Analysis Overview
SHA256
87b3109dda617d9459cfb758766910a68f46076050f274821dc3ffebb54642f1
Threat Level: Known bad
The file file was found to be: Known bad.
Malicious Activity Summary
Healer
RedLine
DcRat
Glupteba payload
SmokeLoader
RedLine payload
Glupteba
Amadey
Modifies Windows Defender Real-time Protection settings
Detects Healer an antivirus disabler dropper
Downloads MZ/PE file
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Windows security modification
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
Program crash
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Enumerates system info in registry
Suspicious use of FindShellTrayWindow
Uses Task Scheduler COM API
Suspicious use of SendNotifyMessage
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 22:35
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 22:35
Reported
2023-10-10 22:38
Platform
win7-20230831-en
Max time kernel
118s
Max time network
133s
Command Line
Signatures
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2836 set thread context of 2900 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 284
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
| MD5 | b820053e0b116dcab686f6c154a9f51d |
| SHA1 | c8b91a82ab7bdd558a7e48609ae7803a2d3434ce |
| SHA256 | ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3 |
| SHA512 | ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
| MD5 | b820053e0b116dcab686f6c154a9f51d |
| SHA1 | c8b91a82ab7bdd558a7e48609ae7803a2d3434ce |
| SHA256 | ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3 |
| SHA512 | ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
| MD5 | b820053e0b116dcab686f6c154a9f51d |
| SHA1 | c8b91a82ab7bdd558a7e48609ae7803a2d3434ce |
| SHA256 | ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3 |
| SHA512 | ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
| MD5 | b820053e0b116dcab686f6c154a9f51d |
| SHA1 | c8b91a82ab7bdd558a7e48609ae7803a2d3434ce |
| SHA256 | ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3 |
| SHA512 | ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
| MD5 | 19c8abfb159254382df8b23bb5cc004d |
| SHA1 | 8e6d50c6aae7876650fcedbbb4540db9da731715 |
| SHA256 | cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0 |
| SHA512 | f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
| MD5 | 19c8abfb159254382df8b23bb5cc004d |
| SHA1 | 8e6d50c6aae7876650fcedbbb4540db9da731715 |
| SHA256 | cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0 |
| SHA512 | f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
| MD5 | 19c8abfb159254382df8b23bb5cc004d |
| SHA1 | 8e6d50c6aae7876650fcedbbb4540db9da731715 |
| SHA256 | cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0 |
| SHA512 | f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
| MD5 | 19c8abfb159254382df8b23bb5cc004d |
| SHA1 | 8e6d50c6aae7876650fcedbbb4540db9da731715 |
| SHA256 | cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0 |
| SHA512 | f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
| MD5 | 6f2d8bd86981c79b175e4f03f9c7ab17 |
| SHA1 | 1b81e55f022e1d3f5beaeb5dcd32ec837c986337 |
| SHA256 | 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0 |
| SHA512 | a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
| MD5 | 6f2d8bd86981c79b175e4f03f9c7ab17 |
| SHA1 | 1b81e55f022e1d3f5beaeb5dcd32ec837c986337 |
| SHA256 | 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0 |
| SHA512 | a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
| MD5 | 6f2d8bd86981c79b175e4f03f9c7ab17 |
| SHA1 | 1b81e55f022e1d3f5beaeb5dcd32ec837c986337 |
| SHA256 | 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0 |
| SHA512 | a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
| MD5 | 6f2d8bd86981c79b175e4f03f9c7ab17 |
| SHA1 | 1b81e55f022e1d3f5beaeb5dcd32ec837c986337 |
| SHA256 | 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0 |
| SHA512 | a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
memory/2652-40-0x0000000000380000-0x000000000039E000-memory.dmp
memory/2652-41-0x00000000003E0000-0x00000000003FC000-memory.dmp
memory/2652-42-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-43-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-45-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-47-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-49-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-53-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-69-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-67-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-65-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-63-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-61-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-59-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-57-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-55-0x00000000003E0000-0x00000000003F6000-memory.dmp
