Malware Analysis Report

2025-01-23 08:54

Sample ID 231010-z4fftsbf2y
Target file.exe
SHA256 e58a3f36c1ba8395971086aefaca5ea5df180baf106c20a067d2da9448a05ae1
Tags
amadey dcrat glupteba healer redline sectoprat smokeloader 6012068394_99 lutyr magia pixelscloud up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e58a3f36c1ba8395971086aefaca5ea5df180baf106c20a067d2da9448a05ae1

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer redline sectoprat smokeloader 6012068394_99 lutyr magia pixelscloud up3 backdoor discovery dropper evasion infostealer loader persistence rat spyware stealer trojan

SectopRAT

RedLine payload

RedLine

SectopRAT payload

Glupteba

Modifies Windows Defender Real-time Protection settings

Suspicious use of NtCreateUserProcessOtherParentProcess

Amadey

Detects Healer an antivirus disabler dropper

SmokeLoader

Healer

DcRat

Glupteba payload

Modifies Windows Firewall

Downloads MZ/PE file

Stops running service(s)

Drops file in Drivers directory

Windows security modification

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Program Files directory

Launches sc.exe

Enumerates physical storage devices

Program crash

Unsigned PE

Modifies data under HKEY_USERS

Checks SCSI registry key(s)

Suspicious behavior: MapViewOfSection

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-10 21:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-10 21:16

Reported

2023-10-10 21:19

Platform

win10v2004-20230915-en

Max time kernel

116s

Max time network

157s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\444B.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\444B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\444B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\444B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\444B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\444B.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4013.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\46BD.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8C63.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3C87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Il6Jj0CT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3E6C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nn9Ie4tJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bf8HN4LX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Sn1qc8gI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4013.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Nd72JG2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4285.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\444B.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46BD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2YI081ao.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8C63.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A606.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B123.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\B450.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Program Files\Google\Chrome\updater.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\444B.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\3C87.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Il6Jj0CT.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nn9Ie4tJ.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bf8HN4LX.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Sn1qc8gI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\updater.exe C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\444B.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B123.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\B450.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4716 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 4716 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 4716 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2656 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2656 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2656 wrote to memory of 3388 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 3388 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 3388 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 3388 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 3876 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 3876 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 3876 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 3876 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 3876 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 3876 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1664 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3388 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe
PID 3388 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe
PID 3388 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe
PID 3820 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3820 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2656 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe
PID 2656 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe
PID 2656 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3384 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe
PID 4716 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe
PID 4716 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe
PID 4436 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe C:\Windows\system32\cmd.exe
PID 4436 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe C:\Windows\system32\cmd.exe
PID 3436 wrote to memory of 4240 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3436 wrote to memory of 4240 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3436 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3436 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4240 wrote to memory of 2432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4240 wrote to memory of 2432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2296 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 2296 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4860 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1664 -ip 1664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3148 -ip 3148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3820 -ip 3820

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 568

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3384 -ip 3384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 600

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D978.tmp\D979.tmp\D97A.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa355446f8,0x7ffa35544708,0x7ffa35544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa355446f8,0x7ffa35544708,0x7ffa35544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6610659613170336864,1523573588510435399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6610659613170336864,1523573588510435399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2780 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2828 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\3C87.exe

C:\Users\Admin\AppData\Local\Temp\3C87.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Il6Jj0CT.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Il6Jj0CT.exe

C:\Users\Admin\AppData\Local\Temp\3E6C.exe

C:\Users\Admin\AppData\Local\Temp\3E6C.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nn9Ie4tJ.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nn9Ie4tJ.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bf8HN4LX.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bf8HN4LX.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Sn1qc8gI.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Sn1qc8gI.exe

C:\Users\Admin\AppData\Local\Temp\4013.bat

"C:\Users\Admin\AppData\Local\Temp\4013.bat"

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Nd72JG2.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Nd72JG2.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\4285.exe

C:\Users\Admin\AppData\Local\Temp\4285.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4836 -ip 4836

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 388

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4169.tmp\416A.tmp\416B.bat C:\Users\Admin\AppData\Local\Temp\4013.bat"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\444B.exe

C:\Users\Admin\AppData\Local\Temp\444B.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5412 -ip 5412

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5888 -ip 5888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\46BD.exe

C:\Users\Admin\AppData\Local\Temp\46BD.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 664 -ip 664

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5888 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 416

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2YI081ao.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2YI081ao.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa355446f8,0x7ffa35544708,0x7ffa35544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa355446f8,0x7ffa35544708,0x7ffa35544718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11048494386866598346,5018086785072512121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\8C63.exe

C:\Users\Admin\AppData\Local\Temp\8C63.exe

C:\Users\Admin\AppData\Local\Temp\A606.exe

C:\Users\Admin\AppData\Local\Temp\A606.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\B123.exe

C:\Users\Admin\AppData\Local\Temp\B123.exe

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\B450.exe

C:\Users\Admin\AppData\Local\Temp\B450.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 195.233.44.23.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
CZ 157.240.30.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 35.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 32.101.122.92.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
MD 176.123.9.142:37637 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 170.34.67.172.in-addr.arpa udp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 tak.soydet.top udp
FI 95.217.246.182:8443 tak.soydet.top tcp
US 8.8.8.8:53 182.246.217.95.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 bytecloudasa.website udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 39.212.67.172.in-addr.arpa udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 34bd6db0-4de1-450a-896d-ec41af965695.uuid.cdntokiog.studio udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 server5.cdntokiog.studio udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.49:443 server5.cdntokiog.studio tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.97.0:443 walkinglate.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 49.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

