Analysis Overview
SHA256
72dbe3e582cb916db745466ec12ee67ae7df040521443fc5b1c2903b6f4f3442
Threat Level: Known bad
The file file.exe was found to be: Known bad.
Malicious Activity Summary
Glupteba payload
RedLine
Glupteba
Modifies Windows Defender Real-time Protection settings
SmokeLoader
DcRat
Detects Healer an antivirus disabler dropper
Healer
RedLine payload
Amadey
Stops running service(s)
Downloads MZ/PE file
Blocklisted process makes network request
Modifies Windows Firewall
Checks computer location settings
Windows security modification
Loads dropped DLL
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Suspicious use of SetThreadContext
Launches sc.exe
Program crash
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: MapViewOfSection
Enumerates system info in registry
Checks SCSI registry key(s)
Suspicious use of SendNotifyMessage
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-10 21:04
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-10 21:04
Reported
2023-10-10 21:06
Platform
win7-20230831-en
Max time kernel
121s
Max time network
126s
Command Line
Signatures
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2632 set thread context of 2708 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 288
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 268
Network
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
| MD5 | 4117c50615525fc2524037b75bc6fde1 |
| SHA1 | dd6cd25ba498fb224381a2a28ac0bbf568db4d10 |
| SHA256 | 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05 |
| SHA512 | 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
| MD5 | 4117c50615525fc2524037b75bc6fde1 |
| SHA1 | dd6cd25ba498fb224381a2a28ac0bbf568db4d10 |
| SHA256 | 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05 |
| SHA512 | 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1 |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
| MD5 | 4117c50615525fc2524037b75bc6fde1 |
| SHA1 | dd6cd25ba498fb224381a2a28ac0bbf568db4d10 |
| SHA256 | 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05 |
| SHA512 | 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
| MD5 | 4117c50615525fc2524037b75bc6fde1 |
| SHA1 | dd6cd25ba498fb224381a2a28ac0bbf568db4d10 |
| SHA256 | 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05 |
| SHA512 | 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
| MD5 | 668f26a8f66525132ea5c19b1e81ada2 |
| SHA1 | aadbd64239d25968aacb1ad5b2f4401105d452dc |
| SHA256 | 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632 |
| SHA512 | ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
| MD5 | 668f26a8f66525132ea5c19b1e81ada2 |
| SHA1 | aadbd64239d25968aacb1ad5b2f4401105d452dc |
| SHA256 | 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632 |
| SHA512 | ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
| MD5 | 668f26a8f66525132ea5c19b1e81ada2 |
| SHA1 | aadbd64239d25968aacb1ad5b2f4401105d452dc |
| SHA256 | 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632 |
| SHA512 | ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
| MD5 | 668f26a8f66525132ea5c19b1e81ada2 |
| SHA1 | aadbd64239d25968aacb1ad5b2f4401105d452dc |
| SHA256 | 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632 |
| SHA512 | ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
| MD5 | 40207eb7d80b561e885778b764e21b2b |
| SHA1 | 4cd0a723b095a11ca3e330c5556ef74dee656ffa |
| SHA256 | c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca |
| SHA512 | dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
| MD5 | 40207eb7d80b561e885778b764e21b2b |
| SHA1 | 4cd0a723b095a11ca3e330c5556ef74dee656ffa |
| SHA256 | c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca |
| SHA512 | dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
| MD5 | 40207eb7d80b561e885778b764e21b2b |
| SHA1 | 4cd0a723b095a11ca3e330c5556ef74dee656ffa |
