Malware Analysis Report

2025-01-23 08:55

Sample ID 231010-zw6ytadb28
Target file
SHA256 72dbe3e582cb916db745466ec12ee67ae7df040521443fc5b1c2903b6f4f3442
Tags
evasion persistence trojan amadey dcrat glupteba healer redline smokeloader 6012068394_99 lutyr magia up3 backdoor dropper infostealer loader rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72dbe3e582cb916db745466ec12ee67ae7df040521443fc5b1c2903b6f4f3442

Threat Level: Known bad

The file file was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan amadey dcrat glupteba healer redline smokeloader 6012068394_99 lutyr magia up3 backdoor dropper infostealer loader rat

SmokeLoader

Glupteba

Amadey

RedLine payload

DcRat

RedLine

Detects Healer an antivirus disabler dropper

Modifies Windows Defender Real-time Protection settings

Healer

Glupteba payload

Downloads MZ/PE file

Stops running service(s)

Modifies Windows Firewall

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Windows security modification

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Launches sc.exe

Unsigned PE

Program crash

Enumerates physical storage devices

Suspicious use of SendNotifyMessage

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-10 21:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-10 21:05

Reported

2023-10-10 21:07

Platform

win7-20230831-en

Max time kernel

119s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2380 set thread context of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1920 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1920 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1920 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1920 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1920 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1920 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1920 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 2356 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2356 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2356 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2356 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2356 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2356 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2356 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2644 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2644 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2644 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2644 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2644 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2644 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2644 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2720 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 2720 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 2720 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 2720 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 2720 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 2720 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 2720 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 2720 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2720 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2720 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2720 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2720 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2720 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2720 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2380 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1928 wrote to memory of 272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 1928 wrote to memory of 272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 1928 wrote to memory of 272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 1928 wrote to memory of 272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 1928 wrote to memory of 272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 1928 wrote to memory of 272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 1928 wrote to memory of 272 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2380 wrote to memory of 692 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 268

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 284

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/2552-40-0x0000000000AD0000-0x0000000000AEE000-memory.dmp

memory/2552-41-0x0000000000B00000-0x0000000000B1C000-memory.dmp

memory/2552-57-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-69-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-67-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-65-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-63-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-61-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-59-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-55-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-53-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-51-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-49-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-47-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-45-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-43-0x0000000000B00000-0x0000000000B16000-memory.dmp

memory/2552-42-0x0000000000B00000-0x0000000000B16000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

memory/1928-80-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1928-81-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1928-87-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1928-85-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1928-83-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1928-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1928-79-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1928-78-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1928-77-0x0000000000400000-0x0000000000433000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

memory/1928-76-0x0000000000400000-0x0000000000433000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-10 21:05

Reported

2023-10-10 21:08

Platform

win10v2004-20230915-en

Max time kernel

65s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\681F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\681F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\681F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\681F.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\681F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\681F.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\602E.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\6BD9.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9F8D.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\59F2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5D2F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\602E.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\655F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\681F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6BD9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9F8D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Windows\System32\sc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\681F.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\59F2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe N/A

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\681F.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\sc.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3792 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 3792 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 3792 wrote to memory of 4692 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 4692 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 4692 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 4692 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 5028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 5028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 5028 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 4928 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 4928 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 4928 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 4928 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 4928 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 4928 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1860 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5028 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
PID 5028 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
PID 5028 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
PID 4724 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4724 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4724 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4724 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4724 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4724 wrote to memory of 5072 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4692 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
PID 4692 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
PID 4692 wrote to memory of 2552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2552 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3792 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
PID 3792 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
PID 3792 wrote to memory of 4952 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
PID 4952 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe C:\Windows\system32\cmd.exe
PID 4952 wrote to memory of 532 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe C:\Windows\system32\cmd.exe
PID 532 wrote to memory of 4560 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 532 wrote to memory of 4560 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 220 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 532 wrote to memory of 4820 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 532 wrote to memory of 4820 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4820 wrote to memory of 4432 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4560 wrote to memory of 1456 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1860 -ip 1860

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1952 -ip 1952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 540

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 572

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4724 -ip 4724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 600

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2552 -ip 2552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 616

