Malware Analysis Report

2025-01-23 07:48

Sample ID 231010-2hyrdsfh2v
Target file
SHA256 87b3109dda617d9459cfb758766910a68f46076050f274821dc3ffebb54642f1
Tags
evasion persistence trojan amadey dcrat glupteba healer redline smokeloader lutyr magia up3 backdoor dropper infostealer loader rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

87b3109dda617d9459cfb758766910a68f46076050f274821dc3ffebb54642f1

Threat Level: Known bad

The file file was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan amadey dcrat glupteba healer redline smokeloader lutyr magia up3 backdoor dropper infostealer loader rat

Healer

RedLine

DcRat

Glupteba payload

SmokeLoader

RedLine payload

Glupteba

Amadey

Modifies Windows Defender Real-time Protection settings

Detects Healer an antivirus disabler dropper

Downloads MZ/PE file

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Windows security modification

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Program crash

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-10 22:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-10 22:35

Reported

2023-10-10 22:38

Platform

win7-20230831-en

Max time kernel

118s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2836 set thread context of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 3028 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 3028 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 3028 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 3028 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 3028 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 3028 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 2584 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2584 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2584 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2584 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2584 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2584 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2584 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2924 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2924 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2924 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2924 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2924 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2924 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2924 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2936 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 2936 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 2936 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 2936 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 2936 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 2936 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 2936 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 2936 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 2936 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 2936 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 2936 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 2936 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 2936 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 2936 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2836 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2836 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\SysWOW64\WerFault.exe
PID 2900 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2900 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2900 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2900 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2900 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2900 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2900 wrote to memory of 2976 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 268

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

MD5 b820053e0b116dcab686f6c154a9f51d
SHA1 c8b91a82ab7bdd558a7e48609ae7803a2d3434ce
SHA256 ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3
SHA512 ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

MD5 b820053e0b116dcab686f6c154a9f51d
SHA1 c8b91a82ab7bdd558a7e48609ae7803a2d3434ce
SHA256 ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3
SHA512 ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace

\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

MD5 b820053e0b116dcab686f6c154a9f51d
SHA1 c8b91a82ab7bdd558a7e48609ae7803a2d3434ce
SHA256 ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3
SHA512 ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

MD5 b820053e0b116dcab686f6c154a9f51d
SHA1 c8b91a82ab7bdd558a7e48609ae7803a2d3434ce
SHA256 ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3
SHA512 ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace

\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

MD5 19c8abfb159254382df8b23bb5cc004d
SHA1 8e6d50c6aae7876650fcedbbb4540db9da731715
SHA256 cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0
SHA512 f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

MD5 19c8abfb159254382df8b23bb5cc004d
SHA1 8e6d50c6aae7876650fcedbbb4540db9da731715
SHA256 cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0
SHA512 f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732

\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

MD5 19c8abfb159254382df8b23bb5cc004d
SHA1 8e6d50c6aae7876650fcedbbb4540db9da731715
SHA256 cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0
SHA512 f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

MD5 19c8abfb159254382df8b23bb5cc004d
SHA1 8e6d50c6aae7876650fcedbbb4540db9da731715
SHA256 cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0
SHA512 f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732

\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

MD5 6f2d8bd86981c79b175e4f03f9c7ab17
SHA1 1b81e55f022e1d3f5beaeb5dcd32ec837c986337
SHA256 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0
SHA512 a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

MD5 6f2d8bd86981c79b175e4f03f9c7ab17
SHA1 1b81e55f022e1d3f5beaeb5dcd32ec837c986337
SHA256 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0
SHA512 a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09

\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

MD5 6f2d8bd86981c79b175e4f03f9c7ab17
SHA1 1b81e55f022e1d3f5beaeb5dcd32ec837c986337
SHA256 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0
SHA512 a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

MD5 6f2d8bd86981c79b175e4f03f9c7ab17
SHA1 1b81e55f022e1d3f5beaeb5dcd32ec837c986337
SHA256 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0
SHA512 a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/2652-40-0x0000000000380000-0x000000000039E000-memory.dmp

memory/2652-41-0x00000000003E0000-0x00000000003FC000-memory.dmp

memory/2652-42-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-43-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-45-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-47-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-49-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-53-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-69-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-67-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-65-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-63-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-61-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-59-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-57-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-55-0x00000000003E0000-0x00000000003F6000-memory.dmp

memory/2652-51-0x00000000003E0000-0x00000000003F6000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

memory/2900-76-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-77-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-78-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-79-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-82-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-80-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-85-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-84-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2900-87-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2900-89-0x0000000000400000-0x0000000000433000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-10 22:35