memory/2652-51-0x00000000003E0000-0x00000000003F6000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
memory/2900-76-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-77-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-78-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-79-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-82-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-80-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-85-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-84-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2900-87-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2900-89-0x0000000000400000-0x0000000000433000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 22:35
Reported
2023-10-10 22:38
Platform
win10v2004-20230915-en
Max time kernel
124s
Max time network
161s
Command Line
Signatures
Amadey
DcRat
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\B514.bat | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\BE8D.exe | N/A |
Executes dropped EXE
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\A301.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3860 set thread context of 1172 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 1848 set thread context of 1520 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4556 set thread context of 3880 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 5464 set thread context of 6132 | N/A | C:\Users\Admin\AppData\Local\Temp\B264.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 5916 set thread context of 4712 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3380 set thread context of 5736 | N/A | C:\Users\Admin\AppData\Local\Temp\B8A0.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Enumerates physical storage devices
Program crash
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\BBFC.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3860 -ip 3860
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1172 -ip 1172
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 536
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1848 -ip 1848
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 568
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4556 -ip 4556
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 572
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1548.tmp\1549.tmp\154A.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3183054514280126068,9414628779482904679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3183054514280126068,9414628779482904679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\A301.exe
C:\Users\Admin\AppData\Local\Temp\A301.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe
C:\Users\Admin\AppData\Local\Temp\B264.exe
C:\Users\Admin\AppData\Local\Temp\B264.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe
C:\Users\Admin\AppData\Local\Temp\B514.bat
"C:\Users\Admin\AppData\Local\Temp\B514.bat"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5464 -ip 5464
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B65B.tmp\B65C.tmp\B65D.bat C:\Users\Admin\AppData\Local\Temp\B514.bat"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 416
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5916 -ip 5916
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4712 -ip 4712
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 592
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 540
C:\Users\Admin\AppData\Local\Temp\B8A0.exe
C:\Users\Admin\AppData\Local\Temp\B8A0.exe
C:\Users\Admin\AppData\Local\Temp\BBFC.exe
C:\Users\Admin\AppData\Local\Temp\BBFC.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\BE8D.exe
C:\Users\Admin\AppData\Local\Temp\BE8D.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3380 -ip 3380
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 416
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\FFFC.exe
C:\Users\Admin\AppData\Local\Temp\FFFC.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\source1.exe
"C:\Users\Admin\AppData\Local\Temp\source1.exe"
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\A4C9.exe
C:\Users\Admin\AppData\Local\Temp\A4C9.exe
C:\Users\Admin\AppData\Local\Temp\B37F.exe
C:\Users\Admin\AppData\Local\Temp\B37F.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\B824.exe
