Malware Analysis Report

2025-01-23 10:15

Sample ID 231010-yrmtpsgf2x
Target dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f
SHA256 dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f
Tags
amadey glupteba healer redline sectoprat smokeloader 6012068394_99 pixelscloud up3 backdoor dropper evasion infostealer loader persistence rat trojan dcrat lutyr magia discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f

Threat Level: Known bad

The file dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f was found to be: Known bad.

Malicious Activity Summary

amadey glupteba healer redline sectoprat smokeloader 6012068394_99 pixelscloud up3 backdoor dropper evasion infostealer loader persistence rat trojan dcrat lutyr magia discovery spyware stealer

Detects Healer an antivirus disabler dropper

SmokeLoader

Modifies Windows Defender Real-time Protection settings

Glupteba

RedLine

Glupteba payload

Healer

SectopRAT payload

SectopRAT

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine payload

DcRat

Amadey

Drops file in Drivers directory

Stops running service(s)

Downloads MZ/PE file

Modifies Windows Firewall

Checks computer location settings

Windows security modification

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Checks installed software on the system

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of UnmapMainImage

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-10 20:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-10 20:01

Reported

2023-10-10 20:03

Platform

win7-20230831-en

Max time kernel

30s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9BD2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1932 set thread context of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6AC8571-67A7-11EE-B4CE-C6004B6B9118} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1932 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\SysWOW64\WerFault.exe
PID 1932 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\SysWOW64\WerFault.exe
PID 1932 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\SysWOW64\WerFault.exe
PID 1932 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\SysWOW64\WerFault.exe
PID 1268 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe
PID 1268 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe
PID 1268 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe
PID 1268 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe
PID 1268 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe
PID 1268 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe
PID 1268 wrote to memory of 3020 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe
PID 1268 wrote to memory of 2576 N/A N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe
PID 1268 wrote to memory of 2576 N/A N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe
PID 1268 wrote to memory of 2576 N/A N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe
PID 1268 wrote to memory of 2576 N/A N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe
PID 1268 wrote to memory of 2732 N/A N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat
PID 1268 wrote to memory of 2732 N/A N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat
PID 1268 wrote to memory of 2732 N/A N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat
PID 1268 wrote to memory of 2732 N/A N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat
PID 2576 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe C:\Windows\SysWOW64\WerFault.exe
PID 2576 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe C:\Windows\SysWOW64\WerFault.exe
PID 2576 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe C:\Windows\SysWOW64\WerFault.exe
PID 2576 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\9E72.exe C:\Windows\SysWOW64\WerFault.exe
PID 2732 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat C:\Windows\system32\cmd.exe
PID 2732 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat C:\Windows\system32\cmd.exe
PID 2732 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat C:\Windows\system32\cmd.exe
PID 2732 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\9F3E.bat C:\Windows\system32\cmd.exe
PID 1268 wrote to memory of 2828 N/A N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe
PID 1268 wrote to memory of 2828 N/A N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe
PID 1268 wrote to memory of 2828 N/A N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe
PID 1268 wrote to memory of 2828 N/A N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe
PID 1268 wrote to memory of 2756 N/A N/A C:\Users\Admin\AppData\Local\Temp\A26B.exe
PID 1268 wrote to memory of 2756 N/A N/A C:\Users\Admin\AppData\Local\Temp\A26B.exe
PID 1268 wrote to memory of 2756 N/A N/A C:\Users\Admin\AppData\Local\Temp\A26B.exe
PID 2828 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe C:\Windows\SysWOW64\WerFault.exe
PID 2828 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe C:\Windows\SysWOW64\WerFault.exe
PID 2828 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe C:\Windows\SysWOW64\WerFault.exe
PID 2828 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\A19F.exe C:\Windows\SysWOW64\WerFault.exe
PID 3020 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 3020 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 3020 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 3020 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 3020 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 3020 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 3020 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\9BD2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 1268 wrote to memory of 1948 N/A N/A C:\Users\Admin\AppData\Local\Temp\A4CC.exe
PID 1268 wrote to memory of 1948 N/A N/A C:\Users\Admin\AppData\Local\Temp\A4CC.exe
PID 1268 wrote to memory of 1948 N/A N/A C:\Users\Admin\AppData\Local\Temp\A4CC.exe
PID 1268 wrote to memory of 1948 N/A N/A C:\Users\Admin\AppData\Local\Temp\A4CC.exe
PID 2456 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe
PID 2456 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe
PID 2456 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe
PID 2456 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe
PID 2456 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe

"C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 68

C:\Users\Admin\AppData\Local\Temp\9BD2.exe

C:\Users\Admin\AppData\Local\Temp\9BD2.exe

C:\Users\Admin\AppData\Local\Temp\9E72.exe

C:\Users\Admin\AppData\Local\Temp\9E72.exe

C:\Users\Admin\AppData\Local\Temp\9F3E.bat

"C:\Users\Admin\AppData\Local\Temp\9F3E.bat"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 132

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9FE7.tmp\9FE8.tmp\9FE9.bat C:\Users\Admin\AppData\Local\Temp\9F3E.bat"

C:\Users\Admin\AppData\Local\Temp\A19F.exe

C:\Users\Admin\AppData\Local\Temp\A19F.exe

C:\Users\Admin\AppData\Local\Temp\A26B.exe

C:\Users\Admin\AppData\Local\Temp\A26B.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 132

C:\Users\Admin\AppData\Local\Temp\A4CC.exe

C:\Users\Admin\AppData\Local\Temp\A4CC.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 280

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\system32\taskeng.exe

taskeng.exe {EFE3649F-2701-4893-A722-623CD033C8F3} S-1-5-21-686452656-3203474025-4140627569-1000:UUVOHKNL\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\DDD7.exe

C:\Users\Admin\AppData\Local\Temp\DDD7.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\126F.exe

C:\Users\Admin\AppData\Local\Temp\126F.exe

C:\Users\Admin\AppData\Local\Temp\1BF2.exe

C:\Users\Admin\AppData\Local\Temp\1BF2.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:603147 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\32DC.exe

C:\Users\Admin\AppData\Local\Temp\32DC.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 508

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Windows\system32\taskeng.exe

taskeng.exe {460DD3F7-547D-499C-8C11-31286F18DF03} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231010200259.log C:\Windows\Logs\CBS\CbsPersist_20231010200259.cab

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\system32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\system32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"

Network

Country Destination Domain Proto
FI 77.91.68.29:80 77.91.68.29 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.35:443 facebook.com tcp
CZ 157.240.30.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
CZ 157.240.30.35:443 fbcdn.net tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 fbsbx.com udp
CZ 157.240.30.35:443 fbsbx.com tcp
CZ 157.240.30.35:443 fbsbx.com tcp
TR 185.216.70.222:80 185.216.70.222 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 89a674ef-98e7-4bd2-b598-f1283f355f1a.uuid.cdntokiog.studio udp
US 8.8.8.8:53 msdl.microsoft.com udp
US 204.79.197.219:443 msdl.microsoft.com tcp
US 8.8.8.8:53 vsblobprodscussu5shard30.blob.core.windows.net udp
US 20.150.70.36:443 vsblobprodscussu5shard30.blob.core.windows.net tcp

Files

memory/1212-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1212-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1212-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1212-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1212-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1268-5-0x0000000002A10000-0x0000000002A26000-memory.dmp

memory/1212-6-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9BD2.exe

MD5 d295489cc7f06e3229a08715c3d73814
SHA1 0fd98d23821878adace03323948a2c2718222ffd
SHA256 b3b7fcec7c3996c4124f5bdba514b32124a8ab446ac00dea435b60b1f7e88769
SHA512 314d280da49ebd98c99217551f5262037866f73c11a7477c729364ede03dafd3a5615671925b2826354d5e8a5dcb3dea73f38519ff5bed642c1428224461d451

