Malware Analysis Report

2025-01-23 09:06

Sample ID 231010-y5cwnaba97
Target file.exe
SHA256 80e818d5697a79173104ce849679df30a075d2afe4f07c9e6c833f23daf5ac71
Tags
amadey dcrat glupteba healer redline sectoprat smokeloader 6012068394_99 pixelscloud up3 backdoor google discovery dropper evasion infostealer loader persistence phishing rat rootkit spyware trojan mystic lutyr magia stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

80e818d5697a79173104ce849679df30a075d2afe4f07c9e6c833f23daf5ac71

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer redline sectoprat smokeloader 6012068394_99 pixelscloud up3 backdoor google discovery dropper evasion infostealer loader persistence phishing rat rootkit spyware trojan mystic lutyr magia stealer

Windows security bypass

SectopRAT payload

Detect Mystic stealer payload

Suspicious use of NtCreateUserProcessOtherParentProcess

SectopRAT

Healer

Detected google phishing page

Amadey

RedLine

Modifies Windows Defender Real-time Protection settings

Detects Healer an antivirus disabler dropper

RedLine payload

Mystic

Glupteba

DcRat

Glupteba payload

SmokeLoader

Modifies boot configuration data using bcdedit

Downloads MZ/PE file

Drops file in Drivers directory

Blocklisted process makes network request

Modifies Windows Firewall

Possible attempt to disable PatchGuard

Stops running service(s)

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Windows security modification

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Manipulates WinMon driver.

Manipulates WinMonFS driver.

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Program Files directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of UnmapMainImage

Suspicious behavior: MapViewOfSection

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies system certificate store

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: GetForegroundWindowSpam

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-10 20:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-10 20:21

Reported

2023-10-10 20:28

Platform

win7-20230831-en

Max time kernel

150s

Max time network

153s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detected google phishing page

phishing google

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
File created C:\Windows\system32\drivers\Winmon.sys C:\Windows\rss\csrss.exe N/A
File created C:\Windows\System32\drivers\etc\hosts C:\Program Files\Google\Chrome\updater.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Possible attempt to disable PatchGuard

evasion

Stops running service(s)

evasion

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\872B.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8883.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8B71.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8F69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Windows\system32\conhost.exe N/A
N/A N/A C:\Windows\system32\conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F177.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F7DE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Program Files\Google\Chrome\updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8F69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\system32\taskeng.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\31839b57a4f11171d6abc8bbc4451ee4.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup6 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\85A4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Manipulates WinMon driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMon C:\Windows\rss\csrss.exe N/A

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\updater.exe C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
File created C:\Program Files\Google\Libs\WR64.sys C:\Program Files\Google\Chrome\updater.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
File created C:\Windows\Logs\CBS\CbsPersist_20231010202704.cab C:\Windows\system32\makecab.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{558A1F81-67AB-11EE-B333-7AA063A69366} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000089f363f1004f55de63a5eb3515af1726bffa3791587e58a56ecd8b318b3125d5000000000e8000000002000020000000e08b374aa20a56fb81a5973ffd32ec5b7aa56f1390af7f52e27849ac454898e620000000651a6ad970b4caa8bc0c5d1529f9c852316e1ac64ab39f0c9e9a79e1ec87ff234000000055bd6f6982908a57bd86e0658cc315ce340ccd50dfd6a1e4d157c427876f70045290199930c7337b27b7503d9a3d8dedfc451fedadf4e1f411b98ab78680eb94 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55BA5741-67AB-11EE-B333-7AA063A69366} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e46b2db8fbd901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac2000000000200000000001066000000010000200000002feb27513469b867ce15131824e5756998536eaea7c30817b94bdfaef3d39f74000000000e8000000002000020000000b0fd5e6c2dd8f72dc804d47d3cb0241d99012c1ad00e29320f75eab42c64974c9000000043686d1f530257e1a4f40322594601e30f525f3de8a1155689fe63adc2cfca680859ab8c5229727f674b45460bf4f9d0e205d894daec5ae0eeb04c25fa7e3c4e3dcc87ebf0bbff237737a6f57ffc648159a272fc7ce07a406b013400592a76b303e40d83744175b4b12a83acc38533a20a3af470fd4e378c3da79ed1122d253bd754eb1d0095505b2655d543ec645c7840000000eef854ad03d90322774054aba0e310992b4271ebd95a0a6da62b33b4a7f703e3b5fcd4159ac2ee9d23a7cf1e1e38ef4f7c796888268e080296c2cc1e8babbafd C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403734582" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" C:\Windows\system32\netsh.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" C:\Windows\system32\netsh.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-551 = "North Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c8523048b8fbd901 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 C:\Windows\rss\csrss.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Windows\rss\csrss.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8D65.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\conhost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\schtasks.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\bcdedit.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Program Files\Google\Chrome\updater.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2412 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2412 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2412 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2412 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2412 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2412 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2412 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2384 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2384 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2384 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2384 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2384 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2384 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2384 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2804 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\SysWOW64\WerFault.exe
PID 2804 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\SysWOW64\WerFault.exe
PID 2804 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\SysWOW64\WerFault.exe
PID 2804 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\SysWOW64\WerFault.exe
PID 2804 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\SysWOW64\WerFault.exe
PID 2804 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\SysWOW64\WerFault.exe
PID 2804 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\SysWOW64\WerFault.exe
PID 1196 wrote to memory of 2940 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\85A4.exe
PID 1196 wrote to memory of 2940 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\85A4.exe
PID 1196 wrote to memory of 2940 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\85A4.exe
PID 1196 wrote to memory of 2940 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\85A4.exe
PID 1196 wrote to memory of 2940 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\85A4.exe
PID 1196 wrote to memory of 2940 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\85A4.exe
PID 1196 wrote to memory of 2940 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\85A4.exe
PID 2940 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
PID 2940 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
PID 2940 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
PID 2940 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
PID 2940 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
PID 2940 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
PID 2940 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\85A4.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe
PID 1196 wrote to memory of 2508 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\872B.exe
PID 1196 wrote to memory of 2508 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\872B.exe
PID 1196 wrote to memory of 2508 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\872B.exe
PID 1196 wrote to memory of 2508 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\872B.exe
PID 2796 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
PID 2796 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
PID 2796 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
PID 2796 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
PID 2796 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
PID 2796 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
PID 2796 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe
PID 2640 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
PID 2640 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
PID 2640 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
PID 2640 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
PID 2640 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
PID 2640 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
PID 2640 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe
PID 2504 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 36

C:\Users\Admin\AppData\Local\Temp\85A4.exe

C:\Users\Admin\AppData\Local\Temp\85A4.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe

C:\Users\Admin\AppData\Local\Temp\872B.exe

C:\Users\Admin\AppData\Local\Temp\872B.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

C:\Users\Admin\AppData\Local\Temp\8B71.exe

C:\Users\Admin\AppData\Local\Temp\8B71.exe

C:\Users\Admin\AppData\Local\Temp\8883.bat

"C:\Users\Admin\AppData\Local\Temp\8883.bat"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2508 -s 132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 280