C:\Users\Admin\AppData\Local\Temp\B824.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 126.24.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.110.16.96.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.121.18.2.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 35.247.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | static.xx.fbcdn.net | udp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| US | 8.8.8.8:53 | 27.30.240.157.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | google.com | udp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.251.36.45:443 | accounts.google.com | tcp |
| NL | 142.251.36.45:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | 45.36.251.142.in-addr.arpa | udp |
| NL | 142.251.36.45:443 | accounts.google.com | udp |
| IE | 52.111.236.21:443 | tcp | |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | facebook.com | udp |
| CZ | 157.240.30.35:443 | facebook.com | tcp |
| US | 8.8.8.8:53 | fbcdn.net | udp |
| US | 8.8.8.8:53 | 35.30.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| CZ | 157.240.30.35:443 | fbcdn.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | play.google.com | udp |
| NL | 142.251.36.14:443 | play.google.com | tcp |
| NL | 142.251.36.14:443 | play.google.com | udp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | fbsbx.com | udp |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| US | 8.8.8.8:53 | 211.92.42.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.65.42.5.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| TR | 185.216.70.222:80 | 185.216.70.222 | tcp |
| US | 8.8.8.8:53 | 222.70.216.185.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| NL | 142.251.36.45:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 89.65.42.20.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| MD | 176.123.9.142:37637 | tcp | |
| US | 8.8.8.8:53 | 142.9.123.176.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
| MD5 | b820053e0b116dcab686f6c154a9f51d |
| SHA1 | c8b91a82ab7bdd558a7e48609ae7803a2d3434ce |
| SHA256 | ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3 |
| SHA512 | ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
| MD5 | b820053e0b116dcab686f6c154a9f51d |
| SHA1 | c8b91a82ab7bdd558a7e48609ae7803a2d3434ce |
| SHA256 | ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3 |
| SHA512 | ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
| MD5 | 19c8abfb159254382df8b23bb5cc004d |
| SHA1 | 8e6d50c6aae7876650fcedbbb4540db9da731715 |
| SHA256 | cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0 |
| SHA512 | f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
| MD5 | 19c8abfb159254382df8b23bb5cc004d |
| SHA1 | 8e6d50c6aae7876650fcedbbb4540db9da731715 |
| SHA256 | cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0 |
| SHA512 | f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
| MD5 | 6f2d8bd86981c79b175e4f03f9c7ab17 |
| SHA1 | 1b81e55f022e1d3f5beaeb5dcd32ec837c986337 |
| SHA256 | 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0 |
| SHA512 | a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
| MD5 | 6f2d8bd86981c79b175e4f03f9c7ab17 |
| SHA1 | 1b81e55f022e1d3f5beaeb5dcd32ec837c986337 |
| SHA256 | 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0 |
| SHA512 | a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
memory/3668-28-0x0000000074270000-0x0000000074A20000-memory.dmp
memory/3668-29-0x0000000002010000-0x0000000002020000-memory.dmp
memory/3668-30-0x00000000020C0000-0x00000000020DE000-memory.dmp
memory/3668-31-0x0000000002010000-0x0000000002020000-memory.dmp
memory/3668-32-0x0000000004960000-0x0000000004F04000-memory.dmp
memory/3668-33-0x0000000004F50000-0x0000000004F6C000-memory.dmp
memory/3668-34-0x0000000074270000-0x0000000074A20000-memory.dmp
memory/3668-35-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-36-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-38-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-40-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-42-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-44-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-46-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-48-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-50-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-52-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-54-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-58-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-56-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-60-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-62-0x0000000004F50000-0x0000000004F66000-memory.dmp