C:\Users\Admin\AppData\Local\Temp\9BD2.exe

MD5 d295489cc7f06e3229a08715c3d73814
SHA1 0fd98d23821878adace03323948a2c2718222ffd
SHA256 b3b7fcec7c3996c4124f5bdba514b32124a8ab446ac00dea435b60b1f7e88769
SHA512 314d280da49ebd98c99217551f5262037866f73c11a7477c729364ede03dafd3a5615671925b2826354d5e8a5dcb3dea73f38519ff5bed642c1428224461d451

C:\Users\Admin\AppData\Local\Temp\9E72.exe

MD5 0fdc61c9202e2d8f7865ea1f055d328e
SHA1 bb2ec64387e9a675ac7f97236e54ef6b4e9481e0
SHA256 650a8a6512a47f0224509df2a3431891504f0b796ec26f9f454710d0386fcfee
SHA512 79cb141673b4ed50a0fbfa7aa96bc39a62d5ef72d5809085ab6e798cc5a1ae0c467939ac29fcb148a259f1ef32288dfd8b3fc08ff14dba390c20ca0577e099d2

C:\Users\Admin\AppData\Local\Temp\9F3E.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\9F3E.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

\Users\Admin\AppData\Local\Temp\9E72.exe

MD5 0fdc61c9202e2d8f7865ea1f055d328e
SHA1 bb2ec64387e9a675ac7f97236e54ef6b4e9481e0
SHA256 650a8a6512a47f0224509df2a3431891504f0b796ec26f9f454710d0386fcfee
SHA512 79cb141673b4ed50a0fbfa7aa96bc39a62d5ef72d5809085ab6e798cc5a1ae0c467939ac29fcb148a259f1ef32288dfd8b3fc08ff14dba390c20ca0577e099d2

\Users\Admin\AppData\Local\Temp\9E72.exe

MD5 0fdc61c9202e2d8f7865ea1f055d328e
SHA1 bb2ec64387e9a675ac7f97236e54ef6b4e9481e0
SHA256 650a8a6512a47f0224509df2a3431891504f0b796ec26f9f454710d0386fcfee
SHA512 79cb141673b4ed50a0fbfa7aa96bc39a62d5ef72d5809085ab6e798cc5a1ae0c467939ac29fcb148a259f1ef32288dfd8b3fc08ff14dba390c20ca0577e099d2

\Users\Admin\AppData\Local\Temp\9E72.exe

MD5 0fdc61c9202e2d8f7865ea1f055d328e
SHA1 bb2ec64387e9a675ac7f97236e54ef6b4e9481e0
SHA256 650a8a6512a47f0224509df2a3431891504f0b796ec26f9f454710d0386fcfee
SHA512 79cb141673b4ed50a0fbfa7aa96bc39a62d5ef72d5809085ab6e798cc5a1ae0c467939ac29fcb148a259f1ef32288dfd8b3fc08ff14dba390c20ca0577e099d2

\Users\Admin\AppData\Local\Temp\9E72.exe

MD5 0fdc61c9202e2d8f7865ea1f055d328e
SHA1 bb2ec64387e9a675ac7f97236e54ef6b4e9481e0
SHA256 650a8a6512a47f0224509df2a3431891504f0b796ec26f9f454710d0386fcfee
SHA512 79cb141673b4ed50a0fbfa7aa96bc39a62d5ef72d5809085ab6e798cc5a1ae0c467939ac29fcb148a259f1ef32288dfd8b3fc08ff14dba390c20ca0577e099d2

C:\Users\Admin\AppData\Local\Temp\A19F.exe

MD5 f4162995f2f22651e9b42938e71047d3
SHA1 03b5192eeaffac0376303f7b30eea43a5291374f
SHA256 c3132cfa55991968855a0cf18ae5a21ce54c9b1b5f7c6cc0bc1bf35d09601cae
SHA512 b30e3aa2d4651e6ec2af1e3e9481e9ce520a4938fdfee82004f9db6f8b1c2e71c9031eb009c2c31cfed62f660127f76ffeb65682170b36032b0969bbc2a638da

\Users\Admin\AppData\Local\Temp\9BD2.exe

MD5 d295489cc7f06e3229a08715c3d73814
SHA1 0fd98d23821878adace03323948a2c2718222ffd
SHA256 b3b7fcec7c3996c4124f5bdba514b32124a8ab446ac00dea435b60b1f7e88769
SHA512 314d280da49ebd98c99217551f5262037866f73c11a7477c729364ede03dafd3a5615671925b2826354d5e8a5dcb3dea73f38519ff5bed642c1428224461d451

C:\Users\Admin\AppData\Local\Temp\A26B.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\A26B.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\9FE7.tmp\9FE8.tmp\9FE9.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

\Users\Admin\AppData\Local\Temp\A19F.exe

MD5 f4162995f2f22651e9b42938e71047d3
SHA1 03b5192eeaffac0376303f7b30eea43a5291374f
SHA256 c3132cfa55991968855a0cf18ae5a21ce54c9b1b5f7c6cc0bc1bf35d09601cae
SHA512 b30e3aa2d4651e6ec2af1e3e9481e9ce520a4938fdfee82004f9db6f8b1c2e71c9031eb009c2c31cfed62f660127f76ffeb65682170b36032b0969bbc2a638da

\Users\Admin\AppData\Local\Temp\A19F.exe

MD5 f4162995f2f22651e9b42938e71047d3
SHA1 03b5192eeaffac0376303f7b30eea43a5291374f
SHA256 c3132cfa55991968855a0cf18ae5a21ce54c9b1b5f7c6cc0bc1bf35d09601cae
SHA512 b30e3aa2d4651e6ec2af1e3e9481e9ce520a4938fdfee82004f9db6f8b1c2e71c9031eb009c2c31cfed62f660127f76ffeb65682170b36032b0969bbc2a638da

\Users\Admin\AppData\Local\Temp\A19F.exe

MD5 f4162995f2f22651e9b42938e71047d3
SHA1 03b5192eeaffac0376303f7b30eea43a5291374f
SHA256 c3132cfa55991968855a0cf18ae5a21ce54c9b1b5f7c6cc0bc1bf35d09601cae
SHA512 b30e3aa2d4651e6ec2af1e3e9481e9ce520a4938fdfee82004f9db6f8b1c2e71c9031eb009c2c31cfed62f660127f76ffeb65682170b36032b0969bbc2a638da

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

MD5 dd4c372db3be58e4d24842acc2dbfbc3
SHA1 d6e4743b75bea2b721c72880a4c127e003644b66
SHA256 f56c58adfd5437d8b506a20e1d68d70be912b5c6966c39bbec9176fa7f1ea525
SHA512 e1b2602de975c130742f24c46a23d555ff98bce0736507008194ab0824c5838f62546fcb2e5646f5d31cae74e4aa63f0b1a0cdbf7c770ea8f0dfe86f94a94736

\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

MD5 dd4c372db3be58e4d24842acc2dbfbc3
SHA1 d6e4743b75bea2b721c72880a4c127e003644b66
SHA256 f56c58adfd5437d8b506a20e1d68d70be912b5c6966c39bbec9176fa7f1ea525
SHA512 e1b2602de975c130742f24c46a23d555ff98bce0736507008194ab0824c5838f62546fcb2e5646f5d31cae74e4aa63f0b1a0cdbf7c770ea8f0dfe86f94a94736

C:\Users\Admin\AppData\Local\Temp\A4CC.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

MD5 dd4c372db3be58e4d24842acc2dbfbc3
SHA1 d6e4743b75bea2b721c72880a4c127e003644b66
SHA256 f56c58adfd5437d8b506a20e1d68d70be912b5c6966c39bbec9176fa7f1ea525
SHA512 e1b2602de975c130742f24c46a23d555ff98bce0736507008194ab0824c5838f62546fcb2e5646f5d31cae74e4aa63f0b1a0cdbf7c770ea8f0dfe86f94a94736

C:\Users\Admin\AppData\Local\Temp\A4CC.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