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8B2F.tmp\8B30.tmp\8B60.bat C:\Users\Admin\AppData\Local\Temp\8883.bat"

C:\Users\Admin\AppData\Local\Temp\8D65.exe

C:\Users\Admin\AppData\Local\Temp\8D65.exe

C:\Users\Admin\AppData\Local\Temp\8F69.exe

C:\Users\Admin\AppData\Local\Temp\8F69.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 132

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275458 /prefetch:2

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\BFAD.exe

C:\Users\Admin\AppData\Local\Temp\BFAD.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {673FBD4F-A3CA-4982-8485-8DCBC2CD345B} S-1-5-21-2180306848-1874213455-4093218721-1000:XEBBURHY\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231010202704.log C:\Windows\Logs\CBS\CbsPersist_20231010202704.cab

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Users\Admin\AppData\Local\Temp\F177.exe

C:\Users\Admin\AppData\Local\Temp\F177.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 528

C:\Windows\system32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Users\Admin\AppData\Local\Temp\F7DE.exe

C:\Users\Admin\AppData\Local\Temp\F7DE.exe

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 508

C:\Users\Admin\AppData\Local\Temp\FACC.exe

C:\Users\Admin\AppData\Local\Temp\FACC.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1818916531-151264071413630942971799888289-2145689391-805724997-128883581786552612"

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "167731330820996351981562161279681665250-1085952287-942073446-1137486070-280089132"

C:\Windows\system32\taskeng.exe

taskeng.exe {4F7CCC5B-F759-4105-9BFA-83BFF25AD323} S-1-5-18:NT AUTHORITY\System:Service:

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -timeout 0

C:\Windows\system32\bcdedit.exe

C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}

C:\Windows\system32\bcdedit.exe

C:\Windows\Sysnative\bcdedit.exe /v

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

Network

Country Destination Domain Proto
FI 77.91.68.29:80 77.91.68.29 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
FI 77.91.124.1:80 77.91.124.1 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.35:443 facebook.com tcp
CZ 157.240.30.35:443 facebook.com tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
CZ 157.240.30.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
CZ 157.240.30.35:443 fbsbx.com tcp
CZ 157.240.30.35:443 fbsbx.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.youtube.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.206:443 accounts.youtube.com tcp
NL 142.250.179.206:443 accounts.youtube.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
NL 142.250.179.141:443 accounts.google.com tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 28f2025a-2558-4350-be70-e6b99d7d68d2.uuid.cdntokiog.studio udp
US 8.8.8.8:53 msdl.microsoft.com udp
US 204.79.197.219:443 msdl.microsoft.com tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 vsblobprodscussu5shard30.blob.core.windows.net udp
US 20.150.38.228:443 vsblobprodscussu5shard30.blob.core.windows.net tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 host-file-host6.com udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 host-host-file8.com udp
US 172.67.212.39:80 bytecloudasa.website tcp
NL 194.169.175.127:80 host-host-file8.com tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 vsblobprodscussu5shard58.blob.core.windows.net udp
US 20.150.70.36:443 vsblobprodscussu5shard58.blob.core.windows.net tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 server2.cdntokiog.studio udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 74.125.128.127:19302 stun.l.google.com udp
BG 185.82.216.49:443 server2.cdntokiog.studio tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.96.0:443 walkinglate.com tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
FR 163.172.154.142:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp
DE 51.68.190.80:14433 xmr-eu1.nanopool.org tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

MD5 44217a9da06ef1733107996aaad26f4a
SHA1 fafe743e243cd85601d545487c5b2f3933083127
SHA256 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e
SHA512 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

MD5 44217a9da06ef1733107996aaad26f4a
SHA1 fafe743e243cd85601d545487c5b2f3933083127
SHA256 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e
SHA512 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689

\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

MD5 44217a9da06ef1733107996aaad26f4a
SHA1 fafe743e243cd85601d545487c5b2f3933083127
SHA256 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e
SHA512 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

MD5 44217a9da06ef1733107996aaad26f4a
SHA1 fafe743e243cd85601d545487c5b2f3933083127
SHA256 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e
SHA512 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

memory/2808-23-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2808-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2808-24-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2808-26-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2808-27-0x0000000000400000-0x0000000000409000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

memory/1196-32-0x0000000002C10000-0x0000000002C26000-memory.dmp

memory/2808-34-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\85A4.exe

MD5 d23b61506624e67cd57a0b8406843edc
SHA1 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea
SHA256 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a
SHA512 ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc

C:\Users\Admin\AppData\Local\Temp\85A4.exe

MD5 d23b61506624e67cd57a0b8406843edc
SHA1 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea
SHA256 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a
SHA512 ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc

\Users\Admin\AppData\Local\Temp\85A4.exe

MD5 d23b61506624e67cd57a0b8406843edc
SHA1 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea
SHA256 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a
SHA512 ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc

\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe

MD5 75bcc1f5643821ff846a4a623aed1078
SHA1 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f
SHA256 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a
SHA512 df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe

MD5 75bcc1f5643821ff846a4a623aed1078
SHA1 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f
SHA256 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a
SHA512 df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96

\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe

MD5 75bcc1f5643821ff846a4a623aed1078
SHA1 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f
SHA256 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a
SHA512 df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TC8GG4oS.exe

MD5 75bcc1f5643821ff846a4a623aed1078
SHA1 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f
SHA256 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a
SHA512 df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96

C:\Users\Admin\AppData\Local\Temp\872B.exe

MD5 1e98b2aab70cf73329270535ca121019
SHA1 62ea94364eacec8dc7ab88e2eccd05766eb40736
SHA256 c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd
SHA512 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e

\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe

MD5 784de1f2a7724b915df5022c5d3ee57e
SHA1 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9
SHA256 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4
SHA512 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe

MD5 784de1f2a7724b915df5022c5d3ee57e
SHA1 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9
SHA256 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4
SHA512 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564

\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe

MD5 784de1f2a7724b915df5022c5d3ee57e
SHA1 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9
SHA256 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4
SHA512 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564

\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe

MD5 fd952b68f1541e064bcd239badbf2cad
SHA1 81a0e336f12adb4d4ea22b3d9230ce692e85363f
SHA256 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab
SHA512 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe

MD5 fd952b68f1541e064bcd239badbf2cad
SHA1 81a0e336f12adb4d4ea22b3d9230ce692e85363f
SHA256 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab
SHA512 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2

\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe

MD5 fd952b68f1541e064bcd239badbf2cad
SHA1 81a0e336f12adb4d4ea22b3d9230ce692e85363f
SHA256 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab
SHA512 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Vg7CY8Fv.exe

MD5 fd952b68f1541e064bcd239badbf2cad
SHA1 81a0e336f12adb4d4ea22b3d9230ce692e85363f
SHA256 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab
SHA512 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bb7ie3oC.exe

MD5 784de1f2a7724b915df5022c5d3ee57e
SHA1 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9
SHA256 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4
SHA512 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564

C:\Users\Admin\AppData\Local\Temp\8883.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe

MD5 48d9d7ecee6a0b41e01f25e79150c0fb
SHA1 df09c90062d4cd737592972159deb13f4e71f754
SHA256 db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556
SHA512 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe

MD5 48d9d7ecee6a0b41e01f25e79150c0fb
SHA1 df09c90062d4cd737592972159deb13f4e71f754
SHA256 db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556
SHA512 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

C:\Users\Admin\AppData\Local\Temp\8883.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe

MD5 48d9d7ecee6a0b41e01f25e79150c0fb
SHA1 df09c90062d4cd737592972159deb13f4e71f754
SHA256 db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556
SHA512 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2

C:\Users\Admin\AppData\Local\Temp\8B71.exe

MD5 272d1ce9de469edf32f883556ba15be7
SHA1 d98fe2ac8215c27a8d19180150eab3b510301489
SHA256 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336
SHA512 c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916

\Users\Admin\AppData\Local\Temp\872B.exe

MD5 1e98b2aab70cf73329270535ca121019
SHA1 62ea94364eacec8dc7ab88e2eccd05766eb40736
SHA256 c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd
SHA512 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e

\Users\Admin\AppData\Local\Temp\872B.exe

MD5 1e98b2aab70cf73329270535ca121019
SHA1 62ea94364eacec8dc7ab88e2eccd05766eb40736
SHA256 c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd
SHA512 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e

\Users\Admin\AppData\Local\Temp\872B.exe

MD5 1e98b2aab70cf73329270535ca121019
SHA1 62ea94364eacec8dc7ab88e2eccd05766eb40736
SHA256 c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd
SHA512 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e

\Users\Admin\AppData\Local\Temp\IXP005.TMP\KI6yN2Co.exe

MD5 48d9d7ecee6a0b41e01f25e79150c0fb
SHA1 df09c90062d4cd737592972159deb13f4e71f754
SHA256 db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556
SHA512 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

\Users\Admin\AppData\Local\Temp\872B.exe

MD5 1e98b2aab70cf73329270535ca121019
SHA1 62ea94364eacec8dc7ab88e2eccd05766eb40736
SHA256 c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd
SHA512 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

C:\Users\Admin\AppData\Local\Temp\8D65.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\8D65.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\8B2F.tmp\8B30.tmp\8B60.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

\Users\Admin\AppData\Local\Temp\8B71.exe

MD5 272d1ce9de469edf32f883556ba15be7
SHA1 d98fe2ac8215c27a8d19180150eab3b510301489
SHA256 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336
SHA512 c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916

\Users\Admin\AppData\Local\Temp\8B71.exe

MD5 272d1ce9de469edf32f883556ba15be7
SHA1 d98fe2ac8215c27a8d19180150eab3b510301489
SHA256 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336
SHA512 c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916

\Users\Admin\AppData\Local\Temp\8B71.exe

MD5 272d1ce9de469edf32f883556ba15be7
SHA1 d98fe2ac8215c27a8d19180150eab3b510301489
SHA256 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336
SHA512 c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916

\Users\Admin\AppData\Local\Temp\8B71.exe

MD5 272d1ce9de469edf32f883556ba15be7
SHA1 d98fe2ac8215c27a8d19180150eab3b510301489
SHA256 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336
SHA512 c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916

C:\Users\Admin\AppData\Local\Temp\8F69.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\8F69.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2828-184-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

memory/2828-185-0x0000000000890000-0x000000000089A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{558A1F81-67AB-11EE-B333-7AA063A69366}.dat

MD5 1682ecb213cdf20c6ed698f69d20b89c
SHA1 c50256a3d596caf4272456119936c7a686a684be
SHA256 13c82c5c655e6f624092e82f09a147afc48709fc4b0e52c6078ee3c64451fe9c
SHA512 5a2a38ab1a39a037776af7053313650a67ac6c01f39071b5d45c36d8abac70c4798a21d58ed3319edd6608f60457d8d4c9ad380d42dcefdffbf2c3b6fe79f05a

C:\Users\Admin\AppData\Local\Temp\Cab99CF.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar99FF.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6534fe685672d90bdddcb11cba4a0b52
SHA1 f4267dde4806e64eb5680efc22b4fa2d6660820c
SHA256 bd8597746c1befa561ff730e375f05bf8115f5ba5c062152ed5387c451f2288d
SHA512 8799f5bb569b950d792990d3d9a3e3c8d509b8c7e40bf584c8d96a9c30eb4c658fcc590010c30150702a71674965880461cecee7356227f01360c4f33662c3c1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7b1e0bf9792c7aae3b7e3eb5014c99cf
SHA1 fb0be12216c6a2be23a4d53bd82b68487620c655
SHA256 87e7d6cdf22646ada3fbb0ccf12bccf1d02833f687c4a1646ed069f8d2c99b81
SHA512 68b4cdc79fb6275d80324c97ac8170cfe897c9cc47a13f8914966349dbccc11476627b106b6ec2de29676a08efdcf660348a95404f319baa2e605b6f2c5205d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8b59ff81c95adf118692f824f64a50fd
SHA1 ae7b380c3e634faae683583039e41548603f5958
SHA256 75215dd94d197320032884376dada1663d6c5475acd8010d7a73e4434bb6f4a1
SHA512 01cfa290ffc56a9961a09db8014852a852561aa7c919f013a53f85ea824fbf57ff8b53054b4555b9c364a9114d45c223d1b72b8e5994c5c3b532612b522d6f50

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ABGWT92S\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5h7y85m\imagestore.dat

MD5 2823f30773f0f68cc3b3362167f20608
SHA1 ba4a4c7be58b2641e4d1ae27aa9b2ffee6727047
SHA256 8c4ed4b8a21b5b202a6f11ef9c752da7ee2334a9df50d53829f7abce332f35be
SHA512 97dee3306aa3455e67fcd263023ad61d33a948ed9ca63046f3caa8f72911967651fb1cb7c8edad15cf5665d1a4aece2c6640eb687f7d786c9381ee358a761cb9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 12141d7c824335f5099986ed183f8e31
SHA1 84dfc5b9b927ce394f32f4e1f14e4925359f9140
SHA256 30851405de9e5efb4975e95efa54e59d6187e3701cf48cfe8b09511adbee7ca4
SHA512 9838f441a372073e55242e9d4e90b26d6ef0c81a1c262f98cad83f7218f9d2e694d6dd7d45d94833aa933c9ec37c927c7dea9337c60bf5b28e31268f6003871c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 780f5af986425214ffacdeb0d677746e
SHA1 27c8e3e497e9a409c26fe752b3ee30ea4d730807
SHA256 c833d2a2fa54bb62db623817b55187e6081a63ce13ec69c218a2488b4aa74285
SHA512 8a9c18bdecba145b340a24cfaace9a5ca9bec8892273697eb41e153387e3d4f38eba2b74633b905391726da8fd7bf4552b402f18f77411e90a7ecc3cee76689e

memory/2828-530-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 683d810b2f94d62e55e9594965270ccf
SHA1 88c91a1ea36ef32f52d09febe6f1ab92fad57361
SHA256 9eed473816cd50ef007b13216b9edfbd46aec8bb35968a28a196a3cab11f946a
SHA512 6f2b45bd50006ecee0db11862a070fe4328c5f3dfdfee6b391d87331ef936d81134892b119e5779903cd6b91ca9bc59923c5b39161a078892a937f7471ac7330