MD5 a39abf6030c0d1a294b0786022416c9a
SHA1 1fe555aa3f33349559334d0595d3d49260cd2271
SHA256 e02c24634e369ea286fec4faa74a68d33f90097d323c342ff8ea693f93a3e1a5
SHA512 a0c880fdac16353bfe652ff9101a7f6e50f6288bfdc6fc83917d78d1c05d7c8fa9525a5de8795d883eb2b5f855eeaa65cb80b865d415099dd36480fa11caaa89

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

MD5 a39abf6030c0d1a294b0786022416c9a
SHA1 1fe555aa3f33349559334d0595d3d49260cd2271
SHA256 e02c24634e369ea286fec4faa74a68d33f90097d323c342ff8ea693f93a3e1a5
SHA512 a0c880fdac16353bfe652ff9101a7f6e50f6288bfdc6fc83917d78d1c05d7c8fa9525a5de8795d883eb2b5f855eeaa65cb80b865d415099dd36480fa11caaa89

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

MD5 c85b6e8a72c22d7d7a1a69e74dfddad6
SHA1 34d06d7f38e384ebe1ff790ae0d194c522451df3
SHA256 1faa0f0f80574901d24426dec8e8f08d4a195a92e3a983fbaf9a22cde1214af8
SHA512 ec4162e545ec9f7968ab48490880a91e9474893e779a244b15ed43f146d061b8e990d6132ac3cb23acf2d85967c16eafb0a2290a86620a72bf9c2b5fa531bfa5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

MD5 c85b6e8a72c22d7d7a1a69e74dfddad6
SHA1 34d06d7f38e384ebe1ff790ae0d194c522451df3
SHA256 1faa0f0f80574901d24426dec8e8f08d4a195a92e3a983fbaf9a22cde1214af8
SHA512 ec4162e545ec9f7968ab48490880a91e9474893e779a244b15ed43f146d061b8e990d6132ac3cb23acf2d85967c16eafb0a2290a86620a72bf9c2b5fa531bfa5

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

MD5 66bae0ef21d1bbd9a2bb7bfe89c9e762
SHA1 84c2260357973638e919917e1948bb3694b604d1
SHA256 356274664ea311d0eb99f9ab5442483542ca964d0e7a9249900267d26e0f63aa
SHA512 4e4dda5bce7a50a12fcebc0de9d85417cfe7f4f8e6c039f4e7b1127e059b4b0a1b425bcf91082c5dc61fe724ac69a9d29b5471ff03ae71a04fd36e7173a2d7dd

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

MD5 66bae0ef21d1bbd9a2bb7bfe89c9e762
SHA1 84c2260357973638e919917e1948bb3694b604d1
SHA256 356274664ea311d0eb99f9ab5442483542ca964d0e7a9249900267d26e0f63aa
SHA512 4e4dda5bce7a50a12fcebc0de9d85417cfe7f4f8e6c039f4e7b1127e059b4b0a1b425bcf91082c5dc61fe724ac69a9d29b5471ff03ae71a04fd36e7173a2d7dd

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/3264-28-0x0000000073EA0000-0x0000000074650000-memory.dmp

memory/3264-30-0x0000000002310000-0x000000000232E000-memory.dmp

memory/3264-29-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/3264-31-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/3264-32-0x0000000004A10000-0x0000000004FB4000-memory.dmp

memory/3264-33-0x00000000049A0000-0x00000000049BC000-memory.dmp

memory/3264-34-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-35-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-37-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-39-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-41-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-43-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-45-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-47-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-49-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-51-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-53-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-57-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-59-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-61-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-55-0x00000000049A0000-0x00000000049B6000-memory.dmp

memory/3264-62-0x0000000073EA0000-0x0000000074650000-memory.dmp

memory/3264-63-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/3264-64-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/3264-66-0x0000000073EA0000-0x0000000074650000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

memory/3148-70-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3148-71-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3148-72-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3148-74-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe

MD5 312fcca47cb6cc275bc31a2d264cbf1e
SHA1 bf488673d67f3a3cfe8e25f9b621b834cbcf786b
SHA256 ac069cf88b6d758d892b71897529105a42403a50f4752c87069065417ef70640
SHA512 c40eeb39d99bd7dd9217402a05b34b233b932b165d6b3033a30356f707673ea258ed158feaadb593bcb3127f12c0dbc5775a6e12ab537ac9260cb364913e9d78

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3NK02vK.exe

MD5 312fcca47cb6cc275bc31a2d264cbf1e
SHA1 bf488673d67f3a3cfe8e25f9b621b834cbcf786b
SHA256 ac069cf88b6d758d892b71897529105a42403a50f4752c87069065417ef70640
SHA512 c40eeb39d99bd7dd9217402a05b34b233b932b165d6b3033a30356f707673ea258ed158feaadb593bcb3127f12c0dbc5775a6e12ab537ac9260cb364913e9d78

memory/4356-78-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4356-79-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe

MD5 ed0752ec426fb5e0b92964c54bb49aca
SHA1 81d8e7b03ca5d7c4482f2334dfd03161a8b8df34
SHA256 36d78d51f2f77a79b18dcff8d67d903cd0436d80e2ba5f4c0d1452abb1e3c1a1
SHA512 852b0c8c2789e64e2af26b6aa414bc70baf940c843163a42d4951acd5956a57abca3c80c88663d9da2855fc1954b1f57c6f7c6bbbfdcf0fe20790f2c7f0366c8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4vv169Yr.exe

MD5 ed0752ec426fb5e0b92964c54bb49aca
SHA1 81d8e7b03ca5d7c4482f2334dfd03161a8b8df34
SHA256 36d78d51f2f77a79b18dcff8d67d903cd0436d80e2ba5f4c0d1452abb1e3c1a1
SHA512 852b0c8c2789e64e2af26b6aa414bc70baf940c843163a42d4951acd5956a57abca3c80c88663d9da2855fc1954b1f57c6f7c6bbbfdcf0fe20790f2c7f0366c8

memory/3280-83-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3280-84-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/3280-85-0x0000000007720000-0x00000000077B2000-memory.dmp

memory/3280-86-0x0000000007970000-0x0000000007980000-memory.dmp

memory/3280-87-0x00000000076E0000-0x00000000076EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe

MD5 82b924338a673900593e3d9cb20a6178
SHA1 f6ee5b024697e5e8119d4011b9955e56fd9b4812
SHA256 115da5cb1eb27236d88b4224307f6453e62359c23cbb44e1eff568597893b329
SHA512 b5c41e3156882921b81ef93f355d79de5d961989f63df50a7de3570054dc10ce657dfc02ef41e651eb5a22c9e9f2f1f86d52b86288f5e027dda283b1ffc42b25

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Iu6Cu6.exe

MD5 82b924338a673900593e3d9cb20a6178
SHA1 f6ee5b024697e5e8119d4011b9955e56fd9b4812
SHA256 115da5cb1eb27236d88b4224307f6453e62359c23cbb44e1eff568597893b329
SHA512 b5c41e3156882921b81ef93f355d79de5d961989f63df50a7de3570054dc10ce657dfc02ef41e651eb5a22c9e9f2f1f86d52b86288f5e027dda283b1ffc42b25

memory/3280-92-0x0000000008800000-0x0000000008E18000-memory.dmp

memory/3280-93-0x00000000081E0000-0x00000000082EA000-memory.dmp

memory/3280-94-0x0000000007940000-0x0000000007952000-memory.dmp

memory/3280-95-0x00000000079C0000-0x00000000079FC000-memory.dmp

memory/3280-96-0x0000000007A00000-0x0000000007A4C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D978.tmp\D979.tmp\D97A.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6351be8b63227413881e5dfb033459cc
SHA1 f24489be1e693dc22d6aac7edd692833c623d502
SHA256 e24cda01850900bdb3a4ae5f590a76565664d7689026c146eb96bcd197dac88b
SHA512 66e249488a2f9aa020834f3deca7e4662574dcab0cbb684f21f295f46d71b11f9494b075288189d9df29e4f3414d4b86c27bf8823005d400a5946d7b477f0aef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

\??\pipe\LOCAL\crashpad_4860_ETWSUSJPEHAESNXL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_4240_UYNRUHEFTWBKSVPF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c9d215ca663edcb4fa4fb85a87d3abab
SHA1 108797aa6924ca8f3ce4c823fa3fb18cf3a1be3e
SHA256 daf508467c27be9812569d0d1e48f0ea6152388994eeed9a06060c1cf31e9f72
SHA512 a0660f058d5bfa5fa2e69dffdb52e95e869515edfd88eccc331458179fd5a9c32c403eb3d14ab6af01fb5314c4a5e966f80c7f05ff688c6a9cb1f544fcd381ac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e1373cd-4bf7-4d69-8f04-de83eb69eebb.tmp

MD5 863bb517205ac2879f5e3e2ccf05925e
SHA1 b6599b884746593ce1bb841e0455b91f601ffebb
SHA256 0c1f72592728cd1f4197849936dd85dd6d9f35c3e8fc2691327b6dc9bd3542c3
SHA512 815c03246540ba74fe163b4988779835f564b47d39bb316051ec53f59701d95f6916212812166ea7887c5605b458fc755b786d6e2c5af56534edecf76448020c

memory/3120-143-0x0000000006FC0000-0x0000000006FD6000-memory.dmp

memory/4356-144-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3280-224-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/3280-225-0x0000000007970000-0x0000000007980000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c9d215ca663edcb4fa4fb85a87d3abab
SHA1 108797aa6924ca8f3ce4c823fa3fb18cf3a1be3e
SHA256 daf508467c27be9812569d0d1e48f0ea6152388994eeed9a06060c1cf31e9f72
SHA512 a0660f058d5bfa5fa2e69dffdb52e95e869515edfd88eccc331458179fd5a9c32c403eb3d14ab6af01fb5314c4a5e966f80c7f05ff688c6a9cb1f544fcd381ac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7eb5a210e57ec04672e932dec5c49ab3
SHA1 9005bc471b8d06032b58f04403679547a8f9367c
SHA256 9feee1bde2cfa887d368a58d91ff78e592c79df125f73c569215c9ec5d669ffb
SHA512 7d815485aa9fae42c91ec44a21c9ccd5070b4be760cf48d9d04972fabc2c07479d584976eeb224d66f16166f3679ce6ed326a16ec006c3bc80cf447841554c65