memory/3668-63-0x0000000002010000-0x0000000002020000-memory.dmp
memory/3668-65-0x0000000074270000-0x0000000074A20000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
| MD5 | d6a4b4e599ca88a2798115b2f57a4a50 |
| SHA1 | 881756996242273334e4e03642ed6be2917b7cab |
| SHA256 | 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce |
| SHA512 | 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676 |
memory/1172-69-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1172-70-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1172-71-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1172-73-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
| MD5 | f8fa3529c97f505a4d289c487e17bc2b |
| SHA1 | 2b07adbc723acd83d582065c2757f22128d93305 |
| SHA256 | ea436c873f1717eeff23322111dbb1ae6920ba8ca264a947a92f5ae9824ef739 |
| SHA512 | 6bf77d4bce90638bfd7766c1a5864bc3c59e0e6216796094aacc077b1a4baa7006999c2aa3fa1e7f4629cc80458db327242df8966f6a01b12c3e2702b104f0b2 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
| MD5 | f8fa3529c97f505a4d289c487e17bc2b |
| SHA1 | 2b07adbc723acd83d582065c2757f22128d93305 |
| SHA256 | ea436c873f1717eeff23322111dbb1ae6920ba8ca264a947a92f5ae9824ef739 |
| SHA512 | 6bf77d4bce90638bfd7766c1a5864bc3c59e0e6216796094aacc077b1a4baa7006999c2aa3fa1e7f4629cc80458db327242df8966f6a01b12c3e2702b104f0b2 |
memory/1520-77-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1520-78-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
| MD5 | c15cd2487e9b9d5357d72f2a8a17fcab |
| SHA1 | 515e47debf5d66e44a8c2823e5d601dd7aa2d8a7 |
| SHA256 | f0d6fc5335d727b7d86b80a58d69cce2e0fc576e42954bb290881e15fb20d3dc |
| SHA512 | e63ef7cbe144fe66215ec6b3d42de9bc00aa5eddd72ec9562f5028b30592fd94d6c04c7a344b477c73aa8caaa4bf2769142fa0324cc77ae6d49a70c2a12d94ff |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
| MD5 | c15cd2487e9b9d5357d72f2a8a17fcab |
| SHA1 | 515e47debf5d66e44a8c2823e5d601dd7aa2d8a7 |
| SHA256 | f0d6fc5335d727b7d86b80a58d69cce2e0fc576e42954bb290881e15fb20d3dc |
| SHA512 | e63ef7cbe144fe66215ec6b3d42de9bc00aa5eddd72ec9562f5028b30592fd94d6c04c7a344b477c73aa8caaa4bf2769142fa0324cc77ae6d49a70c2a12d94ff |
memory/3880-82-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3880-83-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/3880-84-0x0000000007590000-0x0000000007622000-memory.dmp
memory/3880-85-0x0000000007530000-0x0000000007540000-memory.dmp
memory/3880-86-0x0000000007660000-0x000000000766A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
| MD5 | a711a367419ac2673178164ee2ca19fc |
| SHA1 | c5593a528109c4673018dba825cfb751ee6bd102 |
| SHA256 | 2a9fe1b01febf5c93040920621dcf6002169d9d0e5a8ee3ca06e8f4a9a5e5765 |
| SHA512 | e19d61ab95b722a4a6f2d9370966309827adc642aab1aa87ba386437758e2b9993e6eacad67471a6ecc5eed492606bcc3b42a2454a2482a997e1df49147d0edb |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
| MD5 | a711a367419ac2673178164ee2ca19fc |
| SHA1 | c5593a528109c4673018dba825cfb751ee6bd102 |
| SHA256 | 2a9fe1b01febf5c93040920621dcf6002169d9d0e5a8ee3ca06e8f4a9a5e5765 |
| SHA512 | e19d61ab95b722a4a6f2d9370966309827adc642aab1aa87ba386437758e2b9993e6eacad67471a6ecc5eed492606bcc3b42a2454a2482a997e1df49147d0edb |
memory/3880-91-0x0000000008670000-0x0000000008C88000-memory.dmp
memory/3880-92-0x0000000007900000-0x0000000007A0A000-memory.dmp
memory/3880-93-0x0000000007830000-0x0000000007842000-memory.dmp
memory/3880-94-0x0000000007890000-0x00000000078CC000-memory.dmp
memory/3880-95-0x0000000007A10000-0x0000000007A5C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1548.tmp\1549.tmp\154A.bat
| MD5 | 0ec04fde104330459c151848382806e8 |
| SHA1 | 3b0b78d467f2db035a03e378f7b3a3823fa3d156 |
| SHA256 | 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f |
| SHA512 | 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 45fe8440c5d976b902cfc89fb780a578 |
| SHA1 | 5696962f2d0e89d4c561acd58483b0a4ffeab800 |
| SHA256 | f620e0b35ac0ead6ed51984859edc75f7d4921aaa90d829bb9ad362d15504f96 |
| SHA512 | efe817ea03c203f8e63d7b50a965cb920fb4f128e72b458a7224c0c1373b31fae9eaa55a504290d2bc0cf55c96fd43f295f9aef6c2791a35fc4ab3e965f6ff25 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bf009481892dd0d1c49db97428428ede |
| SHA1 | aee4e7e213f6332c1629a701b42335eb1a035c66 |
| SHA256 | 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4 |
| SHA512 | d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bf009481892dd0d1c49db97428428ede |
| SHA1 | aee4e7e213f6332c1629a701b42335eb1a035c66 |
| SHA256 | 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4 |