Reported

2023-10-10 22:38

Platform

win10v2004-20230915-en

Max time kernel

124s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\B514.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BE8D.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A301.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B264.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B514.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B8A0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BE8D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FFFC.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\A301.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BBFC.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4064 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 4064 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 4064 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe
PID 3476 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 3476 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 3476 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe
PID 2312 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2312 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 2312 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe
PID 1760 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 1760 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 1760 wrote to memory of 3668 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe
PID 1760 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 1760 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 1760 wrote to memory of 3860 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3860 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2312 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
PID 2312 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
PID 2312 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe
PID 1848 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1848 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1848 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1848 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1848 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1848 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3476 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
PID 3476 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
PID 3476 wrote to memory of 4556 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4556 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4064 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
PID 4064 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
PID 4064 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe
PID 3848 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe C:\Windows\system32\cmd.exe
PID 3848 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe C:\Windows\system32\cmd.exe
PID 2272 wrote to memory of 3680 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2272 wrote to memory of 3680 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4992 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2272 wrote to memory of 2792 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2272 wrote to memory of 2792 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2792 wrote to memory of 3824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2792 wrote to memory of 3824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3680 wrote to memory of 4160 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3860 -ip 3860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1172 -ip 1172

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 536

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1848 -ip 1848

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 568

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4556 -ip 4556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 572

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1548.tmp\1549.tmp\154A.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3183054514280126068,9414628779482904679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3183054514280126068,9414628779482904679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\A301.exe

C:\Users\Admin\AppData\Local\Temp\A301.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe

C:\Users\Admin\AppData\Local\Temp\B264.exe

C:\Users\Admin\AppData\Local\Temp\B264.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe

C:\Users\Admin\AppData\Local\Temp\B514.bat

"C:\Users\Admin\AppData\Local\Temp\B514.bat"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5464 -ip 5464

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B65B.tmp\B65C.tmp\B65D.bat C:\Users\Admin\AppData\Local\Temp\B514.bat"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5916 -ip 5916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4712 -ip 4712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5916 -s 592

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 540

C:\Users\Admin\AppData\Local\Temp\B8A0.exe

C:\Users\Admin\AppData\Local\Temp\B8A0.exe

C:\Users\Admin\AppData\Local\Temp\BBFC.exe

C:\Users\Admin\AppData\Local\Temp\BBFC.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\BE8D.exe

C:\Users\Admin\AppData\Local\Temp\BE8D.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3380 -ip 3380

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 416

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa74af46f8,0x7ffa74af4708,0x7ffa74af4718

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6999974672498955587,1767414325453607858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\FFFC.exe

C:\Users\Admin\AppData\Local\Temp\FFFC.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\A4C9.exe

C:\Users\Admin\AppData\Local\Temp\A4C9.exe

C:\Users\Admin\AppData\Local\Temp\B37F.exe

C:\Users\Admin\AppData\Local\Temp\B37F.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\B824.exe

C:\Users\Admin\AppData\Local\Temp\B824.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 126.24.238.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 81.121.18.2.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.251.36.45:443 accounts.google.com tcp
NL 142.251.36.45:443 accounts.google.com tcp
US 8.8.8.8:53 45.36.251.142.in-addr.arpa udp
NL 142.251.36.45:443 accounts.google.com udp
IE 52.111.236.21:443 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
CZ 157.240.30.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
US 8.8.8.8:53 35.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
CZ 157.240.30.35:443 fbcdn.net tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
RU 5.42.92.211:80 5.42.92.211 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
NL 142.251.36.45:443 accounts.google.com udp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

MD5 b820053e0b116dcab686f6c154a9f51d
SHA1 c8b91a82ab7bdd558a7e48609ae7803a2d3434ce
SHA256 ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3
SHA512 ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LB2qB17.exe

MD5 b820053e0b116dcab686f6c154a9f51d
SHA1 c8b91a82ab7bdd558a7e48609ae7803a2d3434ce
SHA256 ed1ff3521a7c2d608db1d811967720d7d2ba2c46a54a4fd9c51fa46888d81fb3
SHA512 ef084df943e6a93845a1beb0ba2179ce949b6ac6afc9a2bc0db81e65c4146e97cdcdc1316e8320d7a5ccc7c197bfbbcf833ec53616f61036520eeac69b318ace

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

MD5 19c8abfb159254382df8b23bb5cc004d
SHA1 8e6d50c6aae7876650fcedbbb4540db9da731715
SHA256 cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0
SHA512 f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\El4rr47.exe