| SHA256 | c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca |
| SHA512 | dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
| MD5 | 40207eb7d80b561e885778b764e21b2b |
| SHA1 | 4cd0a723b095a11ca3e330c5556ef74dee656ffa |
| SHA256 | c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca |
| SHA512 | dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
memory/2228-40-0x0000000000540000-0x000000000055E000-memory.dmp
memory/2228-41-0x0000000001EF0000-0x0000000001F0C000-memory.dmp
memory/2228-42-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-43-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-45-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-51-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-59-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-67-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-69-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-65-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-63-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-61-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-57-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-55-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-53-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-49-0x0000000001EF0000-0x0000000001F06000-memory.dmp
memory/2228-47-0x0000000001EF0000-0x0000000001F06000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
memory/2708-77-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-76-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-78-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-80-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-82-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
memory/2708-81-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-83-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-79-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-85-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2708-87-0x0000000000400000-0x0000000000433000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-10 21:04
Reported
2023-10-10 21:06
Platform
win10v2004-20230915-en
Max time kernel
76s
Max time network
159s
Command Line
Signatures
Amadey
DcRat
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Downloads MZ/PE file
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Stops running service(s)
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7BA5.bat | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\81B3.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\BB04.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe | N/A |
Executes dropped EXE
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\79DE.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\7F9F.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\source1.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1712 -ip 1712
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2240 -ip 2240
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 572
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1756 -ip 1756
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 604
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3596 -ip 3596
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 572
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\214E.tmp\215F.tmp\2160.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,12930978010422375930,17033962718603857391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,12930978010422375930,17033962718603857391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\79DE.exe
C:\Users\Admin\AppData\Local\Temp\79DE.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe
C:\Users\Admin\AppData\Local\Temp\7AE9.exe
C:\Users\Admin\AppData\Local\Temp\7AE9.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe
C:\Users\Admin\AppData\Local\Temp\7BA5.bat