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a96256692d873ed3469f56c48bf43b0e
SHA1 f54464f0cb2005f164fa37e7d9b42a0249166730
SHA256 206537093ed247ae0573c4309f1fe7013cae31691462b664762229cea308cb67
SHA512 e3fb3ead9961b3e2b8584eb39005b952e9adef40157592a5716e5e96bf6332e2ace0823d26f9f10d9a3466002f044b6e4cafe18d81393ebab782e3bfacdac251

C:\Users\Admin\AppData\Local\Temp\BFAD.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 00ed61015c212d0096847ad841637f62
SHA1 bd9dbb64186e353c60f100ae3a068b9af588c0e4
SHA256 d5d3e85fc3c2f9b3dbd277827ce84c89d876bf380808dcb2b45e73661b4327ca
SHA512 576dbcdedbe54bccaadae468dd4545f04ece3949939ecff741b4d0996b929ce34fbab10df059c62e3e049be2f1191ace869967cf406f614c9c94e0500e63d042

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 48f02332bc48f79af40f08b399d04f69
SHA1 360ecb04debfa2d080825484e48d66f10f5f9146
SHA256 f2060694c782e7db5d1d41231810929d2533666d4a91d1c4dbd98a4db33f458f
SHA512 a23d4a5d668db02a910ebb4cf8438fe20f9da8658d597e463d681b75c5f9269d0fa15d1f1eb59bc61152e2e1a0f9e594175e49a13eb87ed1afae3897fe4c1a5c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a857542fb7930aee5dfc9f5a7d579a42
SHA1 22d516259ef7b2136e6e458bc02ee0d39419aeaa
SHA256 4bae2e22783eed4a18618ff6e4416262b7d74bcce8de27d2b2c7666bcf2549ed
SHA512 516d25387a905ac1d10e91bcf9e70aa59cddd82ded622c771c4e4ca4ffb8ccfbcb523dc862f76d99340d2c8f61d8f5a5a2148d1772c40960a883fa7dad16f31a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 23990a19d27dd8aea89dc94f7238debc
SHA1 a8375e4cbe52ca28b2c7d39666b0a02da38bee77
SHA256 07e79f0b07ac1bf7f90d12fc6bceae03f8b83b38d088f91456440680f45cda48
SHA512 965f2a52caeac24b507776c37abb02c01ca3addc897be6852b8b2f7c94814e85039ba8d589f0a7efb63b16bf6787f344b59910b6065002bd77ac2cd254b8000c

memory/1672-724-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/1672-742-0x00000000003B0000-0x00000000012DA000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d96596c1ad50f309d9a2db10ed34a36
SHA1 e575543b689fd4092e1c168fa7bd2a0314460025
SHA256 9b48c610f33887543d0594110c82736dde6487eb004f7cf899758dd797ccc3fc
SHA512 1811d8bd78bc744f5501a8c12f40962af0d0b05bb402142c869909dde889edc6ddc0da1271a8db01135893c201c5a4e5778bb23c0845b49e52805bd3855016f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cc1a426e7f5fb1432f752ba032045309
SHA1 8b634662245fb978d7b24b7ab297267056072c48
SHA256 1e53d9267b9cc2097f144e802f50030c1c88d00e49ddba5c48284adac69107f7
SHA512 e99526b5d2cba4a29769ad933c08e35817d3fd55bfd8a49a08d4a3e7f2031fd021f5f9d5f5b7c0932d8ae8896a6c80dce20a59726d11e858717e21d9903c7fa9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a705e3846507a2f2883e3dfd08c02ebf
SHA1 fd1b9b07d9688d87e2a98fb6cd349ed63419c689
SHA256 1011e27d3d6d30f9797d26574cdfbac096ded333f9f3dbddbfc160456f756e4e
SHA512 3a0df75a103273ccbeb1b7048a764dea6fae7c39e30c61c3463b6edafd4d45a13d142198fcc3d75010c2c582c7a5249b4a09f01f89f3389bc0f154ce7e3bc8f0

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/2288-914-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/2288-916-0x0000000000E70000-0x0000000001386000-memory.dmp

memory/1620-918-0x0000000003FB0000-0x00000000043A8000-memory.dmp

memory/1672-919-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/1620-920-0x0000000003FB0000-0x00000000043A8000-memory.dmp

memory/1620-923-0x00000000043B0000-0x0000000004C9B000-memory.dmp

memory/1252-925-0x00000000001B0000-0x00000000001B9000-memory.dmp

memory/1220-926-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1220-928-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1252-927-0x00000000002B0000-0x00000000003B0000-memory.dmp

memory/1220-922-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2828-930-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

memory/1620-929-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2288-943-0x00000000052A0000-0x00000000052E0000-memory.dmp

memory/2288-949-0x0000000000500000-0x0000000000501000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7E9TXN45\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

memory/2288-962-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/1620-963-0x0000000003FB0000-0x00000000043A8000-memory.dmp

memory/1620-961-0x0000000000400000-0x000000000266D000-memory.dmp

memory/1620-964-0x00000000043B0000-0x0000000004C9B000-memory.dmp

memory/1220-966-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1196-965-0x0000000002DD0000-0x0000000002DE6000-memory.dmp

memory/3064-970-0x0000000004020000-0x0000000004418000-memory.dmp

memory/3064-971-0x0000000004020000-0x0000000004418000-memory.dmp

memory/3064-972-0x0000000000400000-0x000000000266D000-memory.dmp

memory/3064-978-0x0000000000400000-0x000000000266D000-memory.dmp

memory/3064-979-0x0000000004020000-0x0000000004418000-memory.dmp

memory/2288-980-0x00000000052A0000-0x00000000052E0000-memory.dmp

memory/1016-981-0x0000000004020000-0x0000000004418000-memory.dmp

memory/1304-982-0x000000013F060000-0x000000013F601000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F177.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

memory/1016-999-0x0000000004020000-0x0000000004418000-memory.dmp

memory/1016-1000-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2460-1001-0x0000000000230000-0x000000000028A000-memory.dmp

memory/2460-1003-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2460-1006-0x00000000705B0000-0x0000000070C9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F7DE.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

memory/1580-1016-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/2140-1015-0x0000000000220000-0x000000000023E000-memory.dmp

memory/2140-1018-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2140-1023-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/1580-1033-0x0000000140000000-0x00000001405E8000-memory.dmp

memory/1768-1034-0x00000000002F0000-0x000000000030E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