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1151.tmp\1161.tmp\1162.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x7ffe472e46f8,0x7ffe472e4708,0x7ffe472e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffe472e46f8,0x7ffe472e4708,0x7ffe472e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,360159646102746291,12883795633037393103,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,360159646102746291,12883795633037393103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\59F2.exe

C:\Users\Admin\AppData\Local\Temp\59F2.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

C:\Users\Admin\AppData\Local\Temp\5D2F.exe

C:\Users\Admin\AppData\Local\Temp\5D2F.exe

C:\Users\Admin\AppData\Local\Temp\602E.bat

"C:\Users\Admin\AppData\Local\Temp\602E.bat"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3360 -ip 3360

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4616 -ip 4616

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6136.tmp\6137.tmp\6138.bat C:\Users\Admin\AppData\Local\Temp\602E.bat"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5440 -ip 5440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5440 -s 540

C:\Users\Admin\AppData\Local\Temp\655F.exe

C:\Users\Admin\AppData\Local\Temp\655F.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\681F.exe

C:\Users\Admin\AppData\Local\Temp\681F.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5652 -ip 5652

C:\Users\Admin\AppData\Local\Temp\6BD9.exe

C:\Users\Admin\AppData\Local\Temp\6BD9.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5652 -s 416

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe472e46f8,0x7ffe472e4708,0x7ffe472e4718

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe472e46f8,0x7ffe472e4708,0x7ffe472e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,1355330038192650187,11812911384926493450,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Users\Admin\AppData\Local\Temp\9F8D.exe

C:\Users\Admin\AppData\Local\Temp\9F8D.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\C67F.exe

C:\Users\Admin\AppData\Local\Temp\C67F.exe

C:\Users\Admin\AppData\Local\Temp\C8D1.exe

C:\Users\Admin\AppData\Local\Temp\C8D1.exe

C:\Users\Admin\AppData\Local\Temp\CCF9.exe

C:\Users\Admin\AppData\Local\Temp\CCF9.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 195.233.44.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
N/A 224.0.0.251:5353 udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 81.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
CZ 157.240.30.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 35.30.240.157.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
MD 176.123.9.142:37637 tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
NL 85.209.176.171:80 85.209.176.171 tcp
US 104.20.67.143:443 pastebin.com tcp
US 8.8.8.8:53 bytecloudasa.website udp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 39.212.67.172.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 tak.soydet.top udp
FI 95.217.246.182:8443 tak.soydet.top tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 182.246.217.95.in-addr.arpa udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 host-host-file8.com udp
US 172.67.212.39:80 bytecloudasa.website tcp
NL 194.169.175.127:80 host-host-file8.com tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
US 172.67.212.39:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 db149ff6-2e80-4715-ab66-ffafa6e3045e.uuid.cdntokiog.studio udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 server3.cdntokiog.studio udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.49:443 server3.cdntokiog.studio tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.96.0:443 walkinglate.com tcp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 49.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 0.96.114.188.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
DE 135.125.238.108:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 108.238.125.135.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.34.170:443 pastebin.com tcp
DE 135.125.238.108:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 170.34.67.172.in-addr.arpa udp
US 8.8.8.8:53 stun4.l.google.com udp
JP 172.217.213.127:19302 stun4.l.google.com udp
US 8.8.8.8:53 127.213.217.172.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/4832-28-0x00000000024E0000-0x00000000024FE000-memory.dmp

memory/4832-29-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4832-30-0x0000000004A50000-0x0000000004A60000-memory.dmp

memory/4832-31-0x0000000004AA0000-0x0000000005044000-memory.dmp

memory/4832-32-0x0000000005090000-0x00000000050AC000-memory.dmp

memory/4832-33-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-34-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-36-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-38-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-40-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-44-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-42-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-46-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-50-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-48-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-56-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-54-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-52-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-58-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-60-0x0000000005090000-0x00000000050A6000-memory.dmp

memory/4832-61-0x00000000747C0000-0x0000000074F70000-memory.dmp

memory/4832-62-0x0000000004A50000-0x0000000004A60000-memory.dmp

memory/4832-63-0x0000000004A50000-0x0000000004A60000-memory.dmp

memory/4832-64-0x0000000004A50000-0x0000000004A60000-memory.dmp

memory/4832-66-0x00000000747C0000-0x0000000074F70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

memory/1952-70-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1952-74-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1952-72-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1952-71-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