"C:\Users\Admin\AppData\Local\Temp\7BA5.bat"
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7C9D.tmp\7C9E.tmp\7C9F.bat C:\Users\Admin\AppData\Local\Temp\7BA5.bat"
C:\Users\Admin\AppData\Local\Temp\7DF8.exe
C:\Users\Admin\AppData\Local\Temp\7DF8.exe
C:\Users\Admin\AppData\Local\Temp\7F9F.exe
C:\Users\Admin\AppData\Local\Temp\7F9F.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\81B3.exe
C:\Users\Admin\AppData\Local\Temp\81B3.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2368 -ip 2368
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2172 -ip 2172
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 396
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5376 -ip 5376
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5164 -ip 5164
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 600
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 416
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5376 -s 548
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
C:\Users\Admin\AppData\Local\Temp\BB04.exe
C:\Users\Admin\AppData\Local\Temp\BB04.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\source1.exe
"C:\Users\Admin\AppData\Local\Temp\source1.exe"
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\DAB2.exe
C:\Users\Admin\AppData\Local\Temp\DAB2.exe
C:\Users\Admin\AppData\Local\Temp\DC88.exe
C:\Users\Admin\AppData\Local\Temp\DC88.exe
C:\Users\Admin\AppData\Local\Temp\E081.exe
C:\Users\Admin\AppData\Local\Temp\E081.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=DC88.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=DC88.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa446d46f8,0x7ffa446d4708,0x7ffa446d4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7304109232795058134,2738511118946074995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\windefender.exe
C:\Windows\windefender.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.20.238.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 157.240.201.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| US | 8.8.8.8:53 | 35.201.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.179.250.142.in-addr.arpa | udp |
| NL | 142.250.179.141:443 | accounts.google.com | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | static.xx.fbcdn.net | udp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| CZ | 157.240.30.27:443 | static.xx.fbcdn.net | tcp |
| US | 8.8.8.8:53 | 27.30.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | facebook.com | udp |
| CZ | 157.240.30.35:443 | facebook.com | tcp |
| US | 8.8.8.8:53 | 35.30.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | fbcdn.net | udp |
| CZ | 157.240.30.35:443 | fbcdn.net | tcp |
| US | 8.8.8.8:53 | fbsbx.com | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | play.google.com | udp |
| NL | 142.251.36.14:443 | play.google.com | tcp |
| NL | 142.251.36.14:443 | play.google.com | udp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.36.251.142.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| US | 8.8.8.8:53 | 29.68.91.77.in-addr.arpa | udp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| RU | 5.42.92.211:80 | 5.42.92.211 | tcp |
| US | 8.8.8.8:53 | 80.65.42.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.92.42.5.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 126.211.247.8.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| TR | 185.216.70.222:80 | 185.216.70.222 | tcp |
| US | 8.8.8.8:53 | 222.70.216.185.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| MD | 176.123.9.142:37637 | tcp | |
| NL | 85.209.176.171:80 | 85.209.176.171 | tcp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.9.123.176.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.176.209.85.in-addr.arpa | udp |