MD5 dd4c372db3be58e4d24842acc2dbfbc3
SHA1 d6e4743b75bea2b721c72880a4c127e003644b66
SHA256 f56c58adfd5437d8b506a20e1d68d70be912b5c6966c39bbec9176fa7f1ea525
SHA512 e1b2602de975c130742f24c46a23d555ff98bce0736507008194ab0824c5838f62546fcb2e5646f5d31cae74e4aa63f0b1a0cdbf7c770ea8f0dfe86f94a94736

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

MD5 e1367690e04fa399fc946b2fe702bab4
SHA1 058ea9fb9eef1090122de02162a02f246d6458b7
SHA256 43ea5ce8fba611a2a318a3ea1a72b967b8c22f043750417f3ce96d19bc7e9def
SHA512 8d711cc38a078d565cb2b274b6d02f3a46b7308581c097815aa150463d4afdcb05a63682f2879f47408ed2d64b56c2d07eca544d68439de55931b57bfc76cf82

\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

MD5 e1367690e04fa399fc946b2fe702bab4
SHA1 058ea9fb9eef1090122de02162a02f246d6458b7
SHA256 43ea5ce8fba611a2a318a3ea1a72b967b8c22f043750417f3ce96d19bc7e9def
SHA512 8d711cc38a078d565cb2b274b6d02f3a46b7308581c097815aa150463d4afdcb05a63682f2879f47408ed2d64b56c2d07eca544d68439de55931b57bfc76cf82

\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

MD5 e1367690e04fa399fc946b2fe702bab4
SHA1 058ea9fb9eef1090122de02162a02f246d6458b7
SHA256 43ea5ce8fba611a2a318a3ea1a72b967b8c22f043750417f3ce96d19bc7e9def
SHA512 8d711cc38a078d565cb2b274b6d02f3a46b7308581c097815aa150463d4afdcb05a63682f2879f47408ed2d64b56c2d07eca544d68439de55931b57bfc76cf82

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

MD5 e1367690e04fa399fc946b2fe702bab4
SHA1 058ea9fb9eef1090122de02162a02f246d6458b7
SHA256 43ea5ce8fba611a2a318a3ea1a72b967b8c22f043750417f3ce96d19bc7e9def
SHA512 8d711cc38a078d565cb2b274b6d02f3a46b7308581c097815aa150463d4afdcb05a63682f2879f47408ed2d64b56c2d07eca544d68439de55931b57bfc76cf82

\Users\Admin\AppData\Local\Temp\A19F.exe

MD5 f4162995f2f22651e9b42938e71047d3
SHA1 03b5192eeaffac0376303f7b30eea43a5291374f
SHA256 c3132cfa55991968855a0cf18ae5a21ce54c9b1b5f7c6cc0bc1bf35d09601cae
SHA512 b30e3aa2d4651e6ec2af1e3e9481e9ce520a4938fdfee82004f9db6f8b1c2e71c9031eb009c2c31cfed62f660127f76ffeb65682170b36032b0969bbc2a638da

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

MD5 229460cb3bfdf00106201da676025b70
SHA1 f1563e54acb60599642afbd29f285fc5fa110832
SHA256 2a511f540ed48dab195ee1cef4af0c43402e820018599738619aa216f60481d5
SHA512 906fdd66b699af5c7ea50a55c5e3e0d34d8e8af0cfd621f3c3529e17530b5cd20036b0d98f901104bed7fefc85d18eadc01423773da56e90d78de9b6958e6260

\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

MD5 229460cb3bfdf00106201da676025b70
SHA1 f1563e54acb60599642afbd29f285fc5fa110832
SHA256 2a511f540ed48dab195ee1cef4af0c43402e820018599738619aa216f60481d5
SHA512 906fdd66b699af5c7ea50a55c5e3e0d34d8e8af0cfd621f3c3529e17530b5cd20036b0d98f901104bed7fefc85d18eadc01423773da56e90d78de9b6958e6260

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

MD5 229460cb3bfdf00106201da676025b70
SHA1 f1563e54acb60599642afbd29f285fc5fa110832
SHA256 2a511f540ed48dab195ee1cef4af0c43402e820018599738619aa216f60481d5
SHA512 906fdd66b699af5c7ea50a55c5e3e0d34d8e8af0cfd621f3c3529e17530b5cd20036b0d98f901104bed7fefc85d18eadc01423773da56e90d78de9b6958e6260

\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

MD5 229460cb3bfdf00106201da676025b70
SHA1 f1563e54acb60599642afbd29f285fc5fa110832
SHA256 2a511f540ed48dab195ee1cef4af0c43402e820018599738619aa216f60481d5
SHA512 906fdd66b699af5c7ea50a55c5e3e0d34d8e8af0cfd621f3c3529e17530b5cd20036b0d98f901104bed7fefc85d18eadc01423773da56e90d78de9b6958e6260

\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

MD5 ca64d1eb04ed701f6dba83c59e2d9c74
SHA1 5d0dc63a595be906c61cbf883d6f5fd77f43cfe0
SHA256 7ec2847220fe2b2179da8490559a74bf3684499dca65f95ee4a9761cd28cffc6
SHA512 5dd62405a78159df8f7b3ad93312636108a98c002706f96b1c7b5c9ac4362886e186a261ba8e268c261be2b9a689149c50d440cd7d93d2b282e3b22a9c1a9e56

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

MD5 ca64d1eb04ed701f6dba83c59e2d9c74
SHA1 5d0dc63a595be906c61cbf883d6f5fd77f43cfe0
SHA256 7ec2847220fe2b2179da8490559a74bf3684499dca65f95ee4a9761cd28cffc6
SHA512 5dd62405a78159df8f7b3ad93312636108a98c002706f96b1c7b5c9ac4362886e186a261ba8e268c261be2b9a689149c50d440cd7d93d2b282e3b22a9c1a9e56

\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

MD5 ca64d1eb04ed701f6dba83c59e2d9c74
SHA1 5d0dc63a595be906c61cbf883d6f5fd77f43cfe0
SHA256 7ec2847220fe2b2179da8490559a74bf3684499dca65f95ee4a9761cd28cffc6
SHA512 5dd62405a78159df8f7b3ad93312636108a98c002706f96b1c7b5c9ac4362886e186a261ba8e268c261be2b9a689149c50d440cd7d93d2b282e3b22a9c1a9e56

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

MD5 ca64d1eb04ed701f6dba83c59e2d9c74
SHA1 5d0dc63a595be906c61cbf883d6f5fd77f43cfe0
SHA256 7ec2847220fe2b2179da8490559a74bf3684499dca65f95ee4a9761cd28cffc6
SHA512 5dd62405a78159df8f7b3ad93312636108a98c002706f96b1c7b5c9ac4362886e186a261ba8e268c261be2b9a689149c50d440cd7d93d2b282e3b22a9c1a9e56

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

MD5 a1ff303dc93f70bf1375da6e507e57a4
SHA1 49b21e743d4447c206be7a7cf8b334c052521be6
SHA256 07176cbd72fd196cdf52f4475454a77f7d57678b0e0eebe3223242e294af17cb
SHA512 f3c9c041cc842c700eadc5e17e942f1a543d07887ffdd5895148855e006aea10071397b347e6ca637bf2067810ae3245cd75a23296ba135bfa0233b8ba0ef70c

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\CabBD0A.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarC528.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 35967f8060cafb7c45596f78bfe91e87
SHA1 dd5f2aeb1a4a41ba56a228e5fb2d2f71c82da772
SHA256 be7f16c2580c1ecdf234ccd2824e3e62532f9e7f7e7091aa3be210eda1619a8c
SHA512 cb4321f66038b141305c4e6bb7943348543bb63af4d59ab6050bb1aa5b645da41f7caaf2ac81b74e6f9c7017a9c8c19f2c0b20f9a6459885a512cd618516b8ad

memory/2756-212-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

memory/2756-215-0x00000000001D0000-0x00000000001DA000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f0eb974fc49124d0fe20df1cacd34456
SHA1 1dbede1b51ee60a712e7f696ef00a75caafb9e91
SHA256 aaec663b92c2b3727ef03449c1a0b559685fdbc93013d572eab944fde99b025f
SHA512 ad9120f2be35c876484b7a61bc27d22012b049e50dc37b16d787ae9a1b88fb6e8e00991e2359b484c8a8f5c78b7fc13465c5d5372a3d63c4bc8a050242308905