MD5 edc5d8666c0caf68f37b71985ec0bd03
SHA1 28499c1d50d5b80e55b812c7bbdf16e3b1bc7ddb
SHA256 dc1112575c9eadc678d7e9e18f23ee001e4f56fafc3b9352f5ab05951991ecdb
SHA512 f130fbac42510d7f8ed19963f0c81ea10bf1e103965b4031d04cfa5c2efc67ab019c3f5e330fcd56b87b1e4cc3e77dc0851d739ec94aba788e68522e8a1b4c5e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

MD5 edc5d8666c0caf68f37b71985ec0bd03
SHA1 28499c1d50d5b80e55b812c7bbdf16e3b1bc7ddb
SHA256 dc1112575c9eadc678d7e9e18f23ee001e4f56fafc3b9352f5ab05951991ecdb
SHA512 f130fbac42510d7f8ed19963f0c81ea10bf1e103965b4031d04cfa5c2efc67ab019c3f5e330fcd56b87b1e4cc3e77dc0851d739ec94aba788e68522e8a1b4c5e

memory/5072-78-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5072-79-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

memory/4960-83-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4960-84-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/4960-85-0x00000000078B0000-0x0000000007942000-memory.dmp

memory/4960-86-0x0000000007890000-0x00000000078A0000-memory.dmp

memory/4960-87-0x0000000007A80000-0x0000000007A8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

MD5 aff13e435745c08faedeecefc7bd0bfe
SHA1 b64f58a9034698edef453a0c71bb5b6945085a2c
SHA256 279d7109547300b564ab26c219638f5a2e679bb045de21bc8c829461ffcf9acc
SHA512 dc8f26b6d0c0b2d5282f4f55f46e260196c8c0232e66de36de473ee50d2b918ee3132f02a83d6fb6179c26fa6d904bdc7ec00bc75370e13c769919a0468e4a0b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

MD5 aff13e435745c08faedeecefc7bd0bfe
SHA1 b64f58a9034698edef453a0c71bb5b6945085a2c
SHA256 279d7109547300b564ab26c219638f5a2e679bb045de21bc8c829461ffcf9acc
SHA512 dc8f26b6d0c0b2d5282f4f55f46e260196c8c0232e66de36de473ee50d2b918ee3132f02a83d6fb6179c26fa6d904bdc7ec00bc75370e13c769919a0468e4a0b

memory/772-92-0x00000000031D0000-0x00000000031E6000-memory.dmp

memory/4960-94-0x0000000008990000-0x0000000008FA8000-memory.dmp

memory/5072-96-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4960-97-0x0000000007C60000-0x0000000007D6A000-memory.dmp

memory/4960-98-0x0000000007B70000-0x0000000007B82000-memory.dmp

memory/4960-99-0x0000000007BD0000-0x0000000007C0C000-memory.dmp

memory/4960-100-0x0000000007C10000-0x0000000007C5C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1151.tmp\1161.tmp\1162.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 45fe8440c5d976b902cfc89fb780a578
SHA1 5696962f2d0e89d4c561acd58483b0a4ffeab800
SHA256 f620e0b35ac0ead6ed51984859edc75f7d4921aaa90d829bb9ad362d15504f96
SHA512 efe817ea03c203f8e63d7b50a965cb920fb4f128e72b458a7224c0c1373b31fae9eaa55a504290d2bc0cf55c96fd43f295f9aef6c2791a35fc4ab3e965f6ff25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

\??\pipe\LOCAL\crashpad_4560_MVIWWOOTSCFFPQKD

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_4820_QALBIVAXYCDLIYBE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

memory/4960-136-0x00000000744A0000-0x0000000074C50000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e7dea64afb6f1bc7f796d2b93020dab4
SHA1 7ac6a795b1820a2f5b0d505c2e4058af31c6bff6
SHA256 ea0e2cc279d59f597ce1aabf1fab1149f8a6778847ecb08e60d2c398353bedec
SHA512 c77b1c3f6319675d3a04db33bcb0aa1f04eee7e95630003115c4b64813d4722129cece3fa3d881fbc81fd31c8f60615ca9404ff4bfa708c134b385c8109ac9f3

memory/4960-146-0x0000000007890000-0x00000000078A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a5d5f663a994c36273c988fdff70576d
SHA1 6db12095491988a75902c615eac99988ee28ecce
SHA256 f6cc21c87f0235b97f04e2df29c3d777bc4053e0fabab5d574592b2d06186258
SHA512 8d7b9b460f63dd1f544f4f45c1df562bd669f371071e37630e70a4438e7e398ebd7fd79b67536900f0e573af07aa5801db9ceb7dbc384ff5e94e4e188c76a978