MD5 19c8abfb159254382df8b23bb5cc004d
SHA1 8e6d50c6aae7876650fcedbbb4540db9da731715
SHA256 cbe785159c83adfdd2d876ddb63d10c484153745570bad63d6d3b51f6c7850d0
SHA512 f6f47d446748a86b71feab31f179f82438e6a9e987de2f3028f46d3595530546eefbdd0bb3911497c2b1fe75c51bdfa2b225564897dbde0bac5a9bf3dddfa732

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

MD5 6f2d8bd86981c79b175e4f03f9c7ab17
SHA1 1b81e55f022e1d3f5beaeb5dcd32ec837c986337
SHA256 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0
SHA512 a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\YL5st92.exe

MD5 6f2d8bd86981c79b175e4f03f9c7ab17
SHA1 1b81e55f022e1d3f5beaeb5dcd32ec837c986337
SHA256 97762242d30c83e4db2e58b3ebd368f0d1231cc918d418a6be1a2f41a9e481a0
SHA512 a135aedd8aca49782d6ddc157e9da6a21a865d73cf5e282c6f5f00af747443e9250d9e7f3f0c33bce9ec203493a835c2f5721fb54cd2e3671d538ba0eb86aa09

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mV08SP1.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/3668-28-0x0000000074270000-0x0000000074A20000-memory.dmp

memory/3668-29-0x0000000002010000-0x0000000002020000-memory.dmp

memory/3668-30-0x00000000020C0000-0x00000000020DE000-memory.dmp

memory/3668-31-0x0000000002010000-0x0000000002020000-memory.dmp

memory/3668-32-0x0000000004960000-0x0000000004F04000-memory.dmp

memory/3668-33-0x0000000004F50000-0x0000000004F6C000-memory.dmp

memory/3668-34-0x0000000074270000-0x0000000074A20000-memory.dmp

memory/3668-35-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-36-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-38-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-40-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-42-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-44-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-46-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-48-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-50-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-52-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-54-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-58-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-56-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-60-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-62-0x0000000004F50000-0x0000000004F66000-memory.dmp

memory/3668-63-0x0000000002010000-0x0000000002020000-memory.dmp

memory/3668-65-0x0000000074270000-0x0000000074A20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Wc7828.exe

MD5 d6a4b4e599ca88a2798115b2f57a4a50
SHA1 881756996242273334e4e03642ed6be2917b7cab
SHA256 8113df47b2fed3770126a9c6193ee358d48fc2ed9b5d32e5551c08aa778f1dce
SHA512 5f71d58eb0b8de6393122e9b4a3608b54b919ce7bfb52f7f8207524adbf37b5e57c06f1d5539898471339097c48b647119a3a952cb712221d5a6b6b5f2b72676

memory/1172-69-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1172-70-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1172-71-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1172-73-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe

MD5 f8fa3529c97f505a4d289c487e17bc2b
SHA1 2b07adbc723acd83d582065c2757f22128d93305
SHA256 ea436c873f1717eeff23322111dbb1ae6920ba8ca264a947a92f5ae9824ef739
SHA512 6bf77d4bce90638bfd7766c1a5864bc3c59e0e6216796094aacc077b1a4baa7006999c2aa3fa1e7f4629cc80458db327242df8966f6a01b12c3e2702b104f0b2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3Vh52ZU.exe

MD5 f8fa3529c97f505a4d289c487e17bc2b
SHA1 2b07adbc723acd83d582065c2757f22128d93305
SHA256 ea436c873f1717eeff23322111dbb1ae6920ba8ca264a947a92f5ae9824ef739
SHA512 6bf77d4bce90638bfd7766c1a5864bc3c59e0e6216796094aacc077b1a4baa7006999c2aa3fa1e7f4629cc80458db327242df8966f6a01b12c3e2702b104f0b2

memory/1520-77-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1520-78-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe

MD5 c15cd2487e9b9d5357d72f2a8a17fcab
SHA1 515e47debf5d66e44a8c2823e5d601dd7aa2d8a7
SHA256 f0d6fc5335d727b7d86b80a58d69cce2e0fc576e42954bb290881e15fb20d3dc
SHA512 e63ef7cbe144fe66215ec6b3d42de9bc00aa5eddd72ec9562f5028b30592fd94d6c04c7a344b477c73aa8caaa4bf2769142fa0324cc77ae6d49a70c2a12d94ff