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4ea92b9d65616141b70894e9445a5935
SHA1 9a30bc56d80bc991de084c8a063597a03e31255d
SHA256 0d956ec5f207a0249e3fd35e97dbf37fb8213ed9ccc4e6fbca93300c996c4c83
SHA512 f90b0afb4a1aede4a42074f1ffc6450d0de8fad37959091ab5182e7a479c2ab7547f1bdbe9d5dbf0fe8b38d0e4ea427f6acc8d7aa7976cfb2bf235f11935fd24

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 699e3636ed7444d9b47772e4446ccfc1
SHA1 db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA256 9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512 d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Temp\3C87.exe

MD5 9167b48ab2ba8a8b32efb314545a0c4d
SHA1 6ecc8d67078301a9d03c839bad82057e48a88794
SHA256 bbc268b7e554713d2286552b2eb9b4cd29dc380717e198762b1ed494fc830b42
SHA512 8ff5e130702d811aecf44e735e86ce68be552872674519c16be66c9f45731fc8cfa2fd76c602fa30fdf1223b71ea1aef3cc74d42978d4accf319a4da4a3bba2f

C:\Users\Admin\AppData\Local\Temp\3C87.exe

MD5 9167b48ab2ba8a8b32efb314545a0c4d
SHA1 6ecc8d67078301a9d03c839bad82057e48a88794
SHA256 bbc268b7e554713d2286552b2eb9b4cd29dc380717e198762b1ed494fc830b42
SHA512 8ff5e130702d811aecf44e735e86ce68be552872674519c16be66c9f45731fc8cfa2fd76c602fa30fdf1223b71ea1aef3cc74d42978d4accf319a4da4a3bba2f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6pF42jK.exe

MD5 7b82a235309ba235c3adca5767b647f5
SHA1 8c3a13f60601ec598d2f22a723a97e8099920b85
SHA256 3b251095665a527078f02580dcd597668d8b2db2fce9efff666f14f71d435848
SHA512 c857c0ec46d2ab33b79c85d72e9764b9f35df94b079d2749421b00102e6ce24cd69af53d2de8b50932e4885c040c991ff7acdb21f5913fb6aab96a2def173259

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Il6Jj0CT.exe

MD5 81e8f0effa6ab8d26f586b5ed527bcc3
SHA1 0d71e7435ea5e07ca6022670f8d4ac89279d78f7
SHA256 16de307fbc88d27d5d0628012ecae780064c0f38114ca7974fb71d7b06992ba9
SHA512 4218da913ddf63102651ec1a463a6e44ac48270fc9eb6f2a7d5cb6408ddf996a752291dddaa8c9cc4ee4ee1a404d38f7d50d75472fe04124102231584f62dfa6

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Il6Jj0CT.exe

MD5 81e8f0effa6ab8d26f586b5ed527bcc3
SHA1 0d71e7435ea5e07ca6022670f8d4ac89279d78f7
SHA256 16de307fbc88d27d5d0628012ecae780064c0f38114ca7974fb71d7b06992ba9
SHA512 4218da913ddf63102651ec1a463a6e44ac48270fc9eb6f2a7d5cb6408ddf996a752291dddaa8c9cc4ee4ee1a404d38f7d50d75472fe04124102231584f62dfa6

C:\Users\Admin\AppData\Local\Temp\3E6C.exe

MD5 9a1b518f0106f548fe96669110cbd4e6
SHA1 0577e85cbd4081fbd54d208063b7882606254a31
SHA256 aed0f7cc60856257bb38f56455421b5e9a7fab79878c7ecac38156a81339fd0d
SHA512 c72771204fcc7fc8d5d217451e9d092e141df1aa7080b6c1b56aebac0a199396d9b51a30569bdadbd93806bae34b5c13a7aed169d3c4d97659824545b82466f6

C:\Users\Admin\AppData\Local\Temp\3E6C.exe

MD5 9a1b518f0106f548fe96669110cbd4e6
SHA1 0577e85cbd4081fbd54d208063b7882606254a31
SHA256 aed0f7cc60856257bb38f56455421b5e9a7fab79878c7ecac38156a81339fd0d
SHA512 c72771204fcc7fc8d5d217451e9d092e141df1aa7080b6c1b56aebac0a199396d9b51a30569bdadbd93806bae34b5c13a7aed169d3c4d97659824545b82466f6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nn9Ie4tJ.exe

MD5 6260ea09b699206fc0fdb8df9d9e8d14
SHA1 62040a73935167459b5979bae2471b709763efa0
SHA256 bbe0e5fdd48f70a4aa2437ad27c59ca15c3fd3396ecffa70dda3a8e32a983195
SHA512 0957b6ea1fc42111af74a4c059213993250cfea76c4d819d8d6a177b6457e945be51efc28175ffd889bdd72eed4c618c8c0c6bb88751e7b56757897d50bfb55e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nn9Ie4tJ.exe

MD5 6260ea09b699206fc0fdb8df9d9e8d14
SHA1 62040a73935167459b5979bae2471b709763efa0
SHA256 bbe0e5fdd48f70a4aa2437ad27c59ca15c3fd3396ecffa70dda3a8e32a983195
SHA512 0957b6ea1fc42111af74a4c059213993250cfea76c4d819d8d6a177b6457e945be51efc28175ffd889bdd72eed4c618c8c0c6bb88751e7b56757897d50bfb55e