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e7dea64afb6f1bc7f796d2b93020dab4
SHA1 7ac6a795b1820a2f5b0d505c2e4058af31c6bff6
SHA256 ea0e2cc279d59f597ce1aabf1fab1149f8a6778847ecb08e60d2c398353bedec
SHA512 c77b1c3f6319675d3a04db33bcb0aa1f04eee7e95630003115c4b64813d4722129cece3fa3d881fbc81fd31c8f60615ca9404ff4bfa708c134b385c8109ac9f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 176d38b3ad886fae9cd154b504de4ade
SHA1 38f16dd67bbfaa3e2fc209a11dbdc2e48e536c98
SHA256 8e9683a57c507f9d6d33df1c416968786bed052809928739ee01556700f27ce5
SHA512 e19a45f3350f1d977fa870abe172a29cc1f0a93700a0d6bc62fc762ebe20f13f6891b54c569fc59272be8da21537cf2688e5b5d03693f35b38db1da2c91f5df4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 74d3d257e4249e7f9ba418827aaa4972
SHA1 c953f5877becb229a220a7cb0d4f1803f3251ad1
SHA256 699d1c34439727fb4fc44144995941f0f412d2789ac4a6839503312b32970e68
SHA512 9c99e13fd818079959a5201d3e170bb634415b7639326f8efbcc62dcb15e9dc72ebf7ee493e3a09808ca896d67e84a30940bf351aca501f1f854839229e42e21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Temp\59F2.exe

MD5 26e16643800e11da6d23a668fe5bffc4
SHA1 f3395c143dc6da867b784da8c55c84673c20403a
SHA256 b6509e5dc57e9c64f02a41436d7f083981c39bd44e66570f553e2c012aa895c0
SHA512 e17f8d29e768268e32f2c8c5f1ec57f62496c0caf5c9b1c03c6c918aa5e6ae2fcd8156853e118f0834545ab8b04b9e731d8f8ae67a1527a8b0882f7373c60841

C:\Users\Admin\AppData\Local\Temp\59F2.exe

MD5 26e16643800e11da6d23a668fe5bffc4
SHA1 f3395c143dc6da867b784da8c55c84673c20403a
SHA256 b6509e5dc57e9c64f02a41436d7f083981c39bd44e66570f553e2c012aa895c0
SHA512 e17f8d29e768268e32f2c8c5f1ec57f62496c0caf5c9b1c03c6c918aa5e6ae2fcd8156853e118f0834545ab8b04b9e731d8f8ae67a1527a8b0882f7373c60841

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6ZU22AI.exe

MD5 4daab548c87b65cf050e931d3ca42ad1
SHA1 b6ea92e1bb6dbd6a7bded6003e916f63faf6bb28
SHA256 7750fa364c109944652e0e25071cd0ddb325a92fe40f186d801242f67636afc0
SHA512 c7eebe07d30295833ed7ca9f74768fef9051531497262ff61e9d1a3269278af2ada717f7aee1403bd61ad1d0c34bebc43ca53b5a8bde8346ca0be2093fb0af27

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

MD5 a18283afb2aae9c440b749f41eb23c42
SHA1 1090de0f48e997dc328312b3ffab7586029c0138
SHA256 e68c2f69d853606257c37a1e36a52a17b22b49593126adc0a2540ba316fb1d2d
SHA512 0bf8c00e37332699dd387c93eb1fbe801f4a7725bfb26863acd3b3392cb3772b768cf62edd7c5d2df2c8c2cbbfe054f42f7b8c8055be8232f9c4eaf4ac922da7

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

MD5 a18283afb2aae9c440b749f41eb23c42
SHA1 1090de0f48e997dc328312b3ffab7586029c0138
SHA256 e68c2f69d853606257c37a1e36a52a17b22b49593126adc0a2540ba316fb1d2d
SHA512 0bf8c00e37332699dd387c93eb1fbe801f4a7725bfb26863acd3b3392cb3772b768cf62edd7c5d2df2c8c2cbbfe054f42f7b8c8055be8232f9c4eaf4ac922da7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