MD5 1afff8d5352aecef2ecd47ffa02d7f7d
SHA1 8b115b84efdb3a1b87f750d35822b2609e665bef
SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512 e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

memory/1768-1038-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/1768-1039-0x0000000004280000-0x00000000042C0000-memory.dmp

memory/2288-1044-0x0000000000520000-0x000000000053C000-memory.dmp

memory/2288-1053-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1058-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1060-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1056-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1054-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1062-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1064-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1076-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1074-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1072-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1070-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1068-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2288-1066-0x0000000000520000-0x0000000000535000-memory.dmp

memory/2308-1077-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2308-1078-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2308-1079-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2308-1080-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1016-1082-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2288-1084-0x0000000000660000-0x0000000000661000-memory.dmp

memory/2308-1083-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2308-1081-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2308-1101-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2308-1124-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2308-1126-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2288-1125-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/2460-1130-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/1016-1131-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2140-1136-0x00000000705B0000-0x0000000070C9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1FF7.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp204B.tmp

MD5 213238ebd4269260f49418ca8be3cd01
SHA1 f4516fb0d8b526dc11d68485d461ab9db6d65595
SHA256 3f8b0d150b1f09e01d194e83670a136959bed64a080f71849d2300c0bfa92e53
SHA512 5e639f00f3be46c439a8aaf80481420dbff46e5c85d103192be84763888fb7fcb6440b75149bf1114f85d4587100b9de5a37c222c21e5720bc03b708aa54c326

memory/1768-1215-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/1768-1216-0x0000000004280000-0x00000000042C0000-memory.dmp

memory/1768-1217-0x00000000705B0000-0x0000000070C9E000-memory.dmp

memory/2308-1218-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2476-1228-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

memory/2476-1229-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

memory/2476-1230-0x000007FEF4BE0000-0x000007FEF557D000-memory.dmp

memory/2476-1231-0x0000000001D70000-0x0000000001DF0000-memory.dmp

memory/2476-1232-0x0000000001D70000-0x0000000001DF0000-memory.dmp

memory/2476-1233-0x0000000001D70000-0x0000000001DF0000-memory.dmp

memory/2476-1234-0x000007FEF4BE0000-0x000007FEF557D000-memory.dmp

memory/2476-1235-0x0000000001D70000-0x0000000001DF0000-memory.dmp

memory/2308-1236-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M3JPU718N4I2QW7XZGL6.temp

MD5 80c883c536b30f1510387cf3bd2a2c44
SHA1 09f3eed477cd07107f70e23416fa2a2302efa60b
SHA256 f83b23a2b4d2f42691b138cf746df57e944a42db2bac6a11575a141e0d451f54
SHA512 23052b07078ca9ee242b4860db3675717bf135b705dd53fc0e27e935a0edcc5ae8740186f105702be466f87f7eb444baddf4eb654309e2543523b36bf3caf578

memory/1244-1243-0x0000000002260000-0x0000000002268000-memory.dmp

memory/1244-1244-0x000007FEF4C10000-0x000007FEF55AD000-memory.dmp

memory/1244-1242-0x000000001B1B0000-0x000000001B492000-memory.dmp

memory/1244-1245-0x0000000002640000-0x00000000026C0000-memory.dmp

memory/1244-1247-0x0000000002640000-0x00000000026C0000-memory.dmp

memory/1244-1248-0x0000000002640000-0x00000000026C0000-memory.dmp

memory/1244-1246-0x000007FEF4C10000-0x000007FEF55AD000-memory.dmp

C:\Program Files\Google\Chrome\updater.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

MD5 fd2727132edd0b59fa33733daa11d9ef
SHA1 63e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA256 3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA512 3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

C:\Users\Admin\AppData\Local\Temp\osloader.exe

MD5 e2f68dc7fbd6e0bf031ca3809a739346
SHA1 9c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA512 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

MD5 5da3a881ef991e8010deed799f1a5aaf
SHA1 fea1acea7ed96d7c9788783781e90a2ea48c1a53
SHA256 f18fdb9e03546bfb98397bcb8378b505eaf4ac061749229a7ee92a1c3cf156e4
SHA512 24fbcb5353a3d51ee01f1de1bbb965f9e40e0d00e52c42713d446f12edceeb8d08b086a8687a6188decaa8f256899e24a06c424d8d73adaad910149a9c45ef09

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\C4I18IP7\suggestions[1].en-US

MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-10 20:21

Reported

2023-10-10 20:27

Platform

win10v2004-20230915-en

Max time kernel

109s

Max time network

167s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3837.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\33DE.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\70AD.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3062.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\33DE.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3537.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3837.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\70AD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8CD2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9510.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Program Files\Google\Chrome\updater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3062.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\updater.exe C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\35E4.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3856 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 3856 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 3856 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe
PID 2544 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2544 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 2544 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe
PID 3408 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3408 wrote to memory of 4708 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2544 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe
PID 2544 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe
PID 2544 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3224 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3856 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe
PID 3856 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe
PID 3856 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe
PID 3096 wrote to memory of 988 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3062.exe
PID 3096 wrote to memory of 988 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3062.exe
PID 3096 wrote to memory of 988 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3062.exe
PID 3096 wrote to memory of 3276 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3360.exe
PID 3096 wrote to memory of 3276 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3360.exe
PID 3096 wrote to memory of 3276 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3360.exe
PID 988 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3062.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe
PID 988 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3062.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe
PID 988 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\3062.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe
PID 3096 wrote to memory of 4160 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\33DE.bat
PID 3096 wrote to memory of 4160 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\33DE.bat
PID 3096 wrote to memory of 4160 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\33DE.bat
PID 5100 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe
PID 5100 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe
PID 5100 wrote to memory of 4352 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe
PID 3096 wrote to memory of 3328 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3537.exe
PID 3096 wrote to memory of 3328 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3537.exe
PID 3096 wrote to memory of 3328 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\3537.exe
PID 4352 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe
PID 4352 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe
PID 4352 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe
PID 3096 wrote to memory of 3088 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\35E4.exe
PID 3096 wrote to memory of 3088 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\35E4.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3276 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\3360.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3408 -ip 3408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 204

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3224 -ip 3224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4376 -ip 4376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 552

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe

C:\Users\Admin\AppData\Local\Temp\3062.exe

C:\Users\Admin\AppData\Local\Temp\3062.exe

C:\Users\Admin\AppData\Local\Temp\3360.exe

C:\Users\Admin\AppData\Local\Temp\3360.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe

C:\Users\Admin\AppData\Local\Temp\33DE.bat

"C:\Users\Admin\AppData\Local\Temp\33DE.bat"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe

C:\Users\Admin\AppData\Local\Temp\3537.exe

C:\Users\Admin\AppData\Local\Temp\3537.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe

C:\Users\Admin\AppData\Local\Temp\35E4.exe

C:\Users\Admin\AppData\Local\Temp\35E4.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3276 -ip 3276

C:\Users\Admin\AppData\Local\Temp\3837.exe

C:\Users\Admin\AppData\Local\Temp\3837.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 384

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3328 -ip 3328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3416 -ip 3416

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 568

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1884 -ip 1884

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3582.tmp\3583.tmp\3584.bat C:\Users\Admin\AppData\Local\Temp\33DE.bat"

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff931c246f8,0x7ff931c24708,0x7ff931c24718