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4BU568lC.exe

MD5 c15cd2487e9b9d5357d72f2a8a17fcab
SHA1 515e47debf5d66e44a8c2823e5d601dd7aa2d8a7
SHA256 f0d6fc5335d727b7d86b80a58d69cce2e0fc576e42954bb290881e15fb20d3dc
SHA512 e63ef7cbe144fe66215ec6b3d42de9bc00aa5eddd72ec9562f5028b30592fd94d6c04c7a344b477c73aa8caaa4bf2769142fa0324cc77ae6d49a70c2a12d94ff

memory/3880-82-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3880-83-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/3880-84-0x0000000007590000-0x0000000007622000-memory.dmp

memory/3880-85-0x0000000007530000-0x0000000007540000-memory.dmp

memory/3880-86-0x0000000007660000-0x000000000766A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe

MD5 a711a367419ac2673178164ee2ca19fc
SHA1 c5593a528109c4673018dba825cfb751ee6bd102
SHA256 2a9fe1b01febf5c93040920621dcf6002169d9d0e5a8ee3ca06e8f4a9a5e5765
SHA512 e19d61ab95b722a4a6f2d9370966309827adc642aab1aa87ba386437758e2b9993e6eacad67471a6ecc5eed492606bcc3b42a2454a2482a997e1df49147d0edb

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5uh7AH0.exe

MD5 a711a367419ac2673178164ee2ca19fc
SHA1 c5593a528109c4673018dba825cfb751ee6bd102
SHA256 2a9fe1b01febf5c93040920621dcf6002169d9d0e5a8ee3ca06e8f4a9a5e5765
SHA512 e19d61ab95b722a4a6f2d9370966309827adc642aab1aa87ba386437758e2b9993e6eacad67471a6ecc5eed492606bcc3b42a2454a2482a997e1df49147d0edb

memory/3880-91-0x0000000008670000-0x0000000008C88000-memory.dmp

memory/3880-92-0x0000000007900000-0x0000000007A0A000-memory.dmp

memory/3880-93-0x0000000007830000-0x0000000007842000-memory.dmp

memory/3880-94-0x0000000007890000-0x00000000078CC000-memory.dmp

memory/3880-95-0x0000000007A10000-0x0000000007A5C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1548.tmp\1549.tmp\154A.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 45fe8440c5d976b902cfc89fb780a578
SHA1 5696962f2d0e89d4c561acd58483b0a4ffeab800
SHA256 f620e0b35ac0ead6ed51984859edc75f7d4921aaa90d829bb9ad362d15504f96
SHA512 efe817ea03c203f8e63d7b50a965cb920fb4f128e72b458a7224c0c1373b31fae9eaa55a504290d2bc0cf55c96fd43f295f9aef6c2791a35fc4ab3e965f6ff25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 98d7448f58e9c788e7d869e779f85dcd
SHA1 2868c0718d8b7c9bd6c58be4c3336965eac7e63d
SHA256 51982ba8764115ea5846f34fff7ec0dcb04a22e9dba0252bbe4cb272f540e30a
SHA512 238120ae423d8f0ea218ea9e75acc13fdad5b5aa17a0fb31b35baea7720196c0e188da0172f398d080d461e2d5412682c9c7fb353f6f4f95e1691158e72df2b3

memory/2568-134-0x0000000007950000-0x0000000007966000-memory.dmp

memory/1520-135-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8e0eb65b176e9264cf1938e78faf0bb7
SHA1 345fcdf7d15178dd73122e7e40c196229aa53fab
SHA256 72aec105694633afa964a53e1717e2531671cb13977751af45f5fd3018903856
SHA512 60fa4171a75428f37f0e1abc6f7cc7ffd7d1462ba1d242cf243d47fd7955b3d0ee7ea0b4686b70070adb4f6db892322da2994901090fae4d435fcbd7bb0d779f

memory/3880-170-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/3880-173-0x0000000007530000-0x0000000007540000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 98d7448f58e9c788e7d869e779f85dcd
SHA1 2868c0718d8b7c9bd6c58be4c3336965eac7e63d
SHA256 51982ba8764115ea5846f34fff7ec0dcb04a22e9dba0252bbe4cb272f540e30a
SHA512 238120ae423d8f0ea218ea9e75acc13fdad5b5aa17a0fb31b35baea7720196c0e188da0172f398d080d461e2d5412682c9c7fb353f6f4f95e1691158e72df2b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4ecebae521e2c2564a094371193fe864
SHA1 61e1e2a338c927007eaf4fe9c5e1655f7a7e3136
SHA256 f765c62074a27afeee09ee01c15020519adc4766292578e9faa5c06945aa71c4
SHA512 692e5885a62c8161b5a51290e0ed18485424e3d94412a42d3f090be9455c9933aeb9fd5b3abd9f68d4ab4701548a3c27b11c1a7d41516f9e0cd50cfc69cbd254