MD5 56d9fbce98df03bad77c09372964d861
SHA1 15254dcce30064aebc7021dc39136deb562bf6d2
SHA256 59cd12882e61f870ac687865c0db70a7c8e7a326bcaae1503e91044672bb8eb0
SHA512 f82d69c59c94876f3dfb0d86eb9e0206b216fc2392633d1805cbed7d5b252280a1a670973d0dd4ce063e29cc32f8cbdf9f9933178d0a572c91d923578e9a0ed4

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

MD5 56d9fbce98df03bad77c09372964d861
SHA1 15254dcce30064aebc7021dc39136deb562bf6d2
SHA256 59cd12882e61f870ac687865c0db70a7c8e7a326bcaae1503e91044672bb8eb0
SHA512 f82d69c59c94876f3dfb0d86eb9e0206b216fc2392633d1805cbed7d5b252280a1a670973d0dd4ce063e29cc32f8cbdf9f9933178d0a572c91d923578e9a0ed4

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

MD5 8421f6b463d0612dec16db3e0c029f2f
SHA1 d90d59dd217a0cdc2c7e808d6f97f2fa0ed949b9
SHA256 928bccfe9b0c43f6d915f8b08d4e5a385a12736686da90b913f40966313523f9
SHA512 f75c86034d090a626008e9fbd8a087e9a136a04a865fe1767166069718daaeb1140be31f3b4d99f63719f223586afdebf97c828771ea2622f5d9d3d843490230

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

MD5 8421f6b463d0612dec16db3e0c029f2f
SHA1 d90d59dd217a0cdc2c7e808d6f97f2fa0ed949b9
SHA256 928bccfe9b0c43f6d915f8b08d4e5a385a12736686da90b913f40966313523f9
SHA512 f75c86034d090a626008e9fbd8a087e9a136a04a865fe1767166069718daaeb1140be31f3b4d99f63719f223586afdebf97c828771ea2622f5d9d3d843490230

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

MD5 aacac442fd439606eb6122177bea54ec
SHA1 a8b58402a720b454802a188d5906fd1df6ec01b3
SHA256 d95b2814893ec3043908919a2c73c24ba006c589c6ad49d3cfc31dfe7e134265
SHA512 c1c73a8985d9b2bf836309b4e853ffe37e582716b400b71ed363b5af954f4c562d35038c0155f915f87668499273d3131cbb63f3854f388aa971f3547719847d

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\5D2F.exe

MD5 3573958cb38edffb8315c24dd715bd87
SHA1 6f78fe8ef4c0015da6df4183fe7e6226e629bf4c
SHA256 f2e98024fa0363c4199c28a2b8c25d621fe5beff48a65b06009263ad5005e8a8
SHA512 2b12a58dc5373caf2695ef6842cfb7296929e3bfb604a5c7a3a1030928c24e8ae602221ef68458b7b3efcd698c05c25f352dfc21b3551cf6809e55ff3175a686

C:\Users\Admin\AppData\Local\Temp\5D2F.exe

MD5 3573958cb38edffb8315c24dd715bd87
SHA1 6f78fe8ef4c0015da6df4183fe7e6226e629bf4c
SHA256 f2e98024fa0363c4199c28a2b8c25d621fe5beff48a65b06009263ad5005e8a8
SHA512 2b12a58dc5373caf2695ef6842cfb7296929e3bfb604a5c7a3a1030928c24e8ae602221ef68458b7b3efcd698c05c25f352dfc21b3551cf6809e55ff3175a686

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

MD5 aacac442fd439606eb6122177bea54ec
SHA1 a8b58402a720b454802a188d5906fd1df6ec01b3
SHA256 d95b2814893ec3043908919a2c73c24ba006c589c6ad49d3cfc31dfe7e134265
SHA512 c1c73a8985d9b2bf836309b4e853ffe37e582716b400b71ed363b5af954f4c562d35038c0155f915f87668499273d3131cbb63f3854f388aa971f3547719847d

C:\Users\Admin\AppData\Local\Temp\602E.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\602E.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

memory/5268-267-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5268-268-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5268-269-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5440-273-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5440-275-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5440-272-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5268-276-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\655F.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\655F.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\655F.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\6136.tmp\6137.tmp\6138.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