| US | 8.8.8.8:53 | bytecloudasa.website | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 162.61.21.104.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | learn.microsoft.com | udp |
| NL | 104.85.2.139:443 | learn.microsoft.com | tcp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 8.8.8.8:53 | js.monitor.azure.com | udp |
| US | 13.107.246.67:443 | js.monitor.azure.com | tcp |
| US | 13.107.246.67:443 | js.monitor.azure.com | tcp |
| US | 8.8.8.8:53 | mscom.demdex.net | udp |
| IE | 34.250.238.79:443 | mscom.demdex.net | tcp |
| US | 8.8.8.8:53 | target.microsoft.com | udp |
| US | 8.8.8.8:53 | microsoftmscompoc.tt.omtrdc.net | udp |
| US | 8.8.8.8:53 | 139.2.85.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.234.44.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.246.107.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.238.250.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.75.67.172.in-addr.arpa | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | browser.events.data.microsoft.com | udp |
| US | 20.42.65.89:443 | browser.events.data.microsoft.com | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 20.42.65.89:443 | browser.events.data.microsoft.com | tcp |
| US | 8.8.8.8:53 | 89.65.42.20.in-addr.arpa | udp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 104.21.61.162:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| NL | 194.169.175.127:80 | host-host-file8.com | tcp |
| US | 8.8.8.8:53 | 127.175.169.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | bytecloudasa.website | udp |
| US | 172.67.212.39:80 | bytecloudasa.website | tcp |
| US | 8.8.8.8:53 | 39.212.67.172.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 2e539d02-ee2c-4dd2-9f28-45896e73e71d.uuid.cdntokiog.studio | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | server16.cdntokiog.studio | udp |
| US | 8.8.8.8:53 | stun.sipgate.net | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.134.233:443 | cdn.discordapp.com | tcp |
| US | 3.33.249.248:3478 | stun.sipgate.net | udp |
| BG | 185.82.216.49:443 | server16.cdntokiog.studio | tcp |
| US | 8.8.8.8:53 | walkinglate.com | udp |
| US | 188.114.96.0:443 | walkinglate.com | tcp |
| US | 8.8.8.8:53 | udp | |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 90.65.42.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | xmr-eu1.nanopool.org | udp |
| PL | 51.68.143.81:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.67.143:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 81.143.68.51.in-addr.arpa | udp |
| DE | 135.125.238.108:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | 143.67.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 108.238.125.135.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
| MD5 | 4117c50615525fc2524037b75bc6fde1 |
| SHA1 | dd6cd25ba498fb224381a2a28ac0bbf568db4d10 |
| SHA256 | 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05 |
| SHA512 | 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\YO1hV23.exe
| MD5 | 4117c50615525fc2524037b75bc6fde1 |
| SHA1 | dd6cd25ba498fb224381a2a28ac0bbf568db4d10 |
| SHA256 | 8dd971bd1909856434eef7acda38a29d41e5d43a1f64c03680c683b7846fcb05 |
| SHA512 | 011814d70a5f4d177a20e90dc833db3e4eb7ba1d8de034333c0678871be948c810840a77c1e9c704b2edf0fc5d2bb4b599b2f76d9c481c36acb733aa17bc9be1 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
| MD5 | 668f26a8f66525132ea5c19b1e81ada2 |
| SHA1 | aadbd64239d25968aacb1ad5b2f4401105d452dc |
| SHA256 | 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632 |
| SHA512 | ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rQ8yQ82.exe
| MD5 | 668f26a8f66525132ea5c19b1e81ada2 |
| SHA1 | aadbd64239d25968aacb1ad5b2f4401105d452dc |
| SHA256 | 9f0ecd275c1de758fbe4c2ba0f607b81216ffa8172513c7a7d9ea6a8d0728632 |
| SHA512 | ccedf392ff171cacbcec6be2623bbbec63d74e9da90a22a4be4ba7a120cc0d8b8296e09f0a9b4bd7d829a0615f2ca1650ff9d99bf4afde3c99cb75197cd85279 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