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2f3823f0c61cf0b49538aae394d5085d
SHA1 1115d077c808d5be3e82f7d2b49dea8c2504532f
SHA256 2aab84fb3555f025ffe194849f12a6d9fa552daca66242f2b1e434d46b9f4f49
SHA512 ca59543ded220f8c6cef0ce4a2ab33e7387ce421a8cd64091ffc09fa56270d1d33b82ef52c6ba104516eb0959e63db72dc3257752e08cc3fb6ad738d57ab5ccd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 25ac77f8c7c7b76b93c8346e41b89a95
SHA1 5a8f769162bab0a75b1014fb8b94f9bb1fb7970a
SHA256 8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b
SHA512 df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cbb43c05e646f340ce5ae89d1244fcd6
SHA1 a6ae6ff5f2f8dcf4e8d67f8767524924a3875586
SHA256 59871038d48785ee82299f848f16e3e366ccb4a399452c9d6bb1012c4e898327
SHA512 bc7aed3a3e699eedc661482a97b17a2b0db01cced4745af0124c138041a455cd7372aa736f6a40411116f7187d47571c87bb57aa3a50df2bfe533127f3eeb32d

C:\Users\Admin\AppData\Local\Temp\A301.exe

MD5 839f8fc33a04de86e8d5994b2aa6aea0
SHA1 5cb533c20d178bf038d2da2c61eb95bc26433e7c
SHA256 a6d5771ff701fc2702cf698c991c88429f6d840c02b081c68bd2164e40aa71db
SHA512 f53a78336f45421ab3c3bea36e4e7f3f9e7db0a1e6463261c82f4fc48ef9c4a238f1d23e3ea79850d1c117a7d7090b109c04c3da7775ee4528c227820bfee664

C:\Users\Admin\AppData\Local\Temp\A301.exe

MD5 839f8fc33a04de86e8d5994b2aa6aea0
SHA1 5cb533c20d178bf038d2da2c61eb95bc26433e7c
SHA256 a6d5771ff701fc2702cf698c991c88429f6d840c02b081c68bd2164e40aa71db
SHA512 f53a78336f45421ab3c3bea36e4e7f3f9e7db0a1e6463261c82f4fc48ef9c4a238f1d23e3ea79850d1c117a7d7090b109c04c3da7775ee4528c227820bfee664

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Wv57eP.exe

MD5 9d4d147233220521442956ab1e41861a
SHA1 b8377797207475fd453286d26f2d2a4bb8d83728
SHA256 c7df1e7fd95ac9e40120f055fe83ffd55998d2fb5e8406a787a3b0d2b5732e7d
SHA512 becc06ca3397f84171c7cff851ff7c643e730ca00b9097296c2bc88046bc2d76f127d2594a7caed6d98be9588f2010896ec3adb46c13bc3b7be2aaa8529ec5ec

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe

MD5 e82f10ca30c3674b591ba3761a00ff50
SHA1 e751249903f3eeaab829b9cb8e8ae4219222cd23
SHA256 348da7ee617303b87e3334a8857e346309aaf245a78402dec95bf006b54dc6a9
SHA512 9c1d2a823d8856ec9547eef550484b081bd9ce9527fbbe2bbe7c9988c817eb1dce2a963233175c77c9f9137e4a9c012b65de78e29722b14c36eb004f0d30e8d3

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kx4St2pf.exe

MD5 e82f10ca30c3674b591ba3761a00ff50
SHA1 e751249903f3eeaab829b9cb8e8ae4219222cd23
SHA256 348da7ee617303b87e3334a8857e346309aaf245a78402dec95bf006b54dc6a9
SHA512 9c1d2a823d8856ec9547eef550484b081bd9ce9527fbbe2bbe7c9988c817eb1dce2a963233175c77c9f9137e4a9c012b65de78e29722b14c36eb004f0d30e8d3

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe

MD5 49984d4611ca7c02b606d50a958ddd24
SHA1 836a4d3d4cd8baab3a823750e4d44e0c58001dd8
SHA256 205d80759c8ddf3f0730c60c7f9090305e6b99627dce06edded9807b19dd85c5
SHA512 16d2b04a53cda812057d531ccac485a2e41abd12ca5161b09c5594f98bf44e27fa85f89f9ca02144a2d1d55f64f6ad821f893da6994ebcd90c6a5b42b91087ed