| SHA512 | d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bf009481892dd0d1c49db97428428ede |
| SHA1 | aee4e7e213f6332c1629a701b42335eb1a035c66 |
| SHA256 | 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4 |
| SHA512 | d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bf009481892dd0d1c49db97428428ede |
| SHA1 | aee4e7e213f6332c1629a701b42335eb1a035c66 |
| SHA256 | 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4 |
| SHA512 | d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bf009481892dd0d1c49db97428428ede |
| SHA1 | aee4e7e213f6332c1629a701b42335eb1a035c66 |
| SHA256 | 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4 |
| SHA512 | d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 98d7448f58e9c788e7d869e779f85dcd |
| SHA1 | 2868c0718d8b7c9bd6c58be4c3336965eac7e63d |
| SHA256 | 51982ba8764115ea5846f34fff7ec0dcb04a22e9dba0252bbe4cb272f540e30a |
| SHA512 | 238120ae423d8f0ea218ea9e75acc13fdad5b5aa17a0fb31b35baea7720196c0e188da0172f398d080d461e2d5412682c9c7fb353f6f4f95e1691158e72df2b3 |
memory/2568-134-0x0000000007950000-0x0000000007966000-memory.dmp
memory/1520-135-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 8e0eb65b176e9264cf1938e78faf0bb7 |
| SHA1 | 345fcdf7d15178dd73122e7e40c196229aa53fab |
| SHA256 | 72aec105694633afa964a53e1717e2531671cb13977751af45f5fd3018903856 |
| SHA512 | 60fa4171a75428f37f0e1abc6f7cc7ffd7d1462ba1d242cf243d47fd7955b3d0ee7ea0b4686b70070adb4f6db892322da2994901090fae4d435fcbd7bb0d779f |
memory/3880-170-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/3880-173-0x0000000007530000-0x0000000007540000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 98d7448f58e9c788e7d869e779f85dcd |
| SHA1 | 2868c0718d8b7c9bd6c58be4c3336965eac7e63d |
| SHA256 | 51982ba8764115ea5846f34fff7ec0dcb04a22e9dba0252bbe4cb272f540e30a |
| SHA512 | 238120ae423d8f0ea218ea9e75acc13fdad5b5aa17a0fb31b35baea7720196c0e188da0172f398d080d461e2d5412682c9c7fb353f6f4f95e1691158e72df2b3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 4ecebae521e2c2564a094371193fe864 |
| SHA1 | 61e1e2a338c927007eaf4fe9c5e1655f7a7e3136 |
| SHA256 | f765c62074a27afeee09ee01c15020519adc4766292578e9faa5c06945aa71c4 |
| SHA512 | 692e5885a62c8161b5a51290e0ed18485424e3d94412a42d3f090be9455c9933aeb9fd5b3abd9f68d4ab4701548a3c27b11c1a7d41516f9e0cd50cfc69cbd254 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 2f3823f0c61cf0b49538aae394d5085d |
| SHA1 | 1115d077c808d5be3e82f7d2b49dea8c2504532f |
| SHA256 | 2aab84fb3555f025ffe194849f12a6d9fa552daca66242f2b1e434d46b9f4f49 |
| SHA512 | ca59543ded220f8c6cef0ce4a2ab33e7387ce421a8cd64091ffc09fa56270d1d33b82ef52c6ba104516eb0959e63db72dc3257752e08cc3fb6ad738d57ab5ccd |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | 25ac77f8c7c7b76b93c8346e41b89a95 |
| SHA1 | 5a8f769162bab0a75b1014fb8b94f9bb1fb7970a |
| SHA256 | 8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b |
| SHA512 | df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | cbb43c05e646f340ce5ae89d1244fcd6 |
| SHA1 | a6ae6ff5f2f8dcf4e8d67f8767524924a3875586 |
| SHA256 | 59871038d48785ee82299f848f16e3e366ccb4a399452c9d6bb1012c4e898327 |
| SHA512 | bc7aed3a3e699eedc661482a97b17a2b0db01cced4745af0124c138041a455cd7372aa736f6a40411116f7187d47571c87bb57aa3a50df2bfe533127f3eeb32d |
C:\Users\Admin\AppData\Local\Temp\A301.exe
| MD5 | 839f8fc33a04de86e8d5994b2aa6aea0 |
| SHA1 | 5cb533c20d178bf038d2da2c61eb95bc26433e7c |
| SHA256 | a6d5771ff701fc2702cf698c991c88429f6d840c02b081c68bd2164e40aa71db |
| SHA512 | f53a78336f45421ab3c3bea36e4e7f3f9e7db0a1e6463261c82f4fc48ef9c4a238f1d23e3ea79850d1c117a7d7090b109c04c3da7775ee4528c227820bfee664 |
C:\Users\Admin\AppData\Local\Temp\A301.exe
| MD5 | 839f8fc33a04de86e8d5994b2aa6aea0 |
| SHA1 | 5cb533c20d178bf038d2da2c61eb95bc26433e7c |
| SHA256 | a6d5771ff701fc2702cf698c991c88429f6d840c02b081c68bd2164e40aa71db |
| SHA512 | f53a78336f45421ab3c3bea36e4e7f3f9e7db0a1e6463261c82f4fc48ef9c4a238f1d23e3ea79850d1c117a7d7090b109c04c3da7775ee4528c227820bfee664 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Wv57eP.exe
| MD5 | 9d4d147233220521442956ab1e41861a |
| SHA1 | b8377797207475fd453286d26f2d2a4bb8d83728 |
| SHA256 | c7df1e7fd95ac9e40120f055fe83ffd55998d2fb5e8406a787a3b0d2b5732e7d |
| SHA512 | becc06ca3397f84171c7cff851ff7c643e730ca00b9097296c2bc88046bc2d76f127d2594a7caed6d98be9588f2010896ec3adb46c13bc3b7be2aaa8529ec5ec |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe
| MD5 | e82f10ca30c3674b591ba3761a00ff50 |
| SHA1 | e751249903f3eeaab829b9cb8e8ae4219222cd23 |
| SHA256 | 348da7ee617303b87e3334a8857e346309aaf245a78402dec95bf006b54dc6a9 |