| MD5 | 40207eb7d80b561e885778b764e21b2b |
| SHA1 | 4cd0a723b095a11ca3e330c5556ef74dee656ffa |
| SHA256 | c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca |
| SHA512 | dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hC6tO26.exe
| MD5 | 40207eb7d80b561e885778b764e21b2b |
| SHA1 | 4cd0a723b095a11ca3e330c5556ef74dee656ffa |
| SHA256 | c1821a9f53d871a64ed58f53de1d9b839b1f3fc0680566d9f2c2aeb2efefb3ca |
| SHA512 | dafd1f0e17a1a8acb9c4f1910359acbf25565d38fab598bd4ebb6ff0dbb75632b881e9e631035770454dcab578b5b75265e7639ac93e3e8fa345be9faae47a01 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1ed68zM7.exe
| MD5 | 6241b03d68a610324ecda52f0f84e287 |
| SHA1 | da80280b6e3925e455925efd6c6e59a6118269c4 |
| SHA256 | ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2 |
| SHA512 | a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9 |
memory/3360-28-0x00000000744A0000-0x0000000074C50000-memory.dmp
memory/3360-29-0x0000000004B50000-0x0000000004B60000-memory.dmp
memory/3360-30-0x0000000000790000-0x00000000007AE000-memory.dmp
memory/3360-31-0x0000000004B50000-0x0000000004B60000-memory.dmp
memory/3360-32-0x0000000004B60000-0x0000000005104000-memory.dmp
memory/3360-33-0x0000000002540000-0x000000000255C000-memory.dmp
memory/3360-34-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-35-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-37-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-39-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-41-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-51-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-53-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-61-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-59-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-57-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-55-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-49-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-47-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-45-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-43-0x0000000002540000-0x0000000002556000-memory.dmp
memory/3360-62-0x00000000744A0000-0x0000000074C50000-memory.dmp
memory/3360-63-0x0000000004B50000-0x0000000004B60000-memory.dmp
memory/3360-64-0x0000000004B50000-0x0000000004B60000-memory.dmp
memory/3360-66-0x00000000744A0000-0x0000000074C50000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2ZE3001.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
memory/1712-70-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1712-74-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1712-72-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1712-71-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
| MD5 | edc5d8666c0caf68f37b71985ec0bd03 |
| SHA1 | 28499c1d50d5b80e55b812c7bbdf16e3b1bc7ddb |
| SHA256 | dc1112575c9eadc678d7e9e18f23ee001e4f56fafc3b9352f5ab05951991ecdb |
| SHA512 | f130fbac42510d7f8ed19963f0c81ea10bf1e103965b4031d04cfa5c2efc67ab019c3f5e330fcd56b87b1e4cc3e77dc0851d739ec94aba788e68522e8a1b4c5e |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3gO05ag.exe
| MD5 | edc5d8666c0caf68f37b71985ec0bd03 |
| SHA1 | 28499c1d50d5b80e55b812c7bbdf16e3b1bc7ddb |
| SHA256 | dc1112575c9eadc678d7e9e18f23ee001e4f56fafc3b9352f5ab05951991ecdb |
| SHA512 | f130fbac42510d7f8ed19963f0c81ea10bf1e103965b4031d04cfa5c2efc67ab019c3f5e330fcd56b87b1e4cc3e77dc0851d739ec94aba788e68522e8a1b4c5e |
memory/2084-78-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2084-79-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
| MD5 | 387577cb83814176b06f8f0631fea132 |
| SHA1 | a204ff6e96ff6e6e4cbcc8d6e855132180591449 |
| SHA256 | 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea |
| SHA512 | af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4Nz677Xm.exe