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff931c246f8,0x7ff931c24708,0x7ff931c24718

C:\Users\Admin\AppData\Local\Temp\70AD.exe

C:\Users\Admin\AppData\Local\Temp\70AD.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2812434334938846517,8784750003835365875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2812434334938846517,8784750003835365875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\86E5.exe

C:\Users\Admin\AppData\Local\Temp\86E5.exe

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\8CD2.exe

C:\Users\Admin\AppData\Local\Temp\8CD2.exe

C:\Users\Admin\AppData\Local\Temp\9510.exe

C:\Users\Admin\AppData\Local\Temp\9510.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 460 -ip 460

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 804

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,11183473624234136512,5177819580805738432,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 77.121.18.2.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 pastebin.com udp
US 209.197.3.8:80 tcp
US 104.20.67.143:443 pastebin.com tcp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
CZ 157.240.30.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 tak.soydet.top udp
FI 95.217.246.182:8443 tak.soydet.top tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 182.246.217.95.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 162.61.21.104.in-addr.arpa udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 d239f150-ca99-4cc8-b0a3-e3390a00d675.uuid.cdntokiog.studio udp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 server5.cdntokiog.studio udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.49:443 server5.cdntokiog.studio tcp
US 74.125.128.127:19302 stun.l.google.com udp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.97.0:443 walkinglate.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 127.128.125.74.in-addr.arpa udp
US 8.8.8.8:53 49.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 254.21.238.8.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
NL 51.15.65.182:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.68.143:443 pastebin.com tcp
DE 51.68.190.80:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 182.65.15.51.in-addr.arpa udp
US 8.8.8.8:53 143.68.20.104.in-addr.arpa udp
US 8.8.8.8:53 80.190.68.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

MD5 44217a9da06ef1733107996aaad26f4a
SHA1 fafe743e243cd85601d545487c5b2f3933083127
SHA256 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e
SHA512 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v2035040.exe

MD5 44217a9da06ef1733107996aaad26f4a
SHA1 fafe743e243cd85601d545487c5b2f3933083127
SHA256 70f6258c7559919819d4a309c7c608df8301c4a28a79619a9d88d85c2e86838e
SHA512 4c92a029b5627bff7575fa616c17e8c23cf0090b1458179b5f2637f9c1c2bcea398dd6fc97e31f47729b13f1f0e92494dcc6d6e22bcc265c61158f6fc6a4c689

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2556104.exe

MD5 66622dd66b890315884834378e1cd3f2
SHA1 e46184ef6675c95d803e0c3cd1ce251e1bc32d53
SHA256 52df3951cce7d53db656510ab7c8195966ff062d31c4f80d095cee3a97fa3e20
SHA512 1d79390ee9d243b5a2f2e22ad10e84fffb8b96cfadc4300f541196ef3f20a36754fcae48247c5669453a8ca4fb07c45f4b6aa2594c30405416a58c4037a07d00

memory/4708-14-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4708-15-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe

MD5 90974946e2cc83f25f5dc34cf2c6c691
SHA1 fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568
SHA256 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267
SHA512 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b9918659.exe

MD5 90974946e2cc83f25f5dc34cf2c6c691
SHA1 fe7fb4d0a45d95b4e94d5c08f07a076dfbfa9568
SHA256 72d81c4490446b01bdee7fae368a4ba893821430ee0541ed545171b9de7f2267
SHA512 44993865b3d708d36d7c688c09ded36bdec03148a8476601357fe29af9cac9be6c028aedc887d8bd31a3f4103b8745a86dfe341e6c5ee5a7b8737ea3d64b8cfb

memory/4376-19-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4376-20-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4376-21-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4376-23-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3096-24-0x0000000000E10000-0x0000000000E26000-memory.dmp

memory/4708-25-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe

MD5 dbcc6ee32d6707a7e15f60af2a209198
SHA1 95ec6484c1682e6a319fc17784704108294bc569
SHA256 5e6fc225bcf7bc5d2b798e4a5a0f65fa533d40ac349e318b81502a49d0531301
SHA512 e06089cef353db8808886b6593ec19671ab1ac0bf62a8f6df2864bad8350b2279a2998e6d13eb7163514aa27afcd6e46375eca5a3ae6459f19b918d68757876f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c4779435.exe

MD5 dbcc6ee32d6707a7e15f60af2a209198
SHA1 95ec6484c1682e6a319fc17784704108294bc569
SHA256 5e6fc225bcf7bc5d2b798e4a5a0f65fa533d40ac349e318b81502a49d0531301
SHA512 e06089cef353db8808886b6593ec19671ab1ac0bf62a8f6df2864bad8350b2279a2998e6d13eb7163514aa27afcd6e46375eca5a3ae6459f19b918d68757876f

C:\Users\Admin\AppData\Local\Temp\3062.exe

MD5 d23b61506624e67cd57a0b8406843edc
SHA1 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea
SHA256 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a
SHA512 ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc

C:\Users\Admin\AppData\Local\Temp\3062.exe

MD5 d23b61506624e67cd57a0b8406843edc
SHA1 52611ec3d23b291f0c2bfb01602c7ca7dc4c26ea
SHA256 26d1454a7c6f0e5c6e1814702cfc14a3739cb74746e1be3db7d8aa084c13fe3a
SHA512 ecb0034aeb80c7159440cf9b5f7d70ed7a77ebccc60865d0cf4fb70f22bc0a9b10b726d46ee5e17736d4a2f6e17c3aeae863a27e3b694e8449b55fb497beb3cc

C:\Users\Admin\AppData\Local\Temp\3360.exe

MD5 1e98b2aab70cf73329270535ca121019
SHA1 62ea94364eacec8dc7ab88e2eccd05766eb40736
SHA256 c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd
SHA512 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e

C:\Users\Admin\AppData\Local\Temp\3360.exe

MD5 1e98b2aab70cf73329270535ca121019
SHA1 62ea94364eacec8dc7ab88e2eccd05766eb40736
SHA256 c683d5f65e3e538a15597be57d6cddf313e436c7eaa8be1053f4d5121dd3d8cd
SHA512 685b6a707788462b1b61b754b76af05777892b62d8a7a1cee49148b60f739232483db13d4c1e0c0c50237ab07e47a7276dbb9e0552d06dea9c9960c6e37f400e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe

MD5 75bcc1f5643821ff846a4a623aed1078
SHA1 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f
SHA256 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a
SHA512 df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TC8GG4oS.exe

MD5 75bcc1f5643821ff846a4a623aed1078
SHA1 799ddbf8fb69e683631bbcfeb1ecd5cda693bb2f
SHA256 97f4b1ad9f11f66a3de4ae54638e04c6259650c185620b040d731a5fd594754a
SHA512 df21fdce8ecdd311cd9fe4b3a028dd460b5ebac790a7e3324a5793fbe8cd3d832d5e8b0259096b480c76e0b1ae5b5f53b5fbb29a3b92df9b1992c8cb63e7fe96

C:\Users\Admin\AppData\Local\Temp\33DE.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\33DE.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\3537.exe