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe

MD5 590173d0a05e97556709039366f07fea
SHA1 4402d6ea0d867c33ae1e852bb357053d01551e02
SHA256 0b4a5327d31e581553a6966ea7e298c50667f241de97b21af50cfb6c81c800e6
SHA512 b220273d2bbcb3fca40463cd034bbe6d00d4019b25e7918f8f16e6e93a9244f3b38b7e7a490a74de0e9fc216ef4a37872cf36c5a053af30ad31d7cf9623045fa

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok8bG1wv.exe

MD5 590173d0a05e97556709039366f07fea
SHA1 4402d6ea0d867c33ae1e852bb357053d01551e02
SHA256 0b4a5327d31e581553a6966ea7e298c50667f241de97b21af50cfb6c81c800e6
SHA512 b220273d2bbcb3fca40463cd034bbe6d00d4019b25e7918f8f16e6e93a9244f3b38b7e7a490a74de0e9fc216ef4a37872cf36c5a053af30ad31d7cf9623045fa

C:\Users\Admin\AppData\Local\Temp\B264.exe

MD5 a3935470ac75a6b353ae690082b55292
SHA1 40408e4df6dc3f8b94b79b64fdaf39a2c6a06d86
SHA256 001a4c426890691c8daff98d7345167b59218d86e1b7dd0d0ffc1fbe58612d32
SHA512 f7bf7f074a5937fa9f04eeba5b8cf89270fca422d3f8701c753a22f77d359be7893627148d95aa954fd2473c7aecf085889ec1dff4958e06ef25f88785c20bde

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe

MD5 648ba0e942d7d0193ff347f9c3abd5e8
SHA1 ef7f4e5743b988a622664b53ed661badfd790c49
SHA256 9213f30827cb1420d351655a57791de3445ded1cd03c40df0bea9e765c1368ba
SHA512 e559614e1c401d7073880d09ec720c09db0f631cc57104e07d600e6c286b1f9aebe010ac9f5c87c9122b95cf228fb6a3818217ff4e3b90a2d2263a95811c12b1

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\FG2wS5ol.exe

MD5 648ba0e942d7d0193ff347f9c3abd5e8
SHA1 ef7f4e5743b988a622664b53ed661badfd790c49
SHA256 9213f30827cb1420d351655a57791de3445ded1cd03c40df0bea9e765c1368ba
SHA512 e559614e1c401d7073880d09ec720c09db0f631cc57104e07d600e6c286b1f9aebe010ac9f5c87c9122b95cf228fb6a3818217ff4e3b90a2d2263a95811c12b1

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe

MD5 7bbb81dd416c9095b091a8928f9f417e
SHA1 5ad4f96fe96dac9fa3b5151cb2da8aeea7818821
SHA256 920d9f07530945a025bc7b108a6b076b5cbd3cab0e040e12c1fe730673786441
SHA512 e518b5bdf2b6f52ef2e8dac7673110eb36ed4cfa9c50dfaec94e60ca727e3acbd56a15b5e5773ef716a5adb78051fe0913c6c8ca2a48994517604bad287790ee

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1OG42Qe5.exe

MD5 7bbb81dd416c9095b091a8928f9f417e
SHA1 5ad4f96fe96dac9fa3b5151cb2da8aeea7818821
SHA256 920d9f07530945a025bc7b108a6b076b5cbd3cab0e040e12c1fe730673786441
SHA512 e518b5bdf2b6f52ef2e8dac7673110eb36ed4cfa9c50dfaec94e60ca727e3acbd56a15b5e5773ef716a5adb78051fe0913c6c8ca2a48994517604bad287790ee

C:\Users\Admin\AppData\Local\Temp\B264.exe

MD5 a3935470ac75a6b353ae690082b55292
SHA1 40408e4df6dc3f8b94b79b64fdaf39a2c6a06d86
SHA256 001a4c426890691c8daff98d7345167b59218d86e1b7dd0d0ffc1fbe58612d32
SHA512 f7bf7f074a5937fa9f04eeba5b8cf89270fca422d3f8701c753a22f77d359be7893627148d95aa954fd2473c7aecf085889ec1dff4958e06ef25f88785c20bde

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\IB0tc6CQ.exe

MD5 49984d4611ca7c02b606d50a958ddd24
SHA1 836a4d3d4cd8baab3a823750e4d44e0c58001dd8
SHA256 205d80759c8ddf3f0730c60c7f9090305e6b99627dce06edded9807b19dd85c5
SHA512 16d2b04a53cda812057d531ccac485a2e41abd12ca5161b09c5594f98bf44e27fa85f89f9ca02144a2d1d55f64f6ad821f893da6994ebcd90c6a5b42b91087ed