C:\Users\Admin\AppData\Local\Temp\DDD7.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\Local\Temp\DDD7.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/1512-428-0x0000000000140000-0x000000000106A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\iehkyjx\imagestore.dat

MD5 56c754d44c419986e230fb55ee0f9d2b
SHA1 e26160985ecc492ba228aeffa67c5ced9b971141
SHA256 2a7a259380601f5203803850d1b0e7b7c929e027f0bc1aa5cb32c121fa83663f
SHA512 c8c57817ee2acb4f83327c53ccc1e1fd5763bef09e8caf67043bbe59390bf5cc5a32b941bf391da25b9f701fc82c4eb38409ce59ca83ccaba49670c7ea7e80e0

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPR9MST4\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

memory/1512-440-0x0000000070EE0000-0x00000000715CE000-memory.dmp

\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/2592-466-0x0000000070EE0000-0x00000000715CE000-memory.dmp

\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/2592-467-0x0000000000FC0000-0x00000000014D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/2516-470-0x00000000041C0000-0x00000000045B8000-memory.dmp

\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/2756-475-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

memory/2744-478-0x00000000001B0000-0x00000000001B9000-memory.dmp

memory/2516-477-0x00000000041C0000-0x00000000045B8000-memory.dmp

memory/2516-479-0x00000000045C0000-0x0000000004EAB000-memory.dmp

\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

memory/2744-482-0x0000000000270000-0x0000000000370000-memory.dmp

memory/1512-474-0x0000000070EE0000-0x00000000715CE000-memory.dmp

memory/240-483-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/240-485-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2516-486-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

memory/240-488-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2756-512-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 228b5fdfa4b9d5668b962f2035c8ca7c
SHA1 8942590ad0d888d7c076af14e7328e28023b631e
SHA256 1f991aede5e8bce829fe7cfd925ae7b259d0eaf3e6111ff10d8efc8da12fd6bc
SHA512 dccd3b1f47fe3185fd06319309635b610d465667d0d236c944852198d33d555d725a8e1a7a79d76fa11ce43171200e02d27f8314c497ffe68b34b4fbfe2bdd09

memory/2592-540-0x0000000004C90000-0x0000000004CD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\126F.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

memory/1672-546-0x0000000000230000-0x000000000028A000-memory.dmp

memory/2592-549-0x0000000070EE0000-0x00000000715CE000-memory.dmp

memory/1268-551-0x0000000003A60000-0x0000000003A76000-memory.dmp

memory/1672-552-0x0000000000400000-0x000000000046F000-memory.dmp

memory/240-553-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 51660bf02a994fe5bd3511517a0eaec9
SHA1 24646decc87d4639881636077c513f7988e1e9fe
SHA256 2b8912bebe83942d508445375f0db5771cb6a70f4c1e8333203d95f2e6bac38e
SHA512 170bf72350170532422af73aaafc865c9d15f67e832b910d4ec69b270e4c12be1dc2b040d6b94977b7299a093f876bc3fb0e2b86476fa7bfa45b94fac380bb4f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1dc34c097f00e3c23e8609e9f66308c8
SHA1 00ae137a9896e4fd0099c43422540f143a6cc36d
SHA256 0ded8446cb85ac1afe08afaf52fc2a2f3089163af60b56392a270c8b5b7ace55
SHA512 37d0731eab50e89857c2a480a7492b2613cbe0ee0194538cc69c2e390c0c361508500e16b521c857669020fc9ab070d77cf6ed05a0cfb4ac7d93852b6f528009

memory/2516-593-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2592-628-0x00000000009E0000-0x00000000009E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1BF2.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

memory/3004-654-0x0000000000020000-0x000000000003E000-memory.dmp

memory/3004-657-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 444ef9ca935e28d3649d631c149b43be
SHA1 e90698888e9a958054470e677691a89728bb0d06
SHA256 8f74757d9a386fe8c0e580418cdcc19a824ca173425c5370aebeca995dcbbe54
SHA512 c052003342d69107d5f49fa7422724ab73cb13da66fffb07552250ffd463d9d27eedffdf424dabb8920f1b96989b706ef9160788ad4cf200fc71076384423e40

memory/2804-676-0x000000013FC50000-0x00000001401F1000-memory.dmp

memory/2516-677-0x00000000045C0000-0x0000000004EAB000-memory.dmp

memory/2516-697-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 619afce10980d08e98cf9985975dd720
SHA1 9320142c5ffe74ead376552a6e4781e2343755c4
SHA256 d0c4a9632d18fd9ce661e9851cc6893933afaef3f783c524390ed121dac383d2
SHA512 38ddffc419cc3a84c2023f0cb0a1017ba5a0f4c9a634c4a17b16bbcf123e90e70639deb5bb274429602758f88aa904b352a5ccbf8b34e6168e9e804769a38301

memory/1604-719-0x0000000000E30000-0x0000000000E4E000-memory.dmp

memory/1604-720-0x0000000070EE0000-0x00000000715CE000-memory.dmp

memory/1604-721-0x00000000046D0000-0x0000000004710000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79d62f88df9ffdb544518c4b27d7f012
SHA1 5b34ea7096c79034f4d1d653800a9289bb9188c7
SHA256 0d032092ef0639f51bed2f44def684764e1cd23abaf41d8dc3cf48430ae49ec7
SHA512 9c1cf78fb0347b4ae722b2ab08c2c9dc7c3c93691629fa734b86909355e7a76238348fda47deb799953577dedab793c10b769c25aafdbc21c878cb15f94acc21

memory/2516-760-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2592-791-0x0000000000A00000-0x0000000000A1C000-memory.dmp

memory/2592-793-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-792-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-797-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-799-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-795-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-801-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-803-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-805-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-807-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-809-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-811-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-813-0x0000000000A00000-0x0000000000A15000-memory.dmp

memory/2592-815-0x0000000000A00000-0x0000000000A15000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 85cab97acd2807a6df9d1377bd05248a
SHA1 de33aa4c82e093f320b690c044a07b85ccb1b3a5
SHA256 5c315d1699dd27f81f72b711031425c268ff008fc5f75fd5579da84e4ab3bb7b
SHA512 480c528388f852aa5e56a06d81ec4ccf6dc2e410a4e8ae17ec3a0009648e3db3c3d5a63f7f8130c2fb782467a1e198a8f5989d0a5e11e864e73f9107a7fdd4b2

memory/1640-840-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1640-849-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1640-851-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1640-853-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1640-854-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1640-855-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1640-857-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1640-859-0x0000000000400000-0x000000000047F000-memory.dmp

memory/2592-860-0x0000000070EE0000-0x00000000715CE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bde6fddbdc10bd6c9a6ead80868f4d72
SHA1 aedd776cb35cf430e41794b11f97e925839f979e
SHA256 741f89f6e734b362913e60b147dcd074aeb035fb64caac7e8972d726b61f481f
SHA512 086bd0598740bcb4991dccf274a1fb2f58587cf62c06202826fa268b254c3608db13fba0ad7230ffbdfa1d0bb989e8a5536f0c58458e3f7413b953abaee13b36

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

memory/2148-919-0x000000001B130000-0x000000001B412000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/2148-925-0x0000000002390000-0x0000000002398000-memory.dmp

memory/2148-935-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

memory/2148-936-0x0000000002624000-0x0000000002627000-memory.dmp

memory/2148-937-0x000000000262B000-0x0000000002692000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O6WXMYLYHCULLSXWDC45.temp