| SHA512 | 9c1d2a823d8856ec9547eef550484b081bd9ce9527fbbe2bbe7c9988c817eb1dce2a963233175c77c9f9137e4a9c012b65de78e29722b14c36eb004f0d30e8d3 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe
| MD5 | e82f10ca30c3674b591ba3761a00ff50 |
| SHA1 | e751249903f3eeaab829b9cb8e8ae4219222cd23 |
| SHA256 | 348da7ee617303b87e3334a8857e346309aaf245a78402dec95bf006b54dc6a9 |
| SHA512 | 9c1d2a823d8856ec9547eef550484b081bd9ce9527fbbe2bbe7c9988c817eb1dce2a963233175c77c9f9137e4a9c012b65de78e29722b14c36eb004f0d30e8d3 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe
| MD5 | 49984d4611ca7c02b606d50a958ddd24 |
| SHA1 | 836a4d3d4cd8baab3a823750e4d44e0c58001dd8 |
| SHA256 | 205d80759c8ddf3f0730c60c7f9090305e6b99627dce06edded9807b19dd85c5 |
| SHA512 | 16d2b04a53cda812057d531ccac485a2e41abd12ca5161b09c5594f98bf44e27fa85f89f9ca02144a2d1d55f64f6ad821f893da6994ebcd90c6a5b42b91087ed |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe
| MD5 | 590173d0a05e97556709039366f07fea |
| SHA1 | 4402d6ea0d867c33ae1e852bb357053d01551e02 |
| SHA256 | 0b4a5327d31e581553a6966ea7e298c50667f241de97b21af50cfb6c81c800e6 |
| SHA512 | b220273d2bbcb3fca40463cd034bbe6d00d4019b25e7918f8f16e6e93a9244f3b38b7e7a490a74de0e9fc216ef4a37872cf36c5a053af30ad31d7cf9623045fa |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe
| MD5 | 590173d0a05e97556709039366f07fea |
| SHA1 | 4402d6ea0d867c33ae1e852bb357053d01551e02 |
| SHA256 | 0b4a5327d31e581553a6966ea7e298c50667f241de97b21af50cfb6c81c800e6 |
| SHA512 | b220273d2bbcb3fca40463cd034bbe6d00d4019b25e7918f8f16e6e93a9244f3b38b7e7a490a74de0e9fc216ef4a37872cf36c5a053af30ad31d7cf9623045fa |
C:\Users\Admin\AppData\Local\Temp\B264.exe
| MD5 | a3935470ac75a6b353ae690082b55292 |
| SHA1 | 40408e4df6dc3f8b94b79b64fdaf39a2c6a06d86 |
| SHA256 | 001a4c426890691c8daff98d7345167b59218d86e1b7dd0d0ffc1fbe58612d32 |
| SHA512 | f7bf7f074a5937fa9f04eeba5b8cf89270fca422d3f8701c753a22f77d359be7893627148d95aa954fd2473c7aecf085889ec1dff4958e06ef25f88785c20bde |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe
| MD5 | 648ba0e942d7d0193ff347f9c3abd5e8 |
| SHA1 | ef7f4e5743b988a622664b53ed661badfd790c49 |
| SHA256 | 9213f30827cb1420d351655a57791de3445ded1cd03c40df0bea9e765c1368ba |
| SHA512 | e559614e1c401d7073880d09ec720c09db0f631cc57104e07d600e6c286b1f9aebe010ac9f5c87c9122b95cf228fb6a3818217ff4e3b90a2d2263a95811c12b1 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe
| MD5 | 648ba0e942d7d0193ff347f9c3abd5e8 |
| SHA1 | ef7f4e5743b988a622664b53ed661badfd790c49 |
| SHA256 | 9213f30827cb1420d351655a57791de3445ded1cd03c40df0bea9e765c1368ba |
| SHA512 | e559614e1c401d7073880d09ec720c09db0f631cc57104e07d600e6c286b1f9aebe010ac9f5c87c9122b95cf228fb6a3818217ff4e3b90a2d2263a95811c12b1 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe
| MD5 | 7bbb81dd416c9095b091a8928f9f417e |
| SHA1 | 5ad4f96fe96dac9fa3b5151cb2da8aeea7818821 |
| SHA256 | 920d9f07530945a025bc7b108a6b076b5cbd3cab0e040e12c1fe730673786441 |
| SHA512 | e518b5bdf2b6f52ef2e8dac7673110eb36ed4cfa9c50dfaec94e60ca727e3acbd56a15b5e5773ef716a5adb78051fe0913c6c8ca2a48994517604bad287790ee |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe
| MD5 | 7bbb81dd416c9095b091a8928f9f417e |
| SHA1 | 5ad4f96fe96dac9fa3b5151cb2da8aeea7818821 |
| SHA256 | 920d9f07530945a025bc7b108a6b076b5cbd3cab0e040e12c1fe730673786441 |
| SHA512 | e518b5bdf2b6f52ef2e8dac7673110eb36ed4cfa9c50dfaec94e60ca727e3acbd56a15b5e5773ef716a5adb78051fe0913c6c8ca2a48994517604bad287790ee |
C:\Users\Admin\AppData\Local\Temp\B264.exe
| MD5 | a3935470ac75a6b353ae690082b55292 |
| SHA1 | 40408e4df6dc3f8b94b79b64fdaf39a2c6a06d86 |
| SHA256 | 001a4c426890691c8daff98d7345167b59218d86e1b7dd0d0ffc1fbe58612d32 |
| SHA512 | f7bf7f074a5937fa9f04eeba5b8cf89270fca422d3f8701c753a22f77d359be7893627148d95aa954fd2473c7aecf085889ec1dff4958e06ef25f88785c20bde |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe
| MD5 | 49984d4611ca7c02b606d50a958ddd24 |
| SHA1 | 836a4d3d4cd8baab3a823750e4d44e0c58001dd8 |
| SHA256 | 205d80759c8ddf3f0730c60c7f9090305e6b99627dce06edded9807b19dd85c5 |
| SHA512 | 16d2b04a53cda812057d531ccac485a2e41abd12ca5161b09c5594f98bf44e27fa85f89f9ca02144a2d1d55f64f6ad821f893da6994ebcd90c6a5b42b91087ed |
C:\Users\Admin\AppData\Local\Temp\B514.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
C:\Users\Admin\AppData\Local\Temp\B514.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
memory/6132-318-0x0000000000400000-0x0000000000433000-memory.dmp
memory/6132-320-0x0000000000400000-0x0000000000433000-memory.dmp