C:\Users\Admin\AppData\Local\Temp\B514.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\B514.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

memory/6132-318-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6132-320-0x0000000000400000-0x0000000000433000-memory.dmp

memory/6132-322-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4712-324-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4712-325-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4712-327-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B65B.tmp\B65C.tmp\B65D.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bb1d.TMP

MD5 a64aa92849f09e69b263825130aecf73
SHA1 be6e42f42a49f2c29f4f19768603ca7bb9704c13
SHA256 3b46fa02c6c00257601f3951b1b6fc05bc4c9ca3432b5374832ad2876933da7d
SHA512 8f55c01c8cb275919470ad4b52fdc2c2494a274fe96831c3878715438e02e6083107b4fc5889f731b605eccf12b78dbbf9fb80a1f85787f86381f3fad59549f7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 57db448a7c6827b185ce07fdd954b76a
SHA1 1d3d4f94156b6b6f98209bd327727dd4d3691f9c
SHA256 d92e551cbc5193fad9442910c2ce8830f8d2d920f57868670a90a0c392e56897
SHA512 7a325b004252fb362482b1f188672b20ca1471944bf73c4599277e49cb4acb9ad426ede127b9eaf8fc4ee070172848ec45cb5bbb359f26b2460db438f5e6b924

C:\Users\Admin\AppData\Local\Temp\B8A0.exe

MD5 93990eb50d3989187d96bbb7ee7307d2
SHA1 1677aed3760a6348b97aa163134d23b49b7ed298
SHA256 25c69320a3d9cd10abae8aaf565082a44158ee506173030e741e9c44d08fed6e
SHA512 e32474eaf50b378011af84b627de25a9b13fc8608aaa71135990bd0fb89c589a24ab33a299dc22247908e6617856b7a940d004e73fd0adde847590fcbcb89a95

C:\Users\Admin\AppData\Local\Temp\B8A0.exe

MD5 93990eb50d3989187d96bbb7ee7307d2
SHA1 1677aed3760a6348b97aa163134d23b49b7ed298
SHA256 25c69320a3d9cd10abae8aaf565082a44158ee506173030e741e9c44d08fed6e
SHA512 e32474eaf50b378011af84b627de25a9b13fc8608aaa71135990bd0fb89c589a24ab33a299dc22247908e6617856b7a940d004e73fd0adde847590fcbcb89a95

memory/3664-350-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

memory/6132-351-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BBFC.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\BBFC.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/3664-356-0x00007FFA70130000-0x00007FFA70BF1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BE8D.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\BE8D.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/5736-363-0x0000000073F60000-0x0000000074710000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe

MD5 cded7d5b117a56fe62558b4e745efcb1
SHA1 f5f0d4f7533e696b778d9f70ebf17dbfe4eadea8
SHA256 24d936540c5d20b1ad3d87c3c18e2cb735193551f02cb9b90656bfea9a7cdafb
SHA512 4cbce60d1b25169369b979f283747f36b969cdc0fba9062b77877eef3c6178f8e88c5503d7d745b4a6f30b73ae6423af4feeca3cab26c765b65f053c56f85696

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2hH861vm.exe

MD5 cded7d5b117a56fe62558b4e745efcb1
SHA1 f5f0d4f7533e696b778d9f70ebf17dbfe4eadea8
SHA256 24d936540c5d20b1ad3d87c3c18e2cb735193551f02cb9b90656bfea9a7cdafb
SHA512 4cbce60d1b25169369b979f283747f36b969cdc0fba9062b77877eef3c6178f8e88c5503d7d745b4a6f30b73ae6423af4feeca3cab26c765b65f053c56f85696

memory/5140-367-0x0000000000610000-0x000000000064E000-memory.dmp

memory/5140-368-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/5736-369-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/5140-376-0x0000000007370000-0x0000000007380000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 52ac7ef1f99eb055398c879085b715a1
SHA1 ad97a7d26b3a187a02967929d7089530c7b9d07e
SHA256 c6650d6a7b4e0daabce6b8e1b8d38e49474a34de98e51706b2a69e0a19b727c4
SHA512 64f03631994940c99545abfd21e703975d713147d75b87abeae51f0f4b2497041b824be8a1427c2611ac77bb2ea4e7a235d17995467f5f20abbafa8bf19775f7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b2a86352a217259d70bc218d78068198
SHA1 63ad96b652bcbaf54395e8431e524826bcc56ec1
SHA256 1eb53067acd9ae46b716f9a37e61291fdd338edc15fc58bbd585aad07668f10a
SHA512 5d0a1b0aa926e6e1217fc32e77954c72a65cd51bf9529a2f2c724ce2a5ed53a237087e6969ff03e09631770f6d643694e66053a088a6be0dc4bb2038f12f984f