MD5 e8935da49aa6ceb281f21f8af4c81f81
SHA1 097a2e1b667f01090875360799708720f9675cff
SHA256 990f4525746add724704913c8f317960bf5c28d1b8f67746afe407c5858acf25
SHA512 4d2d5590f66b165893322e095f1463b46609aaf542524d754aa5d1bcde4965737d98fe7005ad52ba48757f4c28a2d1a340c8f275a36926096519c100ab6173cb

memory/2932-987-0x000000001B1C0000-0x000000001B4A2000-memory.dmp

memory/2932-988-0x0000000002250000-0x0000000002258000-memory.dmp

memory/2932-1026-0x000007FEF4A70000-0x000007FEF540D000-memory.dmp

memory/2932-1027-0x0000000002504000-0x0000000002507000-memory.dmp

memory/2932-1028-0x000000000250B000-0x0000000002572000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9E7B.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp9EA0.tmp

MD5 9c3d41e4722dcc865c20255a59633821
SHA1 f3d6bb35f00f830a21d442a69bc5d30075e0c09b
SHA256 8a9827a58c3989200107213c7a8f6bc8074b6bd0db04b7f808bd123d2901972d
SHA512 55f0e7f0b42b21a0f27ef85366ccc5aa2b11efaad3fddb5de56207e8a17ee7077e7d38bde61ab53b96fae87c1843b57c3f79846ece076a5ab128a804951a3e14

memory/1604-1205-0x0000000070EE0000-0x00000000715CE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 5141bac44177b77dc18514ee018aefca
SHA1 e6478500f5b35ce5ec00626c4eab0b5c739b0763
SHA256 22460a8b4b546d1e6f0c6665c33f2542e3ce06f402865f20ac7c85af362484e3
SHA512 2bb4995a17acb52e23fb4980323bd4a400487faa4ed8dec50853889af9add4f25ccf792e9589ebb9dc8db9ce6cb25edd8bea15093f67e00e607d2f130d8cdb7e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce1b6ce68b2d33eac4feefd59aa3317e
SHA1 15a5d65e9ee2ea01e592e4be1c79ef9bf6967625
SHA256 c7cebf5aa3f66a95c89ea7abe96f709ea1ea86c3bd1ad7ff95aca3691c0b2575
SHA512 4d0eb4da1599c65e4354b9c950b3bb46f6d3e6fd9336fd4cd355021a7e393a7e063c3294565bd2a5b4b539e8ebb14f099d7d1a32ed97a1ef6a270cffc86c24dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5cdae653a865261b0f49e7a77b7e500a
SHA1 a7f80d9fd95ada769260c74c33dda1145d839831
SHA256 6c2f2a39483ef41da76b1fdd3f6cc34819cef3ef2a8ffad7220caa9f4be2188d
SHA512 b1687040a30e8c3a12cab73994303d2dc3cde318982ce000835ad030a0ca25457de413534bfd2d424f44e094005f98f10cd0e209d6d07e1463291496a732a3f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0ff990dc84b4c863521bd0f7d90fdfcf
SHA1 c6fd0bd34f78e395dbe294d708e52e0ab097f3af
SHA256 02450d1cddf2032aad443dbf646931059d79a344bc5e776c95aa970c4f987ef4
SHA512 4ffb1ccddb3efdeee6e2f6bc34ddfcf9380d9b5d1e5f1de80a71fc250f04192128b4dca7a3459b95435b177c23388cea21cbb745e9790d3acbe35faa10ddf4cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 93faf7640d7a3b6da0e030032733b180
SHA1 6504c53d7136a08fbc673341f2b6bffce7d523f3
SHA256 e5e29cd2d67c58a0bab00523e0c700e3c5dc24f10ae045ef145a08e05b7d13eb
SHA512 3e31bbd7c6bc830fc1d823f5a9035cd26f3eb44ec3ca321e162228ca44f2d62869944a008f488c8334faf8161d6711515bea70acae243a034e5ddf35d57587b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a5a644923d1dc24d21806f753aa5b7e
SHA1 99edb484bb17768ce4ff8e13ec398d4217d4d969
SHA256 9afc0e41f82fa332a7267a8922fd2c19743e2aacc2b5b271ea6ebc6c82717b90
SHA512 c54735ef1780fc0cbb15734336611a898d5bb3c680e8b0fb9737fca97b166f2429db2e79721cfdd95c0054051f85563b1f1472e448b151f0a7e2166bcd1f8748

C:\Program Files\Google\Chrome\updater.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75d9f34fd8806ca9e55075480cd9640b
SHA1 baf14821c20a23d939cfb83fbeed39a93441753d
SHA256 e932d8d0523f8d19710b16d9763476861bfa50fa644b37dab151e43493f8c6c1
SHA512 c6b643a59f33a97f685ee4c74b8c9a256914a3b4c84d72e1d16b0feb42bc135c9fa0850bbbd6e0bb3a917cb4e5c55c26007e7a3c6d7c867fbdbbde293d3ff591

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6ac7301c87bfd7f497c228d44e0efdee
SHA1 d85ea0b5a333f136046e6ed78106307b5516f872
SHA256 39f7e90176b82facd6d2333bf10fb728ae944bff90a7391672594d564e50cb3e
SHA512 feaceb1f04566058a79722ed9fe9775e8648b90e9fe962f8c53e00281a776b7300c114b62076cacdf653e706e7397571a41fe227d15990546087a8a09a561260

memory/2516-1463-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ec691d1c34f2ab93c3b233fbfef1a50
SHA1 86a5cf5a561d2d0274b5d7bb5b420c73ffed61be
SHA256 bb24f1220bcca58359ef2e47b3b39da949a345184fdc959c583f39bbecbbc4fd
SHA512 b7f1b35902f0b2c1289a0b6755b6470ae10584c544bc636c8b7ee8bd801270dfbb800813c20fb6290bf613532fc008e500113488e6c37d9a23978dbcd06779c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 05cbcb8757e6aa0891f701bb108863cb
SHA1 5592430e36e11aa9770ea3b4e457625f455be2aa
SHA256 5d9e8ff3074acaa1e1cadfe60e9163bc6f4eb223460c49cd97151433bbc8503c
SHA512 31f185c17441fd3b0972a529b27123428bbc76bd5ad7ef5fa2e970e5b43a2f21c900a312e6710880542fd16e9cc6159703d7efa2e0bbb07fd904fa29e17fadee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f368168c71092d98291e1c4ffbe04fc
SHA1 afaa73dd71610e4909075ad5b6e670abf5c63c95
SHA256 36da5e8c5ce05679b4a86ff8dc19623606c6f30f3700ea2e33a805c0d4ccef9a
SHA512 41970c58ba7cb6d6e57b6fc496336fb6a5bb3ece53880522668bdb55abf240d6c9031db610a9d85cde5d9ce4969852f2073e258260931f67f99f89a7e0dbd4b7

memory/1640-1586-0x0000000000401000-0x000000000046A000-memory.dmp

memory/1988-1676-0x0000000003F10000-0x0000000004308000-memory.dmp

memory/1988-1677-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

MD5 1afff8d5352aecef2ecd47ffa02d7f7d
SHA1 8b115b84efdb3a1b87f750d35822b2609e665bef
SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512 e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-10 20:01