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bf8HN4LX.exe

MD5 29dc12eac39f0bdbea57e7f7d0f5f4f8
SHA1 5274a3620d5302f327f7c2c72030a5281f84b8ae
SHA256 51a28d49ee525cfb28e97a96355de48e002225f99b278624432f20572d327903
SHA512 93cfc5f423614dcdfeff73ccb1da3c10b5fd648d44422d4171a7303d500fa13b9ad3642a58bc0d23f0fc5fda4f252a56962466fb090a2f20e7f4675cdcf283f5

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Bf8HN4LX.exe

MD5 29dc12eac39f0bdbea57e7f7d0f5f4f8
SHA1 5274a3620d5302f327f7c2c72030a5281f84b8ae
SHA256 51a28d49ee525cfb28e97a96355de48e002225f99b278624432f20572d327903
SHA512 93cfc5f423614dcdfeff73ccb1da3c10b5fd648d44422d4171a7303d500fa13b9ad3642a58bc0d23f0fc5fda4f252a56962466fb090a2f20e7f4675cdcf283f5

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Sn1qc8gI.exe

MD5 f75c658600de8ee2742b07ce9fcc1f79
SHA1 064adc5e6f575d2d06b92f2000f074435eb6e9ef
SHA256 786d523d39285b9614a94daa59241c0f0a1fc7f451a007800a584c2b330853fb
SHA512 e3e4b264c3056aa2c681d204b788173faf6b3716427876306e84784e75c6e6b17503a720db2ba7a5c13df97ac97ebf131c297532311d9a7446da2574f01d4762

C:\Users\Admin\AppData\Local\Temp\4013.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\Sn1qc8gI.exe

MD5 f75c658600de8ee2742b07ce9fcc1f79
SHA1 064adc5e6f575d2d06b92f2000f074435eb6e9ef
SHA256 786d523d39285b9614a94daa59241c0f0a1fc7f451a007800a584c2b330853fb
SHA512 e3e4b264c3056aa2c681d204b788173faf6b3716427876306e84784e75c6e6b17503a720db2ba7a5c13df97ac97ebf131c297532311d9a7446da2574f01d4762

C:\Users\Admin\AppData\Local\Temp\4013.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8103beb08e3e2106121ae006b0eaf5d7
SHA1 d8666e5756055e1bfb4884cfad4993b3149a7f05
SHA256 0534a5830ceacfff2370e4eae92b58296ad376b15052efd01b9ec5800535b9e3
SHA512 a322dce3822b641f47f44e23fdf3013cba526c201bd71258c4fcbac13835c82417e88098fa91dadb64ebef545f571a955ee3467d38b04aeefa40cf1c64f7c88a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58410b.TMP

MD5 da2ba3f28d09f47fdf0c53429674f368
SHA1 d58b63b974781256f3a724ec904e12d6cbaceb5a
SHA256 582779afbe49b234837c07ba3c82e3ecd8316b884d2dc02024ab0c922427fb7a
SHA512 47658c8b96eee4a1e3e67ed8239b9fb275042a701f89c446b99aa68e29925b01df850cb483eeaa1c0e90a1095457b8cefa0168c9704245b65ac76e9f4a79e2ef

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Nd72JG2.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Nd72JG2.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1Nd72JG2.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

memory/5456-355-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4285.exe

MD5 2fef31cdda5719e13df06a8c4a2c6fd5
SHA1 8b85b809145d88dc9d20a42d372cfd8a6638cb0a
SHA256 6e9476e26e20d6d2278a3318e6378a12c5a17cd10b18527433c0fecd2e0f9693
SHA512 5e6ad8edab707f2b7b0b3b252490ee376d3da8364528c03752a04633c060eb514d25d00885568c9bd31c83021d5a9191ba9a7277c29abfc8781560a3838f0e3c

memory/5456-360-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4285.exe

MD5 2fef31cdda5719e13df06a8c4a2c6fd5
SHA1 8b85b809145d88dc9d20a42d372cfd8a6638cb0a
SHA256 6e9476e26e20d6d2278a3318e6378a12c5a17cd10b18527433c0fecd2e0f9693
SHA512 5e6ad8edab707f2b7b0b3b252490ee376d3da8364528c03752a04633c060eb514d25d00885568c9bd31c83021d5a9191ba9a7277c29abfc8781560a3838f0e3c

memory/5456-357-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5888-364-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 983bd0692010b70e44ab5c965a59ab29
SHA1 fa642d0f86b11a1bcb298a468102ac1ef05309f4
SHA256 ed3548cfb2a014b43cec0e779f395a44da7dbbb972876de0ecaca04314cb9d7f
SHA512 41f5ffca87c9177fae10e5e93806d0a8923ec88d75218e727d98ab980f8ddd94aaf98875a5c48a24b083a9aa247d5e16e4e1ad8d535e39eee0228d82f357add8

memory/5888-368-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5560-367-0x0000000000FA0000-0x0000000000FAA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\444B.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\444B.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/5888-379-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5560-380-0x00007FFA30420000-0x00007FFA30EE1000-memory.dmp

memory/5456-384-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\46BD.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\46BD.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/5564-389-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/5564-391-0x0000000007C70000-0x0000000007C80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4169.tmp\416A.tmp\416B.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2YI081ao.exe