| MD5 | 387577cb83814176b06f8f0631fea132 |
| SHA1 | a204ff6e96ff6e6e4cbcc8d6e855132180591449 |
| SHA256 | 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea |
| SHA512 | af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c |
memory/3840-83-0x0000000000400000-0x000000000043E000-memory.dmp
memory/3840-84-0x0000000074090000-0x0000000074840000-memory.dmp
memory/3840-85-0x0000000007720000-0x00000000077B2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
| MD5 | aff13e435745c08faedeecefc7bd0bfe |
| SHA1 | b64f58a9034698edef453a0c71bb5b6945085a2c |
| SHA256 | 279d7109547300b564ab26c219638f5a2e679bb045de21bc8c829461ffcf9acc |
| SHA512 | dc8f26b6d0c0b2d5282f4f55f46e260196c8c0232e66de36de473ee50d2b918ee3132f02a83d6fb6179c26fa6d904bdc7ec00bc75370e13c769919a0468e4a0b |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5nS5Jc7.exe
| MD5 | aff13e435745c08faedeecefc7bd0bfe |
| SHA1 | b64f58a9034698edef453a0c71bb5b6945085a2c |
| SHA256 | 279d7109547300b564ab26c219638f5a2e679bb045de21bc8c829461ffcf9acc |
| SHA512 | dc8f26b6d0c0b2d5282f4f55f46e260196c8c0232e66de36de473ee50d2b918ee3132f02a83d6fb6179c26fa6d904bdc7ec00bc75370e13c769919a0468e4a0b |
memory/3840-90-0x00000000078E0000-0x00000000078F0000-memory.dmp
memory/3840-91-0x00000000078B0000-0x00000000078BA000-memory.dmp
memory/3152-92-0x0000000008480000-0x0000000008496000-memory.dmp
memory/2084-93-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\214E.tmp\215F.tmp\2160.bat
| MD5 | 0ec04fde104330459c151848382806e8 |
| SHA1 | 3b0b78d467f2db035a03e378f7b3a3823fa3d156 |
| SHA256 | 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f |
| SHA512 | 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40 |
memory/3840-97-0x00000000088A0000-0x0000000008EB8000-memory.dmp
memory/3840-98-0x0000000007AF0000-0x0000000007BFA000-memory.dmp
memory/3840-99-0x0000000007990000-0x00000000079A2000-memory.dmp
memory/3840-100-0x00000000079F0000-0x0000000007A2C000-memory.dmp
memory/3840-101-0x0000000007A30000-0x0000000007A7C000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 3478c18dc45d5448e5beefe152c81321 |
| SHA1 | a00c4c477bbd5117dec462cd6d1899ec7a676c07 |
| SHA256 | d2191cbeb51c49cbcd6f0ef24c8f93227b56680c95c762843137ac5d5f3f2e23 |
| SHA512 | 8473bb9429b1baf1ca4ac2f03f2fdecc89313624558cf9d3f58bebb58a8f394c950c34bdc7b606228090477f9c867b0d19a00c0e2f76355c613dafd73d69599c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4d25fc6e43a16159ebfd161f28e16ef7 |
| SHA1 | 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4 |
| SHA256 | cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5 |
| SHA512 | ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4d25fc6e43a16159ebfd161f28e16ef7 |
| SHA1 | 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4 |
| SHA256 | cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5 |
| SHA512 | ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4d25fc6e43a16159ebfd161f28e16ef7 |
| SHA1 | 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4 |
| SHA256 | cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5 |
| SHA512 | ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4d25fc6e43a16159ebfd161f28e16ef7 |
| SHA1 | 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4 |
| SHA256 | cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5 |
| SHA512 | ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1 |
\??\pipe\LOCAL\crashpad_4664_URBFVYGMKPNOZIVM
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 43cd17a99bf8125f4282c789b7cb1eaf |
| SHA1 | 9ba23849f59aaa25621f702a8b7f12e100218b1c |
| SHA256 | 9d57d45e1883a200b3ce606db2d0e614f5e8dd8065af02152c746f222fafb8a7 |
| SHA512 | 5a0206f706325f3aaa97ad9e01213314971b83c1067a1e375a8d641ca2ce1c89f7708bd8f8bbf52767fe1c60a139c9fba4c7cade5f1ca370525a5a93e7d350bc |