MD5 272d1ce9de469edf32f883556ba15be7
SHA1 d98fe2ac8215c27a8d19180150eab3b510301489
SHA256 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336
SHA512 c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe

MD5 784de1f2a7724b915df5022c5d3ee57e
SHA1 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9
SHA256 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4
SHA512 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564

C:\Users\Admin\AppData\Local\Temp\3537.exe

MD5 272d1ce9de469edf32f883556ba15be7
SHA1 d98fe2ac8215c27a8d19180150eab3b510301489
SHA256 3c9b6b95f33cdbbcf4d6f52a2b2a0f0636c7052fd4f1a8e12a2bf9d08349b336
SHA512 c21a90b4c6c8787e98fbe13595395eca54897941b98f8d6458c0e528e09236692765cffaa768c50cf3d728f753138720ffe4700b18cebfcec158aa9c88793916

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Bb7ie3oC.exe

MD5 784de1f2a7724b915df5022c5d3ee57e
SHA1 40980a0bcb9be54b9c1cee6e124ab6a37383f0d9
SHA256 22be32d264ae921e887ca663e20fa76c951812aab7050a3c52e9a7324ce7dff4
SHA512 80304918038c08d4a1e70f8013db14d6c68c2df7c9c4665bbd2cafb1b5c4aceeed172571735f2efca7aec48e353473988d1174bc2f4f892db2a44e94c95f9564

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe

MD5 fd952b68f1541e064bcd239badbf2cad
SHA1 81a0e336f12adb4d4ea22b3d9230ce692e85363f
SHA256 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab
SHA512 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2

memory/3088-76-0x00000000001A0000-0x00000000001AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\35E4.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\35E4.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Vg7CY8Fv.exe

MD5 fd952b68f1541e064bcd239badbf2cad
SHA1 81a0e336f12adb4d4ea22b3d9230ce692e85363f
SHA256 57a02a8e771a425191061d7bb857c5bc0c724c898ac469e522754b95d77e5cab
SHA512 96b7342bd93dc0e936263ccd139005a630d786538ce6634497a01e7b865c1142568cf94fc7e8696c6e01fa9f2dd00e1c7513128ad7d885e91196eb49298fbda2

memory/2200-83-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3088-84-0x00007FF920EC0000-0x00007FF921981000-memory.dmp

memory/2200-85-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2200-87-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3837.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2200-90-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe

MD5 48d9d7ecee6a0b41e01f25e79150c0fb
SHA1 df09c90062d4cd737592972159deb13f4e71f754
SHA256 db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556
SHA512 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\KI6yN2Co.exe

MD5 48d9d7ecee6a0b41e01f25e79150c0fb
SHA1 df09c90062d4cd737592972159deb13f4e71f754
SHA256 db53f706f36c667cbc174fda8ed17e4a396d9dbc3aa91b4b1e46030d1820d556
SHA512 4f100250f1dc8aa2643e1e0125c02ee2206f78a4422d32d50717a2361fa7339b3647f466ba43973e5de3c74d295d51241e913080b9b56966c1d9e408e72d6bd2

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1pU73RN0.exe

MD5 022d0467613b9ef0a3f150e4107c1051
SHA1 9ed52a30e31efcdbc4e9ccbfaf85fc4319af2b9a
SHA256 175d60f244ba588b872d302c6e955cbdefa94f252e0be0ad493e72377fe41346
SHA512 a2287a2e2cf0914c377ddcbd2de1cb0a426e7c13bb724e8889589a33ee719089d75a13d72e66eb67d448d95f4b45030336d7217a12c5c4ed831be351f6439151

C:\Users\Admin\AppData\Local\Temp\3837.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2488-103-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1884-105-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1884-106-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1884-108-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2200-109-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe

MD5 b7ae9b84b2fd44c28ab972c8e639cd16
SHA1 b5aa05e04c2608cd1468fe67022588155580f5a8
SHA256 4dbb25442d1c358bc5403d5261f14c494a0ccdba643dc40553f9ed7de29c1a12
SHA512 8aa52fd360fb46fd493ab96d4a97d6ed5db1944f30dee08e5e61addf1da03de04188c317c6c525100baa04b48c33cdc7ea58853f468483489cfb0096687e243b

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kz988Mj.exe

MD5 b7ae9b84b2fd44c28ab972c8e639cd16
SHA1 b5aa05e04c2608cd1468fe67022588155580f5a8
SHA256 4dbb25442d1c358bc5403d5261f14c494a0ccdba643dc40553f9ed7de29c1a12
SHA512 8aa52fd360fb46fd493ab96d4a97d6ed5db1944f30dee08e5e61addf1da03de04188c317c6c525100baa04b48c33cdc7ea58853f468483489cfb0096687e243b

memory/4584-114-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/2488-115-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/4584-119-0x0000000000810000-0x000000000084E000-memory.dmp

memory/3088-120-0x00007FF920EC0000-0x00007FF921981000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2488-126-0x0000000007E40000-0x00000000083E4000-memory.dmp

memory/3088-125-0x00007FF920EC0000-0x00007FF921981000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582.tmp\3583.tmp\3584.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

memory/4584-128-0x0000000007610000-0x00000000076A2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 451fddf78747a5a4ebf64cabb4ac94e7
SHA1 6925bd970418494447d800e213bfd85368ac8dc9
SHA256 64d12f59d409aa1b03f0b2924e0b2419b65c231de9e04fce15cc3a76e1b9894d
SHA512 edb85a2a94c207815360820731d55f6b4710161551c74008df0c2ae10596e1886c8a9e11d43ddf121878ae35ac9f06fc66b4c325b01ed4e7bf4d3841b27e0864

memory/4584-131-0x00000000077B0000-0x00000000077C0000-memory.dmp

memory/2488-132-0x0000000007AB0000-0x0000000007AC0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Temp\70AD.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

memory/2488-152-0x00000000079D0000-0x00000000079DA000-memory.dmp

\??\pipe\LOCAL\crashpad_2996_EXDGPUESJRLBKPWO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\70AD.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

memory/2488-167-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/3824-168-0x0000000000DF0000-0x0000000001D1A000-memory.dmp

memory/4584-161-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/3824-170-0x00000000734A0000-0x0000000073C50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 93b2bae8520109ce2111d39a9d09bbbe
SHA1 67c5606021dbd6f8e91712af05c8d720fc91485d
SHA256 592c46c9e00aed257d5351e966d890a1e8b68850e5c4234af15df1809f0c7688
SHA512 396d98c647f0169775cd55c095fa1c848a1d737cf1078fa1de094af14e0713fb5c5b267d8d5764e256201b357a3eb3e2c306274121090b79b1269d7aab272dd1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 00030f392fddb0f4e19c385361e11a9b
SHA1 b8701d7a2c64d0d71208d52b85077ec1dbb763be
SHA256 4210e3e6d27ea451421a6ddd2408a61f1b84c36c39c2d39ce0cb770c0bfdfdee
SHA512 1415e96c7fc265f6da6a3a63410b36224bb0266942dc81a644a0cafb8123f13a8b8621a87006595e83264a2fbfb3913c8a203b61077854d81b9f7b9d9d4aad68