memory/6132-322-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4712-324-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4712-325-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4712-327-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\B65B.tmp\B65C.tmp\B65D.bat
| MD5 | 0ec04fde104330459c151848382806e8 |
| SHA1 | 3b0b78d467f2db035a03e378f7b3a3823fa3d156 |
| SHA256 | 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f |
| SHA512 | 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bb1d.TMP
| MD5 | a64aa92849f09e69b263825130aecf73 |
| SHA1 | be6e42f42a49f2c29f4f19768603ca7bb9704c13 |
| SHA256 | 3b46fa02c6c00257601f3951b1b6fc05bc4c9ca3432b5374832ad2876933da7d |
| SHA512 | 8f55c01c8cb275919470ad4b52fdc2c2494a274fe96831c3878715438e02e6083107b4fc5889f731b605eccf12b78dbbf9fb80a1f85787f86381f3fad59549f7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 57db448a7c6827b185ce07fdd954b76a |
| SHA1 | 1d3d4f94156b6b6f98209bd327727dd4d3691f9c |
| SHA256 | d92e551cbc5193fad9442910c2ce8830f8d2d920f57868670a90a0c392e56897 |
| SHA512 | 7a325b004252fb362482b1f188672b20ca1471944bf73c4599277e49cb4acb9ad426ede127b9eaf8fc4ee070172848ec45cb5bbb359f26b2460db438f5e6b924 |
C:\Users\Admin\AppData\Local\Temp\B8A0.exe
| MD5 | 93990eb50d3989187d96bbb7ee7307d2 |
| SHA1 | 1677aed3760a6348b97aa163134d23b49b7ed298 |
| SHA256 | 25c69320a3d9cd10abae8aaf565082a44158ee506173030e741e9c44d08fed6e |
| SHA512 | e32474eaf50b378011af84b627de25a9b13fc8608aaa71135990bd0fb89c589a24ab33a299dc22247908e6617856b7a940d004e73fd0adde847590fcbcb89a95 |
C:\Users\Admin\AppData\Local\Temp\B8A0.exe
| MD5 | 93990eb50d3989187d96bbb7ee7307d2 |
| SHA1 | 1677aed3760a6348b97aa163134d23b49b7ed298 |
| SHA256 | 25c69320a3d9cd10abae8aaf565082a44158ee506173030e741e9c44d08fed6e |
| SHA512 | e32474eaf50b378011af84b627de25a9b13fc8608aaa71135990bd0fb89c589a24ab33a299dc22247908e6617856b7a940d004e73fd0adde847590fcbcb89a95 |
memory/3664-350-0x0000000000CA0000-0x0000000000CAA000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | bf009481892dd0d1c49db97428428ede |
| SHA1 | aee4e7e213f6332c1629a701b42335eb1a035c66 |
| SHA256 | 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4 |
| SHA512 | d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11 |
memory/6132-351-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\BBFC.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
C:\Users\Admin\AppData\Local\Temp\BBFC.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
memory/3664-356-0x00007FFA70130000-0x00007FFA70BF1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\BE8D.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\BE8D.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/5736-363-0x0000000073F60000-0x0000000074710000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe
| MD5 | cded7d5b117a56fe62558b4e745efcb1 |
| SHA1 | f5f0d4f7533e696b778d9f70ebf17dbfe4eadea8 |
| SHA256 | 24d936540c5d20b1ad3d87c3c18e2cb735193551f02cb9b90656bfea9a7cdafb |
| SHA512 | 4cbce60d1b25169369b979f283747f36b969cdc0fba9062b77877eef3c6178f8e88c5503d7d745b4a6f30b73ae6423af4feeca3cab26c765b65f053c56f85696 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe
| MD5 | cded7d5b117a56fe62558b4e745efcb1 |
| SHA1 | f5f0d4f7533e696b778d9f70ebf17dbfe4eadea8 |
| SHA256 | 24d936540c5d20b1ad3d87c3c18e2cb735193551f02cb9b90656bfea9a7cdafb |
| SHA512 | 4cbce60d1b25169369b979f283747f36b969cdc0fba9062b77877eef3c6178f8e88c5503d7d745b4a6f30b73ae6423af4feeca3cab26c765b65f053c56f85696 |
memory/5140-367-0x0000000000610000-0x000000000064E000-memory.dmp
memory/5140-368-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/5736-369-0x0000000007CB0000-0x0000000007CC0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/5140-376-0x0000000007370000-0x0000000007380000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 52ac7ef1f99eb055398c879085b715a1 |
| SHA1 | ad97a7d26b3a187a02967929d7089530c7b9d07e |
| SHA256 | c6650d6a7b4e0daabce6b8e1b8d38e49474a34de98e51706b2a69e0a19b727c4 |
| SHA512 | 64f03631994940c99545abfd21e703975d713147d75b87abeae51f0f4b2497041b824be8a1427c2611ac77bb2ea4e7a235d17995467f5f20abbafa8bf19775f7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b2a86352a217259d70bc218d78068198 |
| SHA1 | 63ad96b652bcbaf54395e8431e524826bcc56ec1 |
| SHA256 | 1eb53067acd9ae46b716f9a37e61291fdd338edc15fc58bbd585aad07668f10a |
| SHA512 | 5d0a1b0aa926e6e1217fc32e77954c72a65cd51bf9529a2f2c724ce2a5ed53a237087e6969ff03e09631770f6d643694e66053a088a6be0dc4bb2038f12f984f |
memory/3664-552-0x00007FFA70130000-0x00007FFA70BF1000-memory.dmp
memory/5736-553-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/5140-554-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/5736-555-0x0000000007CB0000-0x0000000007CC0000-memory.dmp