Reported

2023-10-10 20:04

Platform

win10v2004-20230915-en

Max time kernel

176s

Max time network

194s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\F147.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ACB8.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\C0EF.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\99DA.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\BE1F.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\392F.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3E7F.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4964 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4964 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3240 wrote to memory of 2792 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\99DA.exe
PID 3240 wrote to memory of 2792 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\99DA.exe
PID 3240 wrote to memory of 2792 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\99DA.exe
PID 3240 wrote to memory of 812 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\A600.exe
PID 3240 wrote to memory of 812 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\A600.exe
PID 3240 wrote to memory of 812 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\A600.exe
PID 3240 wrote to memory of 5116 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\ACB8.bat
PID 3240 wrote to memory of 5116 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\ACB8.bat
PID 3240 wrote to memory of 5116 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\ACB8.bat
PID 3240 wrote to memory of 2192 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B6CB.exe
PID 3240 wrote to memory of 2192 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B6CB.exe
PID 3240 wrote to memory of 2192 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\B6CB.exe
PID 3240 wrote to memory of 3292 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BE1F.exe
PID 3240 wrote to memory of 3292 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\BE1F.exe
PID 3240 wrote to memory of 4920 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C0EF.exe
PID 3240 wrote to memory of 4920 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C0EF.exe
PID 3240 wrote to memory of 4920 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\C0EF.exe
PID 2792 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\99DA.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 2792 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\99DA.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 2792 wrote to memory of 4424 N/A C:\Users\Admin\AppData\Local\Temp\99DA.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe
PID 4424 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe
PID 4424 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe
PID 4424 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe
PID 1064 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe
PID 1064 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe
PID 1064 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe
PID 812 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2400 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe
PID 2400 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe
PID 2400 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe
PID 5116 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\ACB8.bat C:\Windows\system32\cmd.exe
PID 5116 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\ACB8.bat C:\Windows\system32\cmd.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4920 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\C0EF.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4920 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\C0EF.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4920 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\C0EF.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2192 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\B6CB.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 812 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\A600.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe

"C:\Users\Admin\AppData\Local\Temp\dab934a6e60ae099a284735854432e977c0779d6b00a6b72f6d955cfce327a5f.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4964 -ip 4964

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 268

C:\Users\Admin\AppData\Local\Temp\99DA.exe

C:\Users\Admin\AppData\Local\Temp\99DA.exe

C:\Users\Admin\AppData\Local\Temp\A600.exe

C:\Users\Admin\AppData\Local\Temp\A600.exe

C:\Users\Admin\AppData\Local\Temp\ACB8.bat

"C:\Users\Admin\AppData\Local\Temp\ACB8.bat"

C:\Users\Admin\AppData\Local\Temp\B6CB.exe

C:\Users\Admin\AppData\Local\Temp\B6CB.exe

C:\Users\Admin\AppData\Local\Temp\BE1F.exe

C:\Users\Admin\AppData\Local\Temp\BE1F.exe

C:\Users\Admin\AppData\Local\Temp\C0EF.exe

C:\Users\Admin\AppData\Local\Temp\C0EF.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DQ73CJ8.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 812 -ip 812

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 408

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 388

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2192 -ip 2192

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D59B.tmp\D59C.tmp\D59D.bat C:\Users\Admin\AppData\Local\Temp\ACB8.bat"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4908 -ip 4908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4980 -ip 4980

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 572

C:\Users\Admin\AppData\Local\Temp\F147.exe

C:\Users\Admin\AppData\Local\Temp\F147.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 540

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2BY150Kr.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2BY150Kr.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\3074.exe

C:\Users\Admin\AppData\Local\Temp\3074.exe

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\392F.exe

C:\Users\Admin\AppData\Local\Temp\392F.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\3E7F.exe

C:\Users\Admin\AppData\Local\Temp\3E7F.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffccf4846f8,0x7ffccf484708,0x7ffccf484718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffccf4846f8,0x7ffccf484708,0x7ffccf484718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,13359103356738602028,11196266845616579939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,13359103356738602028,11196266845616579939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,16433293623577561936,1210156618962775167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 80.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 254.1.248.8.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 193.78.101.95.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 pastebin.com udp
NL 85.209.176.171:80 85.209.176.171 tcp
US 104.20.67.143:443 pastebin.com tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 tak.soydet.top udp
FI 95.217.246.182:8443 tak.soydet.top tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 182.246.217.95.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 170.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
NL 142.250.179.141:443 accounts.google.com udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 bytecloudasa.website udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 162.61.21.104.in-addr.arpa udp

Files

memory/2092-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2092-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2092-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3240-2-0x0000000001300000-0x0000000001316000-memory.dmp

memory/3240-6-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-8-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-9-0x0000000003310000-0x0000000003320000-memory.dmp

memory/3240-7-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-11-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-12-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-10-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-13-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-15-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-17-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-18-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-16-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-20-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-19-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-21-0x0000000008C50000-0x0000000008C60000-memory.dmp

memory/3240-22-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-24-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-26-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-29-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-30-0x0000000003310000-0x0000000003320000-memory.dmp

memory/3240-28-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-25-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-31-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-32-0x0000000008C60000-0x0000000008C70000-memory.dmp

memory/3240-33-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-36-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-35-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-34-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-37-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-39-0x0000000003300000-0x0000000003310000-memory.dmp

memory/3240-40-0x0000000003300000-0x0000000003310000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\99DA.exe

MD5 d295489cc7f06e3229a08715c3d73814
SHA1 0fd98d23821878adace03323948a2c2718222ffd
SHA256 b3b7fcec7c3996c4124f5bdba514b32124a8ab446ac00dea435b60b1f7e88769
SHA512 314d280da49ebd98c99217551f5262037866f73c11a7477c729364ede03dafd3a5615671925b2826354d5e8a5dcb3dea73f38519ff5bed642c1428224461d451

C:\Users\Admin\AppData\Local\Temp\99DA.exe

MD5 d295489cc7f06e3229a08715c3d73814
SHA1 0fd98d23821878adace03323948a2c2718222ffd
SHA256 b3b7fcec7c3996c4124f5bdba514b32124a8ab446ac00dea435b60b1f7e88769
SHA512 314d280da49ebd98c99217551f5262037866f73c11a7477c729364ede03dafd3a5615671925b2826354d5e8a5dcb3dea73f38519ff5bed642c1428224461d451

C:\Users\Admin\AppData\Local\Temp\A600.exe

MD5 0fdc61c9202e2d8f7865ea1f055d328e
SHA1 bb2ec64387e9a675ac7f97236e54ef6b4e9481e0
SHA256 650a8a6512a47f0224509df2a3431891504f0b796ec26f9f454710d0386fcfee
SHA512 79cb141673b4ed50a0fbfa7aa96bc39a62d5ef72d5809085ab6e798cc5a1ae0c467939ac29fcb148a259f1ef32288dfd8b3fc08ff14dba390c20ca0577e099d2

C:\Users\Admin\AppData\Local\Temp\A600.exe

MD5 0fdc61c9202e2d8f7865ea1f055d328e
SHA1 bb2ec64387e9a675ac7f97236e54ef6b4e9481e0
SHA256 650a8a6512a47f0224509df2a3431891504f0b796ec26f9f454710d0386fcfee
SHA512 79cb141673b4ed50a0fbfa7aa96bc39a62d5ef72d5809085ab6e798cc5a1ae0c467939ac29fcb148a259f1ef32288dfd8b3fc08ff14dba390c20ca0577e099d2

C:\Users\Admin\AppData\Local\Temp\ACB8.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\ACB8.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\B6CB.exe

MD5 f4162995f2f22651e9b42938e71047d3
SHA1 03b5192eeaffac0376303f7b30eea43a5291374f
SHA256 c3132cfa55991968855a0cf18ae5a21ce54c9b1b5f7c6cc0bc1bf35d09601cae
SHA512 b30e3aa2d4651e6ec2af1e3e9481e9ce520a4938fdfee82004f9db6f8b1c2e71c9031eb009c2c31cfed62f660127f76ffeb65682170b36032b0969bbc2a638da

C:\Users\Admin\AppData\Local\Temp\B6CB.exe

MD5 f4162995f2f22651e9b42938e71047d3
SHA1 03b5192eeaffac0376303f7b30eea43a5291374f
SHA256 c3132cfa55991968855a0cf18ae5a21ce54c9b1b5f7c6cc0bc1bf35d09601cae
SHA512 b30e3aa2d4651e6ec2af1e3e9481e9ce520a4938fdfee82004f9db6f8b1c2e71c9031eb009c2c31cfed62f660127f76ffeb65682170b36032b0969bbc2a638da

C:\Users\Admin\AppData\Local\Temp\BE1F.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\BE1F.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/3292-66-0x0000000000620000-0x000000000062A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C0EF.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\C0EF.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Bg00Ob.exe