MD5 e374dec8c64c2c696716aaba2afa18da
SHA1 9035c5c3e6c17d9e9a78ecc0ebba14f5b852d1c1
SHA256 e71c8511719611ac7ad7dc6d0c263a179e903c522e2c6b064f0d3404259a4fd6
SHA512 5490ecbc7bab5b0f58f60e3c112d13629ac13cf825c8c98004237b942324ef5b7b6b468e6a5849145d52bda8651760f21fa7f3f484f5dd1fc0188fe260b29a71

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2YI081ao.exe

MD5 e374dec8c64c2c696716aaba2afa18da
SHA1 9035c5c3e6c17d9e9a78ecc0ebba14f5b852d1c1
SHA256 e71c8511719611ac7ad7dc6d0c263a179e903c522e2c6b064f0d3404259a4fd6
SHA512 5490ecbc7bab5b0f58f60e3c112d13629ac13cf825c8c98004237b942324ef5b7b6b468e6a5849145d52bda8651760f21fa7f3f484f5dd1fc0188fe260b29a71

memory/5280-402-0x00000000008E0000-0x000000000091E000-memory.dmp

memory/5280-403-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/5280-404-0x0000000007920000-0x0000000007930000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ffe501eec146157a8e6026174e591843
SHA1 0f80e9ee31842fd6a3851349a848e94c951cce2c
SHA256 e85b96341d28e681b59050705471ca5068dfcd05cfca776eb5943c1da8401568
SHA512 9a77a9f32d38e53ca9a8f627d5e914f1e057e6c69e4f04609023c41fa61f016ad54816a3e2ef4f90e9c497a7a71c599a0a0e3ec4eaa4f246e31b5249b803a054

memory/5560-533-0x00007FFA30420000-0x00007FFA30EE1000-memory.dmp

memory/5564-541-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/5560-543-0x00007FFA30420000-0x00007FFA30EE1000-memory.dmp

memory/5280-544-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/5280-545-0x0000000007920000-0x0000000007930000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 17425d7e8fa304956e1fcc33b7e7f274
SHA1 f629071b0c39e314b15df21b3f7504bfc5e63a8d
SHA256 680d725f48267ab856838bf90b03262c3c8daef68a75ae127d47a3e3fc7303da
SHA512 a45bc0e7efe06dce924db1df8a5650233c5d8a79adc4cb7fb572d5b425abd49a992c3c891fbbaae4d2d5720f73d73d7e1cd1b6ea81958af1307216b7bce9ff97

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6d526bdec2642143ec8cc290852015bd
SHA1 4250f7001f4043daee6721d8a1fa09952185c547
SHA256 e3508b1b83fee29ab84e651338449293ff7967e91b4bd40ffcf0050ca9a53734
SHA512 e300b3aae27008d90ca6c219a6d3a9fd90907aa07f012d305ce837ffd0d87b970476cf230b0c12a2eb4a1b099669332d614b46946f34c9d07f1b4cdadea125ed

memory/5512-575-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/5512-576-0x0000000000360000-0x000000000128A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

memory/2376-597-0x0000000000540000-0x000000000059A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/5572-612-0x0000000000400000-0x0000000000431000-memory.dmp

memory/5572-613-0x00000000001C0000-0x00000000001DE000-memory.dmp

memory/5572-617-0x0000000073A80000-0x0000000074230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

memory/396-625-0x00000000024D0000-0x00000000025D0000-memory.dmp

memory/5156-627-0x0000000000400000-0x0000000000409000-memory.dmp

memory/396-626-0x00000000024B0000-0x00000000024B9000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 61df1ea12c088579a5e6d4cce2ee276e
SHA1 a6fac0e196bc90fb5c3575e7eeb5896af1cecde9
SHA256 6b3af4338f2b4a694e61c3f18de0aba44fb888b976be7fa082500a253501cd69
SHA512 a9467a8cd74e96641fb6186c75a1e21b1a925aaa0944ac4d38a97c7dfece801160deb2d92c3dc28c78f2a3e09fc2ba26277c9d190ecc7dfeac8786dce45e5960

memory/5512-633-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/6104-635-0x0000000000D30000-0x0000000001246000-memory.dmp

memory/4408-636-0x0000000000830000-0x000000000084E000-memory.dmp

memory/5156-634-0x0000000000400000-0x0000000000409000-memory.dmp

memory/6104-637-0x0000000073A80000-0x0000000074230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/4408-640-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/2632-642-0x0000000004800000-0x00000000050EB000-memory.dmp

memory/6104-643-0x0000000005BC0000-0x0000000005BD0000-memory.dmp

memory/2632-646-0x00000000042F0000-0x00000000046F8000-memory.dmp

memory/5572-645-0x00000000049C0000-0x00000000049D0000-memory.dmp

memory/6104-648-0x0000000005D50000-0x0000000005DEC000-memory.dmp

memory/5512-647-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/2632-649-0x0000000000400000-0x000000000266D000-memory.dmp

memory/4408-650-0x0000000001340000-0x0000000001350000-memory.dmp

memory/6104-651-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

memory/3120-653-0x0000000006DF0000-0x0000000006E06000-memory.dmp

memory/5156-655-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5572-654-0x0000000005E70000-0x0000000006032000-memory.dmp

memory/5572-659-0x0000000006060000-0x000000000658C000-memory.dmp

memory/5572-660-0x0000000006640000-0x00000000066A6000-memory.dmp

memory/5572-670-0x0000000073A80000-0x0000000074230000-memory.dmp

memory/2492-672-0x00000000029D0000-0x0000000002A06000-memory.dmp

memory/2632-671-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2492-673-0x0000000073A80000-0x0000000074230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u1i43uoe.xs4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5636-718-0x00007FF761BA0000-0x00007FF762141000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpED80.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpEDA5.tmp