memory/5140-556-0x0000000007370000-0x0000000007380000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 9df2e42549f872b3dc0d61694e7c5dc1 |
| SHA1 | 0bdd2c6db8a6a95d5058c8242d5a05db582135c1 |
| SHA256 | 34adc3c4f9363e1b069fe0f3131f589251784ec4c03dc4bfccb6bedb29e043a9 |
| SHA512 | c8bc635269b6f00da6fd684842c236ce22cc0b2e8fb02f0410623038db3aaf0ecde3451ab4c98c2575b959f351871d1f310bb5919d78cac52a26188ee593f0b0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 463850447e448c0b4af827345e0330d3 |
| SHA1 | c561b36947ba4f9497ffb682d8eb05c981847359 |
| SHA256 | 0d0da3f5d56b804a0dcbc9663ac947726839fe13b8631501d77de67aa8e7277e |
| SHA512 | 42a8958d9435353d0fb87c00e536d4a641a89df1d1abf9ef431254c76acaef0ca276fdc9ef139fa240326284cc0fd7947401e148d3a1ea2af64f4ea2010d91c5 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | d7664a991d7c7ba14c270035d73ab069 |
| SHA1 | f0a4e4741530e9ac8db39aed6fd27f7e3a1550ef |
| SHA256 | a1df5141b3854d43d2fb3e0fdb3d4001804b1bdfafbf47d1ede6d4c9e954fc12 |
| SHA512 | d7fbe123b8cb83b5c59b78318379c40784bdc44e889bc3e7bb3dc7dc3699e012e6ab8cb2d61e917313c983572f07e3aa359038a2ab8d9814fe6c2e356cce5cd3 |
memory/3664-610-0x00007FFA70130000-0x00007FFA70BF1000-memory.dmp
memory/6064-612-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/6064-613-0x0000000000DB0000-0x0000000001CDA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | b44f3ea702caf5fba20474d4678e67f6 |
| SHA1 | d33da22fcd5674123807aaf01123d49a69901e33 |
| SHA256 | 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8 |
| SHA512 | ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | aa6f521d78f6e9101a1a99f8bfdfbf08 |
| SHA1 | 81abd59d8275c1a1d35933f76282b411310323be |
| SHA256 | 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d |
| SHA512 | 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153 |
C:\Users\Admin\AppData\Local\Temp\source1.exe
| MD5 | e082a92a00272a3c1cd4b0de30967a79 |
| SHA1 | 16c391acf0f8c637d36a93e217591d8319e3f041 |
| SHA256 | eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc |
| SHA512 | 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288 |
memory/5508-639-0x0000000073F60000-0x0000000074710000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
memory/5508-638-0x00000000004D0000-0x00000000009E6000-memory.dmp
memory/6064-646-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/5508-644-0x0000000005360000-0x0000000005370000-memory.dmp
memory/2308-647-0x00000000023D0000-0x00000000024D0000-memory.dmp
memory/5508-650-0x0000000005290000-0x0000000005291000-memory.dmp
memory/2308-648-0x0000000002310000-0x0000000002319000-memory.dmp
memory/5508-649-0x0000000005510000-0x00000000055AC000-memory.dmp
memory/5772-651-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5772-652-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5260-654-0x00000000043C0000-0x00000000047C4000-memory.dmp
memory/5260-655-0x00000000047D0000-0x00000000050BB000-memory.dmp
memory/5260-657-0x0000000000400000-0x000000000266D000-memory.dmp
memory/5508-661-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/6036-660-0x00000000023B0000-0x00000000023E6000-memory.dmp
memory/5508-664-0x0000000005360000-0x0000000005370000-memory.dmp
memory/6036-663-0x0000000004880000-0x0000000004890000-memory.dmp
memory/6036-662-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/6036-665-0x0000000004EC0000-0x00000000054E8000-memory.dmp
memory/6036-666-0x0000000004D30000-0x0000000004D52000-memory.dmp
memory/6036-670-0x00000000056C0000-0x0000000005726000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blq5xxog.ixo.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/6036-667-0x0000000005560000-0x00000000055C6000-memory.dmp
memory/6036-678-0x0000000005730000-0x0000000005A84000-memory.dmp
memory/5772-680-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2568-679-0x00000000026C0000-0x00000000026D6000-memory.dmp
memory/5260-685-0x00000000043C0000-0x00000000047C4000-memory.dmp
memory/5260-684-0x0000000000400000-0x000000000266D000-memory.dmp
memory/3784-687-0x00007FF6EA7D0000-0x00007FF6EAD71000-memory.dmp
memory/5260-688-0x00000000047D0000-0x00000000050BB000-memory.dmp
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
memory/6036-700-0x0000000073F60000-0x0000000074710000-memory.dmp
memory/4788-717-0x00000000005F0000-0x000000000064A000-memory.dmp
memory/5508-723-0x0000000005610000-0x0000000005625000-memory.dmp
memory/5508-726-0x0000000005610000-0x0000000005625000-memory.dmp
memory/5508-724-0x0000000005610000-0x0000000005625000-memory.dmp