MD5 3c1b3305c62cd9cd1d0b9cea7e743c59
SHA1 cbb3062933d111c72e6a80aaed631dab395b4fe6
SHA256 bb43a037e0ea9824ea54132ea78346a255b4f51333a02460814177ad9c2f04d3
SHA512 b3006bd3450f2fd1f066d186c0ce4bd81376347b6c9ae7c5c1bcf6666b110d0dec38d0ac3b6fdd04ac35e4a039ee4c50f461498e4410118bef43d271df5c706b

memory/3292-78-0x00007FFCBD800000-0x00007FFCBE2C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

MD5 dd4c372db3be58e4d24842acc2dbfbc3
SHA1 d6e4743b75bea2b721c72880a4c127e003644b66
SHA256 f56c58adfd5437d8b506a20e1d68d70be912b5c6966c39bbec9176fa7f1ea525
SHA512 e1b2602de975c130742f24c46a23d555ff98bce0736507008194ab0824c5838f62546fcb2e5646f5d31cae74e4aa63f0b1a0cdbf7c770ea8f0dfe86f94a94736

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\OV6MR7Yw.exe

MD5 dd4c372db3be58e4d24842acc2dbfbc3
SHA1 d6e4743b75bea2b721c72880a4c127e003644b66
SHA256 f56c58adfd5437d8b506a20e1d68d70be912b5c6966c39bbec9176fa7f1ea525
SHA512 e1b2602de975c130742f24c46a23d555ff98bce0736507008194ab0824c5838f62546fcb2e5646f5d31cae74e4aa63f0b1a0cdbf7c770ea8f0dfe86f94a94736

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

MD5 e1367690e04fa399fc946b2fe702bab4
SHA1 058ea9fb9eef1090122de02162a02f246d6458b7
SHA256 43ea5ce8fba611a2a318a3ea1a72b967b8c22f043750417f3ce96d19bc7e9def
SHA512 8d711cc38a078d565cb2b274b6d02f3a46b7308581c097815aa150463d4afdcb05a63682f2879f47408ed2d64b56c2d07eca544d68439de55931b57bfc76cf82

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bf6Dw9Ui.exe

MD5 e1367690e04fa399fc946b2fe702bab4
SHA1 058ea9fb9eef1090122de02162a02f246d6458b7
SHA256 43ea5ce8fba611a2a318a3ea1a72b967b8c22f043750417f3ce96d19bc7e9def
SHA512 8d711cc38a078d565cb2b274b6d02f3a46b7308581c097815aa150463d4afdcb05a63682f2879f47408ed2d64b56c2d07eca544d68439de55931b57bfc76cf82

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/392-106-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/3420-111-0x0000000000400000-0x0000000000433000-memory.dmp

memory/392-112-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/3420-113-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3420-110-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3420-109-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bt4xT1rz.exe

MD5 ca64d1eb04ed701f6dba83c59e2d9c74
SHA1 5d0dc63a595be906c61cbf883d6f5fd77f43cfe0
SHA256 7ec2847220fe2b2179da8490559a74bf3684499dca65f95ee4a9761cd28cffc6
SHA512 5dd62405a78159df8f7b3ad93312636108a98c002706f96b1c7b5c9ac4362886e186a261ba8e268c261be2b9a689149c50d440cd7d93d2b282e3b22a9c1a9e56

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

MD5 229460cb3bfdf00106201da676025b70
SHA1 f1563e54acb60599642afbd29f285fc5fa110832
SHA256 2a511f540ed48dab195ee1cef4af0c43402e820018599738619aa216f60481d5
SHA512 906fdd66b699af5c7ea50a55c5e3e0d34d8e8af0cfd621f3c3529e17530b5cd20036b0d98f901104bed7fefc85d18eadc01423773da56e90d78de9b6958e6260

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fZ8WR0am.exe

MD5 229460cb3bfdf00106201da676025b70
SHA1 f1563e54acb60599642afbd29f285fc5fa110832
SHA256 2a511f540ed48dab195ee1cef4af0c43402e820018599738619aa216f60481d5
SHA512 906fdd66b699af5c7ea50a55c5e3e0d34d8e8af0cfd621f3c3529e17530b5cd20036b0d98f901104bed7fefc85d18eadc01423773da56e90d78de9b6958e6260

memory/4980-116-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4980-117-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4980-119-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F147.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\Local\Temp\F147.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

memory/392-125-0x0000000007B70000-0x0000000008114000-memory.dmp

memory/392-126-0x00000000076A0000-0x0000000007732000-memory.dmp

memory/4664-127-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/4664-128-0x0000000000E20000-0x0000000001D4A000-memory.dmp

memory/392-129-0x00000000078D0000-0x00000000078E0000-memory.dmp

memory/392-130-0x0000000007860000-0x000000000786A000-memory.dmp

memory/3420-131-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3292-133-0x00007FFCBD800000-0x00007FFCBE2C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D59B.tmp\D59C.tmp\D59D.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

memory/392-137-0x0000000008740000-0x0000000008D58000-memory.dmp

memory/392-139-0x0000000007A20000-0x0000000007B2A000-memory.dmp

memory/4036-140-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/392-141-0x0000000007950000-0x0000000007962000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

memory/4036-149-0x00000000073C0000-0x00000000073D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/392-155-0x0000000008120000-0x000000000816C000-memory.dmp

memory/392-145-0x00000000079B0000-0x00000000079EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

memory/392-144-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/4036-138-0x0000000000480000-0x00000000004BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

memory/3292-136-0x00007FFCBD800000-0x00007FFCBE2C1000-memory.dmp

memory/4768-174-0x0000000000590000-0x0000000000AA6000-memory.dmp

memory/4768-178-0x0000000072C10000-0x00000000733C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/1192-184-0x00000000042A0000-0x00000000046A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3074.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/1192-189-0x00000000046B0000-0x0000000004F9B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\392F.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

memory/4664-193-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/4664-195-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/2840-197-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\3E7F.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/3064-202-0x0000000003E90000-0x0000000003E99000-memory.dmp

memory/2840-203-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3064-201-0x00000000023CC000-0x00000000023DF000-memory.dmp

memory/392-204-0x00000000078D0000-0x00000000078E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\392F.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

C:\Users\Admin\AppData\Local\Temp\3074.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

C:\Users\Admin\AppData\Local\Temp\3E7F.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/1192-208-0x0000000000400000-0x000000000266D000-memory.dmp

memory/3308-209-0x0000000000400000-0x000000000046F000-memory.dmp

memory/4036-210-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/1192-211-0x0000000000400000-0x000000000266D000-memory.dmp

memory/1036-213-0x0000000000950000-0x000000000096E000-memory.dmp

memory/1764-212-0x00000000001C0000-0x00000000001DE000-memory.dmp

memory/3308-214-0x00000000020A0000-0x00000000020FA000-memory.dmp

memory/1036-223-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/1764-224-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4768-225-0x00000000054F0000-0x0000000005500000-memory.dmp

memory/3308-226-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/3240-228-0x0000000008360000-0x0000000008376000-memory.dmp

memory/2840-229-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1764-233-0x0000000072C10000-0x00000000733C0000-memory.dmp

memory/4036-227-0x00000000073C0000-0x00000000073D0000-memory.dmp

memory/4916-234-0x00007FF67DEE0000-0x00007FF67E481000-memory.dmp

memory/4768-235-0x0000000072C10000-0x00000000733C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c126b33f65b7fc4ece66e42d6802b02e
SHA1 2a169a1c15e5d3dab708344661ec04d7339bcb58
SHA256 ca9d2a9ab8047067c8a78be0a7e7af94af34957875de8e640cf2f98b994f52d8
SHA512 eecbe3f0017e902639e0ecb8256ae62bf681bb5f80a7cddc9008d2571fe34d91828dfaee9a8df5a7166f337154232b9ea966c83561ace45d1e2923411702e822