MD5 6e98ae51f6cacb49a7830bede7ab9920
SHA1 1b7e9e375bd48cae50343e67ecc376cf5016d4ee
SHA256 192cd04b9a4d80701bb672cc3678912d1df8f6b987c2b4991d9b6bfbe8f011fd
SHA512 3e7cdda870cbde0655cc30c2f7bd3afee96fdfbe420987ae6ea2709089c0a8cbc8bb9187ef3b4ec3f6a019a9a8b465588b61029869f5934e0820b2461c4a9b2b

C:\Users\Admin\AppData\Local\Temp\tmpEDE6.tmp

MD5 5d646af8e71592c2eca7eb8df936d9fa
SHA1 852ea79e14d9e8a71c3d16938477b9df6968b930
SHA256 ace2153889be607ef242eb41f065b746ef8f8538b3cae9344450ca6e7273084b
SHA512 5af503b219d3fdbb6a01c4786fcbde90dc310cdbc74010c679d10c13d1132fa51d2e3449cfb6c6187a759bcb79b2b36fa3c7816aab4a28d63393ee01f51884fb

C:\Users\Admin\AppData\Local\Temp\tmpEDE0.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

memory/6104-816-0x0000000005FA0000-0x0000000005FB5000-memory.dmp

memory/6104-817-0x0000000005FA0000-0x0000000005FB5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpEE94.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

memory/6104-841-0x0000000005FA0000-0x0000000005FB5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4ba092a9b9aef491d9792bf7ee7529dc
SHA1 39491b7643bf0fd03a2825bb191777a5424cfd79
SHA256 3286d61a9970a69d36ce704bb2380377ed38b60114f1f37ae0580830aaf6fc86
SHA512 d30ad3c611c706563682478e08de48c0064a5c21ae556838d1ffdf4e237ae13fa58325c36502202753b8507f612f4352c05ee01f7f58a5e09b2b1e283ca20237

C:\Users\Admin\AppData\Local\Temp\tmpEF2D.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 5a8366687ccd19ce2baa0e899fb013cd
SHA1 ca665d448d6a5eb75e3fa852e52aea99b4182e13
SHA256 448dbb221985340787495c9ef9cb5de2aab73a73c01db4bcdd5fbb562502e5e1
SHA512 4410ce48e3fd47adb8d095d77b59c0d68f9456472f7f26b2895cfaaed1f949426b2507e23e3d41df9a4ab77378b49a6b1c07167b43db470c1608fd9f314ad28f

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-10 21:16

Reported

2023-10-10 21:18

Platform

win7-20230831-en

Max time kernel

119s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2764 set thread context of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2196 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2196 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2196 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2196 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2196 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2196 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2196 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 2852 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe
PID 1680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 1680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 1680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 1680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 1680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 1680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 1680 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe
PID 2120 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 2120 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 2120 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 2120 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 2120 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 2120 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 2120 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe
PID 2120 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 2120 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 2120 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 2120 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 2120 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 2120 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 2120 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2764 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\SysWOW64\WerFault.exe
PID 2764 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 912 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 284

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

MD5 a39abf6030c0d1a294b0786022416c9a
SHA1 1fe555aa3f33349559334d0595d3d49260cd2271
SHA256 e02c24634e369ea286fec4faa74a68d33f90097d323c342ff8ea693f93a3e1a5
SHA512 a0c880fdac16353bfe652ff9101a7f6e50f6288bfdc6fc83917d78d1c05d7c8fa9525a5de8795d883eb2b5f855eeaa65cb80b865d415099dd36480fa11caaa89

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

MD5 a39abf6030c0d1a294b0786022416c9a
SHA1 1fe555aa3f33349559334d0595d3d49260cd2271
SHA256 e02c24634e369ea286fec4faa74a68d33f90097d323c342ff8ea693f93a3e1a5
SHA512 a0c880fdac16353bfe652ff9101a7f6e50f6288bfdc6fc83917d78d1c05d7c8fa9525a5de8795d883eb2b5f855eeaa65cb80b865d415099dd36480fa11caaa89

\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

MD5 a39abf6030c0d1a294b0786022416c9a
SHA1 1fe555aa3f33349559334d0595d3d49260cd2271
SHA256 e02c24634e369ea286fec4faa74a68d33f90097d323c342ff8ea693f93a3e1a5
SHA512 a0c880fdac16353bfe652ff9101a7f6e50f6288bfdc6fc83917d78d1c05d7c8fa9525a5de8795d883eb2b5f855eeaa65cb80b865d415099dd36480fa11caaa89

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lj4NJ41.exe

MD5 a39abf6030c0d1a294b0786022416c9a
SHA1 1fe555aa3f33349559334d0595d3d49260cd2271
SHA256 e02c24634e369ea286fec4faa74a68d33f90097d323c342ff8ea693f93a3e1a5
SHA512 a0c880fdac16353bfe652ff9101a7f6e50f6288bfdc6fc83917d78d1c05d7c8fa9525a5de8795d883eb2b5f855eeaa65cb80b865d415099dd36480fa11caaa89