MD5 bc0a6049eecddb65511b6c817c98e1ef
SHA1 5caa207b6abf9144c6feb9bffcff3a8a076241ee
SHA256 25823e6984c9b840c119386ef6ffe881aad8b16f00d6e8e3129c3ebec0702395
SHA512 a5b9959cc7b5ca98093430d51d10e971849865120865bf3b6ee303b4437a00a127289e2971412f47cce3e394cb81e07373367dd923cb75babb6b138fc66d0f94

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

MD5 bc0a6049eecddb65511b6c817c98e1ef
SHA1 5caa207b6abf9144c6feb9bffcff3a8a076241ee
SHA256 25823e6984c9b840c119386ef6ffe881aad8b16f00d6e8e3129c3ebec0702395
SHA512 a5b9959cc7b5ca98093430d51d10e971849865120865bf3b6ee303b4437a00a127289e2971412f47cce3e394cb81e07373367dd923cb75babb6b138fc66d0f94

memory/5708-285-0x0000000000B00000-0x0000000000B3E000-memory.dmp

memory/5708-286-0x00000000744A0000-0x0000000074C50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\681F.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\681F.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/5792-292-0x0000000000B70000-0x0000000000B7A000-memory.dmp

memory/5792-293-0x00007FFE427A0000-0x00007FFE43261000-memory.dmp

memory/5708-294-0x00000000079A0000-0x00000000079B0000-memory.dmp

memory/5980-297-0x00000000744A0000-0x0000000074C50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6BD9.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\6BD9.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/5980-303-0x0000000005010000-0x0000000005020000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 012bffd4c65893cbc30b96ee4cb5a2ba
SHA1 556d8b1d6f745d5fcb83154e896af53e082c5711
SHA256 3f6757e12d3fe88fe968a94b316afb20bf78955be68e3e745233433baca1f52c
SHA512 a1ec193798335f2af0cb740f60fc9a7173acfa80193e4a23d6bbb793d9f73534e04c6a8d68d402b70d3ce28e7e12779da3c2a768091b6289df2462a0b256bed6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c62b9d647a75816f9e163ba913bd2699
SHA1 a82d01146507dd4cda83fb855d3223e608697b0e
SHA256 a6864f6e0556b8f6982b89568b07c69cb2366085d8041b0e7c68d68c7f6fd15e
SHA512 356b09bd54d27c0f2da6e9eed4f4c7cbc6b76dbd36f2f234fce0df822e60573ecf447e38a8df6d6438c45470c4ae8e76dd3b080c6b9e2971fb8432a39c910eb3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/5708-416-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/5792-417-0x00007FFE427A0000-0x00007FFE43261000-memory.dmp

memory/5708-472-0x00000000079A0000-0x00000000079B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4f7ae214729032c10977fc2d199375a7
SHA1 64e5a54855928a977939a47faaed790fabade11a
SHA256 457bf15e24183336e92192793c53769600b46f6d3bcb5a7b761d4070fdd8d064
SHA512 d181715f2addc9fe791a57ba0d412271ba8b57ec69e2db6b00a5b4a016f4fc9277b521debb765363841a11bf8530e2ac163cbd263b3aa4cf2f4fe0d447e701ed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588fa8.TMP

MD5 e6014a0e552488b48f32de3c948a12e5
SHA1 f86026a51200fa18893870645997bb42ba1787e2
SHA256 327b2e486b6ef41b8befc392128437191394b39777793bb2e20035586aa2a8ba
SHA512 f0c7324b443614c35efceab3e6a70020c4ceee6df55452dca9841e31545db1ec5a13635858c41aa26ebd51b7c61877d9227f69fa27a4b323117936731e682997

memory/5792-492-0x00007FFE427A0000-0x00007FFE43261000-memory.dmp

memory/5980-494-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/5980-502-0x0000000005010000-0x0000000005020000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5511e328fed314b14cef195e6d703c10
SHA1 90e836e0ea595fceb4e78cc5910135992b15b2eb
SHA256 c417751a23c760e995f77f0ed5a9bb15684d35038d2362c04340ca1ed221c8c9
SHA512 e79d6703e8300f260dfae45c8499de5b160f1d5484f5650fb691767915a5073c00b041c54ed1c573a8d8bda0a1879954100968a897dc9e1568d5a97d62d2431b

