memory.dmp

memory/5492-534-0x0000000004AC0000-0x00000000053AB000-memory.dmp

memory/5492-536-0x00000000046C0000-0x0000000004ABA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\set16.exe

MD5 22d5269955f256a444bd902847b04a3b
SHA1 41a83de3273270c3bd5b2bd6528bdc95766aa268
SHA256 ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd
SHA512 d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

memory/5132-545-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5428-551-0x0000000000400000-0x0000000000430000-memory.dmp

memory/5492-553-0x0000000000400000-0x000000000298D000-memory.dmp

memory/5428-557-0x0000000001560000-0x0000000001566000-memory.dmp

memory/5900-561-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/3032-562-0x0000000000630000-0x00000000007ED000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9fa08c9c7e2605c09c569b46e010259f
SHA1 d34b3855cd09bb12e9c4135c9509391cef1de95c
SHA256 bbc234cd41fb8dd75a786e4d03ca9b91c52c98f234a705e09ef220a1fdc395e0
SHA512 e2e91f2e4ff677818250404ad38107f09e9e2f40347810ff9d236ec7224ca0e4a8096edb955babfaf246ec37e7699f50847a8b6b3bbd682f3f7c5468a9d6baf7

memory/5428-579-0x0000000074740000-0x0000000074EF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos.exe

MD5 076ab7d1cc5150a5e9f8745cc5f5fb6c
SHA1 7b40783a27a38106e2cc91414f2bc4d8b484c578
SHA256 d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90
SHA512 75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

memory/5132-582-0x0000000000400000-0x0000000000413000-memory.dmp

memory/5900-584-0x0000000007B90000-0x0000000007BA0000-memory.dmp

memory/5428-585-0x0000000005470000-0x0000000005480000-memory.dmp

memory/5216-586-0x00000000007F0000-0x00000000007F8000-memory.dmp

memory/3360-601-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5216-602-0x00007FFDABAD0000-0x00007FFDAC591000-memory.dmp

memory/5216-603-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

memory/5604-605-0x00000000020B0000-0x00000000020B1000-memory.dmp

memory/5248-606-0x00007FFDABAD0000-0x00007FFDAC591000-memory.dmp

memory/1600-609-0x00000000004C0000-0x000000000051A000-memory.dmp

memory/1600-620-0x0000000000400000-0x0000000000467000-memory.dmp

memory/5148-622-0x0000000000400000-0x00000000005F1000-memory.dmp

C:\ProgramData\ContentDVSvc\ContentDVSvc.exe

MD5 27b85a95804a760da4dbee7ca800c9b4
SHA1 f03136226bf3dd38ba0aa3aad1127ccab380197c
SHA256 f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245
SHA512 e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

memory/1600-625-0x0000000074740000-0x0000000074EF0000-memory.dmp

memory/5148-624-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/4832-630-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3224-627-0x00000000029C0000-0x00000000029D6000-memory.dmp

memory/5148-629-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5492-636-0x00000000046C0000-0x0000000004ABA000-memory.dmp

memory/6000-641-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5884-640-0x0000000000990000-0x0000000000CD4000-memory.dmp

memory/5884-642-0x00000000054C0000-0x000000000559C000-memory.dmp

memory/5884-649-0x0000000005680000-0x0000000005758000-memory.dmp

memory/5884-650-0x0000000005960000-0x0000000005A28000-memory.dmp

memory/5884-654-0x0000000005A30000-0x0000000005A7C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 ec6aae2bb7d8781226ea61adca8f0586
SHA1 d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3
SHA256 b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599
SHA512 aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

memory/5492-635-0x0000000004AC0000-0x00000000053AB000-memory.dmp

memory/5492-667-0x0000000000400000-0x000000000298D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f5ef298d11197b2484407f40980dd253
SHA1 41657d8ffd4f45e8832d035efcab7a64049abef2
SHA256 c36af9e75c9b3913d1081add768fb346d4fbb6a1ce62a2c93b702687f614a0c8
SHA512 043d19e40d072f29d56f0b9b07e17aa838a2ff2311aad3e2e37d28f2ea30b641dd0f65304ac3ee60ba1fe83629b480a22ec4c2062c7c2450c01a9092deedc28a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 7d3c836f4980488335bdc51a04b919e1
SHA1 303621d868caa7f7d75da4a0fb5ae7c3d94aec0e
SHA256 c45c547d7c95aaf812c5edee542564b358549711b3d6b298e1061c550faf7b03
SHA512 8490d0f5b9ef56ae2d33983c4662969bf9cc086d8284c46256718bf576068fdadd3eeb6151846ab19247cd3521cfa9413d06e5b6235095e48437934701ea74da

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b507781cdb87d44f07d596dcfde3facf
SHA1 86dda93a6b4f3243c9d60f757088d8243848eb2f
SHA256 d02044dd6c714190badc4d15b24018392193f309201249174c23546bbd8e3650
SHA512 57c486ae8b07f8d4c57b177a0a68e61bcf435693ee8024639d9bb5f864e807c32e2a27fc6954c61716a464f762bdf3a73e886771cebe212ef66fb61d9f023185

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fd15857b2111a18d5c0ec8b778b17ef1
SHA1 fc8e57d33a1421cbeb628de8ea260f45d5c59b42
SHA256 01da154a8c961d9a6fd57ddab3c4b65a5bcee314fdf9acc85dc0a2817e9d8121
SHA512 5f9c89fd99220df2fc24c0acf0b74069f14132eb081b57767b2ffec646295a2c56ce78125a4bb13a5996212eff9916a4f6a03ba25781c132d88399d7289eec84

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 bedfd3008ef9af50f33002e2da317146
SHA1 653a1d9be3897636034cb9f2d5dd5132d26e564d
SHA256 84286714a5c9f46ceb18a64f4289389305fbd5e9c5c874e236f8ea68eec7d1b1
SHA512 dc270d73ec207f567381adb42dfbdf0f7c7e6b44775a84f3126fab79e973e743522b523660f6072e7ea8fc3322b563b2fe09925bf19d127d2b2d4784964a4d25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 5de75383aad2dc7e4f43e6894ec45a5a
SHA1 328a73e92bbb26a1620e0cd5907cd768eb29c7ae
SHA256 b3f97843abc629c9e3bbc77286a8363fb3da21ec62510e2bad362713d403f765
SHA512 b3dd5ad37f52ec98d3643d890814bc263cc24ceae1e465b442fc00828da924ebe6efc1006cdecbda20ac92afb71c39e35d8aec43a4cd3f06480f545f5462614e

memory/5604-795-0x0000000000400000-0x00000000004B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_clfcyisc.vyu.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5492-853-0x0000000000400000-0x000000000298D000-memory.dmp

memory/6000-888-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5492-921-0x0000000000400000-0x000000000298D000-memory.dmp

memory/2804-949-0x0000000000400000-0x000000000298D000-memory.dmp

memory/6000-950-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/2804-1013-0x0000000000400000-0x000000000298D000-memory.dmp

memory/6000-1015-0x0000000000400000-0x00000000005F1000-memory.dmp

memory/5720-1014-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/5720-1020-0x00000000055B0000-0x0000000005691000-memory.dmp

memory/5720-1022-0x00000000055B0000-0x0000000005691000-memory.dmp

memory/5720-1024-0x00000000055B0000-0x0000000005691000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4