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 db9dbef3f8b1f616429f605c1ebca2f0
SHA1 ffba76f0836c024828d4ff1982cc4240c41a8f16
SHA256 3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1
SHA512 4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 db9dbef3f8b1f616429f605c1ebca2f0
SHA1 ffba76f0836c024828d4ff1982cc4240c41a8f16
SHA256 3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1
SHA512 4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 db9dbef3f8b1f616429f605c1ebca2f0
SHA1 ffba76f0836c024828d4ff1982cc4240c41a8f16
SHA256 3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1
SHA512 4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 db9dbef3f8b1f616429f605c1ebca2f0
SHA1 ffba76f0836c024828d4ff1982cc4240c41a8f16
SHA256 3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1
SHA512 4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

\??\pipe\LOCAL\crashpad_2616_RSZRJTIXLRFOJINW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 db9dbef3f8b1f616429f605c1ebca2f0
SHA1 ffba76f0836c024828d4ff1982cc4240c41a8f16
SHA256 3e0297327872058355ac041a5e0fc83ed017faee0f6c0105b44bb3e5399a93a1
SHA512 4eedc387fe304f27f9d52ff5d71461c7f22147f7a8c18b8e7982acb76515528a36486a567451daafe093f9563b133c6799f2ad046e04256ccb46c83eb99e86c5

memory/1192-272-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0051897162e4084c36720aee027e59f4
SHA1 ceff666df9ee25e0837b4c27ab9dda3f8b136157
SHA256 4179c9880d5c0036de6d02e34e4e0872e403f9bca16eaf8895ac9441c74727ef
SHA512 4460cfb68f029a61c1b947a9010efce8fae55a4345d9c02ce71e8dbde420ad72c4ad1ec85c9b142e9ccb8169359a190b6e64c7d3b2d67a112bf88d02513c3f3b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4c55e4b16213593f8efb3b9604b01b64
SHA1 c04636e71c27df94db53fe59b4404988954e65f4
SHA256 a571ccb789f3a54ffec210b9572625471f82dee62d8efb698972ef57ad127c58
SHA512 94a9b6dcfff9e9f1f4bc99d725c1b666f9a1e6296f639f7dd90c9ddef74b3f78c008dc0808bb9434bf64e0cef94cc6100ccdc120130045d588ab598e15182056

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rnknid5h.tci.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4916-314-0x00007FF67DEE0000-0x00007FF67E481000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0051897162e4084c36720aee027e59f4
SHA1 ceff666df9ee25e0837b4c27ab9dda3f8b136157
SHA256 4179c9880d5c0036de6d02e34e4e0872e403f9bca16eaf8895ac9441c74727ef
SHA512 4460cfb68f029a61c1b947a9010efce8fae55a4345d9c02ce71e8dbde420ad72c4ad1ec85c9b142e9ccb8169359a190b6e64c7d3b2d67a112bf88d02513c3f3b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 50d3fe56fe87f5c2f22575cb200c30b9
SHA1 554abb854db781fe40d97a3e99cd3e49336823f9
SHA256 750040ce95450f240bd424a20b61b767df40bff6521c60ee0fd15671e1d5f0f2
SHA512 69bc2a2772f29820759f6f40f99baf62c311f00307b150c3281da492d0d5f13723842496ec49e01daf09263eefc2681970d2dfc237dad5a4539beaddd19422e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 50d3fe56fe87f5c2f22575cb200c30b9
SHA1 554abb854db781fe40d97a3e99cd3e49336823f9
SHA256 750040ce95450f240bd424a20b61b767df40bff6521c60ee0fd15671e1d5f0f2
SHA512 69bc2a2772f29820759f6f40f99baf62c311f00307b150c3281da492d0d5f13723842496ec49e01daf09263eefc2681970d2dfc237dad5a4539beaddd19422e0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 681f61cd8e974928c78cf30c315ec2f4
SHA1 d1e14a76490ff2c9bae9f094f50dabfea13f0af6
SHA256 968751fd34a7a3adf7cd68225b67bba691b94140695c59843eb5b1bca3b4481f
SHA512 df8fb47b5d8de4a497c8e59ea7141fe56345974f1bab35fc141f86dfcd02060aa5342ff853dd717d2062ef711d8c11eadfbb6fe7266f9a1c745ee9f3f6237f7e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0051897162e4084c36720aee027e59f4
SHA1 ceff666df9ee25e0837b4c27ab9dda3f8b136157
SHA256 4179c9880d5c0036de6d02e34e4e0872e403f9bca16eaf8895ac9441c74727ef
SHA512 4460cfb68f029a61c1b947a9010efce8fae55a4345d9c02ce71e8dbde420ad72c4ad1ec85c9b142e9ccb8169359a190b6e64c7d3b2d67a112bf88d02513c3f3b

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

\??\pipe\LOCAL\crashpad_3732_XMXNUPWBDDQSSLMQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/4768-402-0x0000000005850000-0x0000000005865000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/4768-407-0x0000000005850000-0x0000000005865000-memory.dmp

memory/4768-403-0x0000000005850000-0x0000000005865000-memory.dmp

memory/4768-411-0x0000000005850000-0x0000000005865000-memory.dmp

memory/4768-413-0x0000000005850000-0x0000000005865000-memory.dmp

memory/4768-415-0x0000000005850000-0x0000000005865000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 72782dd761a476c9b939ff99509a7fce
SHA1 48649216e9b51b3616bac35002715a6cc6d4f81e
SHA256 86c9f21158e02e8709c396e9511e1482a5acfb73d18156ca59b0c09e35707f03
SHA512 4501f3531649a0232fee979437c98870dd4078898b7c6ac070f8da64d451a2c9dde652ed694d31238cc4f0b5b498e1ebdeef199317a2169875410ec90f3bf93b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Windows\system32\drivers\etc\hosts

MD5 00930b40cba79465b7a38ed0449d1449
SHA1 4b25a89ee28b20ba162f23772ddaf017669092a5
SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512 cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 6dcb90ba1ba8e06c1d4f27ec78f6911a
SHA1 71e7834c7952aeb9f1aa6eb88e1959a1ae4985d9
SHA256 30d89e5026668c5a58bef231930a8bfb27ca099b24399a2615b210210d418416
SHA512 dc31807eaeb5221ac60d598035ca3ccab1dbeecc95caaff5e1f5a2a89ba1c83ef0a708ee0b8ed05b588ea5d50e360032a534356f84c89d3791df91d419daeff9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9e70bfce7f7412a04593444fcf6c6282
SHA1 1c55636cf2232c20d69a7c1b828bc8502e2bec72
SHA256 3c443c0e86394be02802ad91370ee5d81660839c3e7ffe1019289a2dd81f7709
SHA512 3090edfac2c84ba6a6169f3ad5c7eb5f11eb9257a404ab485b5dff7af80fc695ff0a842a7835234f3f673d2441787c908b5c24e6ba9f3937ee715d2303396c78

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a2665.TMP

MD5 4a0c076fc1e98ccc9b878b23d59bbb0f
SHA1 b0c8949febb382761cb3d45c99d294d59c1ed4e3
SHA256 02e71807e83e24766ce709c67dfd7e112355fe9eea3154e68cc909ab2cff7170
SHA512 a2cb37058b829d9a3e1413373f806563fef86bd73db680d06f87aa9a9d67e6614fe486000a4743b76bf9dd4450fd07cb92be36bdc19dcdf1bb9944f3f9e6fb88

C:\Users\Admin\AppData\Local\Temp\tmp4C6D.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp4C92.tmp

MD5 90e96ddf659e556354303b0029bc28fc
SHA1 22e5d73edd9b7787df2454b13d986f881261af57
SHA256 b62f6f0e4e88773656033b8e70eb487e38c83218c231c61c836d222b1b1dca9e
SHA512 bd1b188b9749decacb485c32b7885c825b6344a92f2496b38e5eb3f86b24015c63bd1a35e82969306ab6d6bc07826442e427f4765beade558378a4404af087a9