memory/4952-514-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/4952-515-0x0000000000040000-0x0000000000F6A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/5776-543-0x0000000000C00000-0x0000000001116000-memory.dmp

memory/5776-542-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/4952-546-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/5776-547-0x00000000059C0000-0x00000000059D0000-memory.dmp

memory/5776-549-0x0000000005C40000-0x0000000005CDC000-memory.dmp

memory/5776-548-0x00000000059B0000-0x00000000059B1000-memory.dmp

memory/5904-560-0x0000000002490000-0x0000000002590000-memory.dmp

memory/5904-561-0x00000000023B0000-0x00000000023B9000-memory.dmp

memory/5464-562-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5464-565-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5464-564-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5812-566-0x0000000004250000-0x0000000004650000-memory.dmp

memory/5812-567-0x0000000004750000-0x000000000503B000-memory.dmp

memory/5812-568-0x0000000000400000-0x000000000266D000-memory.dmp

memory/5776-569-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/5664-571-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/5664-572-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

memory/5664-573-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

memory/5664-570-0x0000000002930000-0x0000000002966000-memory.dmp

memory/5664-574-0x00000000050E0000-0x0000000005708000-memory.dmp

memory/5664-575-0x0000000004E10000-0x0000000004E32000-memory.dmp

memory/5664-576-0x0000000004FC0000-0x0000000005026000-memory.dmp

memory/5664-582-0x00000000058C0000-0x0000000005926000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dzezjlkg.4lk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5664-587-0x0000000005A70000-0x0000000005DC4000-memory.dmp

memory/5664-588-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b72e50bca8449b17425104fdfcd91547
SHA1 e5de29448d67767ac0bba1df99ecab2f553716f4
SHA256 6867d30851bd416857617a7210cd1e425144440ff7ae5a6b84330d7bc690f2a2
SHA512 677ecd5fe6059fc2633084b2d807babab9efdcf7f9e08b613a825da0b73581c8079f9e97c68666c73df71610fca62e0ccee1eaae1bc29a6eba53bf705f57a0f3

memory/772-599-0x0000000007550000-0x0000000007566000-memory.dmp

memory/5464-600-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1560-633-0x00000000020E0000-0x000000000213A000-memory.dmp

memory/3060-639-0x00007FF7F3E80000-0x00007FF7F4421000-memory.dmp

memory/2092-644-0x00000000001C0000-0x00000000001DE000-memory.dmp

memory/5776-657-0x0000000005E60000-0x0000000005E75000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 946dcd534c047756e0461c74e1304799
SHA1 22b588cee1d5b4037e3cbee9047d39b3b45aed71
SHA256 fcf37c1a8061d04b531b1482d61a4f99dfc9be933e3a98867d3eaf6100e7dfd0
SHA512 ac48aff980a51f7820c17afbc3b800181c331743a9070800c2d36c28737924cdb38e01bf7209c38df212efeaad350179c069b903a8f813a47c3d1cb4de25e144

C:\Users\Admin\AppData\Local\Temp\tmp235E.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp23A2.tmp

MD5 9a24ca06da9fb8f5735570a0381ab5a2
SHA1 27bdb2f2456cefc0b3e19d9be0a0dd64cc13d5de
SHA256 9ef3c0aca07106effa1ad59c2c80e27225b2dd0808d588702dcf1a24d5f5fe00
SHA512 dd8ef799db6b1812c26ddc76b51e0ea3bbd5acde4e470a5e1152868e1aa55aa83b7370486f2d09158ffeda7dc8d95a2b071fe6bd086118efdb2b0d361cbf5183

C:\Users\Admin\AppData\Local\Temp\tmp2431.tmp

MD5 567080b1e02b46b9893bdb6394d90027
SHA1 5e903c6e2a3d0a49c75d3b953a8053e2e55ac489
SHA256 6f0c6498abdbcc81e6c1689abbe588f7175fee8a61188cf43d93afdc7a92a179
SHA512 3668f8dbff10855a60520b192dd1eb88f2b32a18a30211907cb41e7c6bc74c4c6b1a4ad5ca9fdc522a67a2f0f7ea2c5e6f27c98fb824126f462ced6343258885

C:\Users\Admin\AppData\Local\Temp\tmp241C.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp2443.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp245F.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4