\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

MD5 c85b6e8a72c22d7d7a1a69e74dfddad6
SHA1 34d06d7f38e384ebe1ff790ae0d194c522451df3
SHA256 1faa0f0f80574901d24426dec8e8f08d4a195a92e3a983fbaf9a22cde1214af8
SHA512 ec4162e545ec9f7968ab48490880a91e9474893e779a244b15ed43f146d061b8e990d6132ac3cb23acf2d85967c16eafb0a2290a86620a72bf9c2b5fa531bfa5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

MD5 c85b6e8a72c22d7d7a1a69e74dfddad6
SHA1 34d06d7f38e384ebe1ff790ae0d194c522451df3
SHA256 1faa0f0f80574901d24426dec8e8f08d4a195a92e3a983fbaf9a22cde1214af8
SHA512 ec4162e545ec9f7968ab48490880a91e9474893e779a244b15ed43f146d061b8e990d6132ac3cb23acf2d85967c16eafb0a2290a86620a72bf9c2b5fa531bfa5

\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

MD5 c85b6e8a72c22d7d7a1a69e74dfddad6
SHA1 34d06d7f38e384ebe1ff790ae0d194c522451df3
SHA256 1faa0f0f80574901d24426dec8e8f08d4a195a92e3a983fbaf9a22cde1214af8
SHA512 ec4162e545ec9f7968ab48490880a91e9474893e779a244b15ed43f146d061b8e990d6132ac3cb23acf2d85967c16eafb0a2290a86620a72bf9c2b5fa531bfa5

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cF7iP09.exe

MD5 c85b6e8a72c22d7d7a1a69e74dfddad6
SHA1 34d06d7f38e384ebe1ff790ae0d194c522451df3
SHA256 1faa0f0f80574901d24426dec8e8f08d4a195a92e3a983fbaf9a22cde1214af8
SHA512 ec4162e545ec9f7968ab48490880a91e9474893e779a244b15ed43f146d061b8e990d6132ac3cb23acf2d85967c16eafb0a2290a86620a72bf9c2b5fa531bfa5

\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

MD5 66bae0ef21d1bbd9a2bb7bfe89c9e762
SHA1 84c2260357973638e919917e1948bb3694b604d1
SHA256 356274664ea311d0eb99f9ab5442483542ca964d0e7a9249900267d26e0f63aa
SHA512 4e4dda5bce7a50a12fcebc0de9d85417cfe7f4f8e6c039f4e7b1127e059b4b0a1b425bcf91082c5dc61fe724ac69a9d29b5471ff03ae71a04fd36e7173a2d7dd

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

MD5 66bae0ef21d1bbd9a2bb7bfe89c9e762
SHA1 84c2260357973638e919917e1948bb3694b604d1
SHA256 356274664ea311d0eb99f9ab5442483542ca964d0e7a9249900267d26e0f63aa
SHA512 4e4dda5bce7a50a12fcebc0de9d85417cfe7f4f8e6c039f4e7b1127e059b4b0a1b425bcf91082c5dc61fe724ac69a9d29b5471ff03ae71a04fd36e7173a2d7dd

\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

MD5 66bae0ef21d1bbd9a2bb7bfe89c9e762
SHA1 84c2260357973638e919917e1948bb3694b604d1
SHA256 356274664ea311d0eb99f9ab5442483542ca964d0e7a9249900267d26e0f63aa
SHA512 4e4dda5bce7a50a12fcebc0de9d85417cfe7f4f8e6c039f4e7b1127e059b4b0a1b425bcf91082c5dc61fe724ac69a9d29b5471ff03ae71a04fd36e7173a2d7dd

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\gb5EU73.exe

MD5 66bae0ef21d1bbd9a2bb7bfe89c9e762
SHA1 84c2260357973638e919917e1948bb3694b604d1
SHA256 356274664ea311d0eb99f9ab5442483542ca964d0e7a9249900267d26e0f63aa
SHA512 4e4dda5bce7a50a12fcebc0de9d85417cfe7f4f8e6c039f4e7b1127e059b4b0a1b425bcf91082c5dc61fe724ac69a9d29b5471ff03ae71a04fd36e7173a2d7dd

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1GA84AW6.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/2784-40-0x0000000001DB0000-0x0000000001DCE000-memory.dmp

memory/2784-41-0x0000000001E30000-0x0000000001E4C000-memory.dmp

memory/2784-42-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-43-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-45-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-47-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-51-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-49-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-55-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-53-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-59-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-57-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-63-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-61-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-67-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-65-0x0000000001E30000-0x0000000001E46000-memory.dmp

memory/2784-69-0x0000000001E30000-0x0000000001E46000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

memory/2620-76-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-79-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-78-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-77-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-80-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-81-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2620-83-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-85-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2620-87-0x0000000000400000-0x0000000000433000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2dC6602.exe

MD5 da0eee39485725d0adaa5678f4d1b681
SHA1 1bd7d3989821d2c92f40a682d6d08a567f5e6da2
SHA256 497b29333dcded5d2521b809843febe11b43ee3b6d74588210084deb27a70e70
SHA512 a316344340632f4c1391e912e97b747ca648ca3171b259ae24730c68db4d325eafb8eb0c1c8470c058a68099cbc5b702185b738d23a67aa1206484489179eba4