\??\pipe\LOCAL\crashpad_956_CWCJVPGNXMCKNZSZ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72d4d5d1-395c-4b94-8848-36dc6acc3800.tmp
| MD5 | 6e0ce95f67a9a7493a4fdb5bbe15a4f5 |
| SHA1 | 981d4054cf0bdefd883bb656438f3a01615f26b2 |
| SHA256 | d7ce8e301a2233dab058ddc30e11cb2a26b3a7309fa5e12c138923775ea03f11 |
| SHA512 | 73b335d83fb74ede83cbda9a4e6c72c8bd61168d24c245a92ed3b6b9945be6d42764eb0a3b8e965db16fb5a3c7c82b8366095fba1b005e386ddb77c84acc2758 |
memory/3840-226-0x0000000074090000-0x0000000074840000-memory.dmp
memory/3840-248-0x00000000078E0000-0x00000000078F0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d4028d000b6995254c51b9bb4d0c9c0a |
| SHA1 | f69ab2b4117f86201653b558c7e6f55144a41f72 |
| SHA256 | 9ebaa81abdb4ba78812f9395cb2cf3d5d6363d683d7ed74d9bcf7d95092eca60 |
| SHA512 | b8ac093f5f30292310b4e2d167211ef685c5826f1b3b5c4213eddc6f9bf7bcce78a4a136101dd9c845acd15b2149e7318b70b0586e034975ebeeb66698985a1d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 43cd17a99bf8125f4282c789b7cb1eaf |
| SHA1 | 9ba23849f59aaa25621f702a8b7f12e100218b1c |
| SHA256 | 9d57d45e1883a200b3ce606db2d0e614f5e8dd8065af02152c746f222fafb8a7 |
| SHA512 | 5a0206f706325f3aaa97ad9e01213314971b83c1067a1e375a8d641ca2ce1c89f7708bd8f8bbf52767fe1c60a139c9fba4c7cade5f1ca370525a5a93e7d350bc |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 75c79b044a90fe54649400219a40a775 |
| SHA1 | 7f4ffe7c0acc884e2f11c6d0a0eddf31a6c107cc |
| SHA256 | 5dea0b4cc5c3d94058581fa4b089d1b819a3288f19a303a0dacbdb825a071d46 |
| SHA512 | ec3b6045c15d09a2094f624beca077575f92acdc1100f8ba29852a86c3eee0b571f5da41cefb7e97b9238a5910a855ee145decc689017e2a9e030869e8d80b82 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | d555d038867542dfb2fb0575a0d3174e |
| SHA1 | 1a5868d6df0b5de26cf3fc7310b628ce0a3726f0 |
| SHA256 | 044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e |
| SHA512 | d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Temp\79DE.exe
| MD5 | 26e16643800e11da6d23a668fe5bffc4 |
| SHA1 | f3395c143dc6da867b784da8c55c84673c20403a |
| SHA256 | b6509e5dc57e9c64f02a41436d7f083981c39bd44e66570f553e2c012aa895c0 |
| SHA512 | e17f8d29e768268e32f2c8c5f1ec57f62496c0caf5c9b1c03c6c918aa5e6ae2fcd8156853e118f0834545ab8b04b9e731d8f8ae67a1527a8b0882f7373c60841 |
C:\Users\Admin\AppData\Local\Temp\79DE.exe
| MD5 | 26e16643800e11da6d23a668fe5bffc4 |
| SHA1 | f3395c143dc6da867b784da8c55c84673c20403a |
| SHA256 | b6509e5dc57e9c64f02a41436d7f083981c39bd44e66570f553e2c012aa895c0 |
| SHA512 | e17f8d29e768268e32f2c8c5f1ec57f62496c0caf5c9b1c03c6c918aa5e6ae2fcd8156853e118f0834545ab8b04b9e731d8f8ae67a1527a8b0882f7373c60841 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6ZU22AI.exe
| MD5 | 4daab548c87b65cf050e931d3ca42ad1 |
| SHA1 | b6ea92e1bb6dbd6a7bded6003e916f63faf6bb28 |
| SHA256 | 7750fa364c109944652e0e25071cd0ddb325a92fe40f186d801242f67636afc0 |
| SHA512 | c7eebe07d30295833ed7ca9f74768fef9051531497262ff61e9d1a3269278af2ada717f7aee1403bd61ad1d0c34bebc43ca53b5a8bde8346ca0be2093fb0af27 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe
| MD5 | a18283afb2aae9c440b749f41eb23c42 |
| SHA1 | 1090de0f48e997dc328312b3ffab7586029c0138 |
| SHA256 | e68c2f69d853606257c37a1e36a52a17b22b49593126adc0a2540ba316fb1d2d |
| SHA512 | 0bf8c00e37332699dd387c93eb1fbe801f4a7725bfb26863acd3b3392cb3772b768cf62edd7c5d2df2c8c2cbbfe054f42f7b8c8055be8232f9c4eaf4ac922da7 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UD6Nc0Qd.exe
| MD5 | a18283afb2aae9c440b749f41eb23c42 |
| SHA1 | 1090de0f48e997dc328312b3ffab7586029c0138 |
| SHA256 | e68c2f69d853606257c37a1e36a52a17b22b49593126adc0a2540ba316fb1d2d |
| SHA512 | 0bf8c00e37332699dd387c93eb1fbe801f4a7725bfb26863acd3b3392cb3772b768cf62edd7c5d2df2c8c2cbbfe054f42f7b8c8055be8232f9c4eaf4ac922da7 |
C:\Users\Admin\AppData\Local\Temp\7AE9.exe
| MD5 | 3573958cb38edffb8315c24dd715bd87 |
| SHA1 | 6f78fe8ef4c0015da6df4183fe7e6226e629bf4c |