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

memory/2488-210-0x0000000008A10000-0x0000000009028000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

memory/2488-223-0x0000000007BB0000-0x0000000007BC2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/4584-220-0x00000000079C0000-0x0000000007ACA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/4584-228-0x00000000078F0000-0x000000000792C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/2488-237-0x0000000007C70000-0x0000000007CBC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/116-255-0x00000000007A0000-0x0000000000CB6000-memory.dmp

memory/116-245-0x00000000734A0000-0x0000000073C50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\86E5.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

C:\Users\Admin\AppData\Local\Temp\8CD2.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

memory/3824-274-0x00000000734A0000-0x0000000073C50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\86E5.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

memory/116-267-0x00000000055D0000-0x00000000055E0000-memory.dmp

memory/116-277-0x0000000005820000-0x00000000058BC000-memory.dmp

memory/116-276-0x0000000005560000-0x0000000005561000-memory.dmp

\??\pipe\LOCAL\crashpad_3844_GFTMOVWOIGBVJSIN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\8CD2.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

memory/4584-286-0x00000000077B0000-0x00000000077C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9510.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e1cc7cf275183fd41936bd0a672be8be
SHA1 36a9781b7f0a001dd449cfb28c741f3d6f65678b
SHA256 28555b3aaab23f7330e094ee155f24c917d9136f3f5da53a7a420b0fbc5dfda7
SHA512 d77eed6ab9129f7f7e1aebe67b18be742d7650420e5cee624f4bf81ee1f092e7ad93b097069748c48690035c1a4973db23d6ba68e7d9184c3a77627be7f60ca1

memory/2488-293-0x0000000007AB0000-0x0000000007AC0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 93b2bae8520109ce2111d39a9d09bbbe
SHA1 67c5606021dbd6f8e91712af05c8d720fc91485d
SHA256 592c46c9e00aed257d5351e966d890a1e8b68850e5c4234af15df1809f0c7688
SHA512 396d98c647f0169775cd55c095fa1c848a1d737cf1078fa1de094af14e0713fb5c5b267d8d5764e256201b357a3eb3e2c306274121090b79b1269d7aab272dd1

memory/460-294-0x0000000000400000-0x000000000046F000-memory.dmp

memory/460-295-0x0000000002070000-0x00000000020CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9510.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/1604-300-0x00000000001C0000-0x00000000001DE000-memory.dmp

memory/4516-303-0x0000000000700000-0x000000000071E000-memory.dmp

memory/1604-301-0x0000000000400000-0x0000000000431000-memory.dmp

memory/460-305-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/4516-309-0x00000000734A0000-0x0000000073C50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b8dc609e12998bebfeb230b0d5d3f00d
SHA1 9269779413e0099993031fd62a793072659e0f3d
SHA256 e942b6b80a1d068b822e540970d052bce40dbc5b74a48fe07160660b3fbd2700
SHA512 6bbcd199740af7875002648ad11afdda019d711a7ba9b81e954d90d66e191ac12529eb0aaeb4c7576d1d97214827ad7798c162323a1f4639883baf7ed390d779

memory/1604-320-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/4932-321-0x00000000022D0000-0x00000000022D9000-memory.dmp

memory/4932-330-0x0000000002390000-0x0000000002490000-memory.dmp

memory/4516-332-0x00000000028C0000-0x00000000028D0000-memory.dmp

memory/3800-331-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

memory/1604-323-0x0000000004810000-0x0000000004820000-memory.dmp

memory/3800-322-0x0000000000400000-0x0000000000409000-memory.dmp

memory/116-333-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/224-334-0x00000000041E0000-0x00000000045E1000-memory.dmp

memory/224-335-0x00000000046F0000-0x0000000004FDB000-memory.dmp

memory/224-336-0x0000000000400000-0x000000000266D000-memory.dmp

memory/4596-350-0x00007FF630660000-0x00007FF630C01000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/460-366-0x0000000000400000-0x000000000046F000-memory.dmp

memory/3096-368-0x0000000002D90000-0x0000000002DA6000-memory.dmp

memory/1604-371-0x0000000005E70000-0x0000000006032000-memory.dmp

memory/3800-369-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1604-374-0x0000000006060000-0x000000000658C000-memory.dmp

memory/1604-375-0x0000000006640000-0x00000000066A6000-memory.dmp

memory/460-378-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/4516-379-0x00000000734A0000-0x0000000073C50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/116-390-0x0000000005800000-0x000000000581C000-memory.dmp

memory/116-392-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-391-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-394-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-396-0x0000000005800000-0x0000000005815000-memory.dmp

memory/1604-398-0x0000000006FD0000-0x0000000007046000-memory.dmp

memory/1604-400-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/116-399-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-402-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-404-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-406-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-408-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-410-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-412-0x0000000005800000-0x0000000005815000-memory.dmp

memory/1604-415-0x0000000007050000-0x000000000706E000-memory.dmp

memory/116-414-0x0000000005800000-0x0000000005815000-memory.dmp

memory/116-417-0x0000000005800000-0x0000000005815000-memory.dmp

memory/4932-418-0x0000000002390000-0x0000000002490000-memory.dmp

memory/1604-419-0x0000000004810000-0x0000000004820000-memory.dmp

memory/116-420-0x0000000005A50000-0x0000000005A51000-memory.dmp

memory/5264-422-0x0000000000400000-0x000000000047F000-memory.dmp

memory/5264-421-0x0000000000400000-0x000000000047F000-memory.dmp

memory/5264-432-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0b186363e3dba7cd6c26ed3ae4a40bfe
SHA1 a4c1f6b1b2759540944c8898c299219c51e1f756
SHA256 626da0d140ac05ed38c9c7f29132c995ccabcd4273e2d5fcd41fefafa6463ea6
SHA512 0658d7ee1e2994899690af3bf9d42f54c93ba8be95364b80508f6796d4caad472f2ebed90e3cdda3a529ed3a48f96c64609632df3118ce0b3b64396aefd9a2f6

memory/5264-434-0x0000000000400000-0x000000000047F000-memory.dmp

memory/116-435-0x00000000734A0000-0x0000000073C50000-memory.dmp

memory/224-439-0x0000000000400000-0x000000000266D000-memory.dmp

memory/224-464-0x00000000041E0000-0x00000000045E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpDCCB.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpDD0F.tmp

MD5 5b39e7698deffeb690fbd206e7640238
SHA1 327f6e6b5d84a0285eefe9914a067e9b51251863
SHA256 53209f64c96b342ff3493441cefa4f49d50f028bd1e5cc45fe1d8b4c9d9a38f8
SHA512 f1f9bc156af008b9686d5e76f41c40e5186f563f416c73c3205e6242b41539516b02f62a1d9f6bcc608ccde759c81def339ccd1633bc8acdd6a69dc4a6477cc7

C:\Users\Admin\AppData\Local\Temp\tmpDDB7.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpDDE3.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmpDDCD.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmpDE4C.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mk3fajxq.4p0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4