memory/3664-552-0x00007FFA70130000-0x00007FFA70BF1000-memory.dmp

memory/5736-553-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/5140-554-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/5736-555-0x0000000007CB0000-0x0000000007CC0000-memory.dmp

memory/5140-556-0x0000000007370000-0x0000000007380000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9df2e42549f872b3dc0d61694e7c5dc1
SHA1 0bdd2c6db8a6a95d5058c8242d5a05db582135c1
SHA256 34adc3c4f9363e1b069fe0f3131f589251784ec4c03dc4bfccb6bedb29e043a9
SHA512 c8bc635269b6f00da6fd684842c236ce22cc0b2e8fb02f0410623038db3aaf0ecde3451ab4c98c2575b959f351871d1f310bb5919d78cac52a26188ee593f0b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 463850447e448c0b4af827345e0330d3
SHA1 c561b36947ba4f9497ffb682d8eb05c981847359
SHA256 0d0da3f5d56b804a0dcbc9663ac947726839fe13b8631501d77de67aa8e7277e
SHA512 42a8958d9435353d0fb87c00e536d4a641a89df1d1abf9ef431254c76acaef0ca276fdc9ef139fa240326284cc0fd7947401e148d3a1ea2af64f4ea2010d91c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d7664a991d7c7ba14c270035d73ab069
SHA1 f0a4e4741530e9ac8db39aed6fd27f7e3a1550ef
SHA256 a1df5141b3854d43d2fb3e0fdb3d4001804b1bdfafbf47d1ede6d4c9e954fc12
SHA512 d7fbe123b8cb83b5c59b78318379c40784bdc44e889bc3e7bb3dc7dc3699e012e6ab8cb2d61e917313c983572f07e3aa359038a2ab8d9814fe6c2e356cce5cd3

memory/3664-610-0x00007FFA70130000-0x00007FFA70BF1000-memory.dmp

memory/6064-612-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/6064-613-0x0000000000DB0000-0x0000000001CDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

memory/5508-639-0x0000000073F60000-0x0000000074710000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/5508-638-0x00000000004D0000-0x00000000009E6000-memory.dmp

memory/6064-646-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/5508-644-0x0000000005360000-0x0000000005370000-memory.dmp

memory/2308-647-0x00000000023D0000-0x00000000024D0000-memory.dmp

memory/5508-650-0x0000000005290000-0x0000000005291000-memory.dmp

memory/2308-648-0x0000000002310000-0x0000000002319000-memory.dmp

memory/5508-649-0x0000000005510000-0x00000000055AC000-memory.dmp

memory/5772-651-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5772-652-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5260-654-0x00000000043C0000-0x00000000047C4000-memory.dmp

memory/5260-655-0x00000000047D0000-0x00000000050BB000-memory.dmp

memory/5260-657-0x0000000000400000-0x000000000266D000-memory.dmp

memory/5508-661-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/6036-660-0x00000000023B0000-0x00000000023E6000-memory.dmp

memory/5508-664-0x0000000005360000-0x0000000005370000-memory.dmp

memory/6036-663-0x0000000004880000-0x0000000004890000-memory.dmp

memory/6036-662-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/6036-665-0x0000000004EC0000-0x00000000054E8000-memory.dmp

memory/6036-666-0x0000000004D30000-0x0000000004D52000-memory.dmp

memory/6036-670-0x00000000056C0000-0x0000000005726000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_blq5xxog.ixo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/6036-667-0x0000000005560000-0x00000000055C6000-memory.dmp

memory/6036-678-0x0000000005730000-0x0000000005A84000-memory.dmp

memory/5772-680-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2568-679-0x00000000026C0000-0x00000000026D6000-memory.dmp

memory/5260-685-0x00000000043C0000-0x00000000047C4000-memory.dmp

memory/5260-684-0x0000000000400000-0x000000000266D000-memory.dmp

memory/3784-687-0x00007FF6EA7D0000-0x00007FF6EAD71000-memory.dmp

memory/5260-688-0x00000000047D0000-0x00000000050BB000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/6036-700-0x0000000073F60000-0x0000000074710000-memory.dmp

memory/4788-717-0x00000000005F0000-0x000000000064A000-memory.dmp

memory/5508-723-0x0000000005610000-0x0000000005625000-memory.dmp

memory/5508-726-0x0000000005610000-0x0000000005625000-memory.dmp

memory/5508-724-0x0000000005610000-0x0000000005625000-memory.dmp