| SHA256 | f2e98024fa0363c4199c28a2b8c25d621fe5beff48a65b06009263ad5005e8a8 |
| SHA512 | 2b12a58dc5373caf2695ef6842cfb7296929e3bfb604a5c7a3a1030928c24e8ae602221ef68458b7b3efcd698c05c25f352dfc21b3551cf6809e55ff3175a686 |
C:\Users\Admin\AppData\Local\Temp\7AE9.exe
| MD5 | 3573958cb38edffb8315c24dd715bd87 |
| SHA1 | 6f78fe8ef4c0015da6df4183fe7e6226e629bf4c |
| SHA256 | f2e98024fa0363c4199c28a2b8c25d621fe5beff48a65b06009263ad5005e8a8 |
| SHA512 | 2b12a58dc5373caf2695ef6842cfb7296929e3bfb604a5c7a3a1030928c24e8ae602221ef68458b7b3efcd698c05c25f352dfc21b3551cf6809e55ff3175a686 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe
| MD5 | 56d9fbce98df03bad77c09372964d861 |
| SHA1 | 15254dcce30064aebc7021dc39136deb562bf6d2 |
| SHA256 | 59cd12882e61f870ac687865c0db70a7c8e7a326bcaae1503e91044672bb8eb0 |
| SHA512 | f82d69c59c94876f3dfb0d86eb9e0206b216fc2392633d1805cbed7d5b252280a1a670973d0dd4ce063e29cc32f8cbdf9f9933178d0a572c91d923578e9a0ed4 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bP4YC6nA.exe
| MD5 | 56d9fbce98df03bad77c09372964d861 |
| SHA1 | 15254dcce30064aebc7021dc39136deb562bf6d2 |
| SHA256 | 59cd12882e61f870ac687865c0db70a7c8e7a326bcaae1503e91044672bb8eb0 |
| SHA512 | f82d69c59c94876f3dfb0d86eb9e0206b216fc2392633d1805cbed7d5b252280a1a670973d0dd4ce063e29cc32f8cbdf9f9933178d0a572c91d923578e9a0ed4 |
C:\Users\Admin\AppData\Local\Temp\7BA5.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe
| MD5 | 8421f6b463d0612dec16db3e0c029f2f |
| SHA1 | d90d59dd217a0cdc2c7e808d6f97f2fa0ed949b9 |
| SHA256 | 928bccfe9b0c43f6d915f8b08d4e5a385a12736686da90b913f40966313523f9 |
| SHA512 | f75c86034d090a626008e9fbd8a087e9a136a04a865fe1767166069718daaeb1140be31f3b4d99f63719f223586afdebf97c828771ea2622f5d9d3d843490230 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe
| MD5 | aacac442fd439606eb6122177bea54ec |
| SHA1 | a8b58402a720b454802a188d5906fd1df6ec01b3 |
| SHA256 | d95b2814893ec3043908919a2c73c24ba006c589c6ad49d3cfc31dfe7e134265 |
| SHA512 | c1c73a8985d9b2bf836309b4e853ffe37e582716b400b71ed363b5af954f4c562d35038c0155f915f87668499273d3131cbb63f3854f388aa971f3547719847d |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JD8xi3ZV.exe
| MD5 | aacac442fd439606eb6122177bea54ec |
| SHA1 | a8b58402a720b454802a188d5906fd1df6ec01b3 |
| SHA256 | d95b2814893ec3043908919a2c73c24ba006c589c6ad49d3cfc31dfe7e134265 |
| SHA512 | c1c73a8985d9b2bf836309b4e853ffe37e582716b400b71ed363b5af954f4c562d35038c0155f915f87668499273d3131cbb63f3854f388aa971f3547719847d |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\JR1ro8Xb.exe
| MD5 | 8421f6b463d0612dec16db3e0c029f2f |
| SHA1 | d90d59dd217a0cdc2c7e808d6f97f2fa0ed949b9 |
| SHA256 | 928bccfe9b0c43f6d915f8b08d4e5a385a12736686da90b913f40966313523f9 |
| SHA512 | f75c86034d090a626008e9fbd8a087e9a136a04a865fe1767166069718daaeb1140be31f3b4d99f63719f223586afdebf97c828771ea2622f5d9d3d843490230 |
C:\Users\Admin\AppData\Local\Temp\7BA5.bat
| MD5 | 9db53ae9e8af72f18e08c8b8955f8035 |
| SHA1 | 50ae5f80c1246733d54db98fac07380b1b2ff90d |
| SHA256 | d1d32c30e132d6348bd8e8baff51d1b706e78204b7f5775874946a7019a92b89 |
| SHA512 | 3cfb3104befbb5d60b5844e3841bf7c61baed8671191cfc42e0666c6ce92412ab235c70be718f52cfbd0e338c9f6f04508e0fd07b30f9bbda389e2e649c199d1 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1RN09Xh9.exe
| MD5 | 4e10fde88dd9d2d63f426599a292444e |
| SHA1 | aab6ffd77142b05a285bdfe17a0d81b9f104a144 |
| SHA256 | deca3ae35cab3253c52e03468f324bd45922c0e2eab9cf453eede5d75cdaad8e |
| SHA512 | 6d9b64a47ffc5e4dfd947da76833bad56be34a57993b55cbceb8f48be0ec556f3367eb78b05e93fcfed5d9a879770148bee74dc0da4f762b5f98d7c1efe527f8 |
C:\Users\Admin\AppData\Local\Temp\7DF8.exe
| MD5 | 387577cb83814176b06f8f0631fea132 |
| SHA1 | a204ff6e96ff6e6e4cbcc8d6e855132180591449 |
| SHA256 | 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea |
| SHA512 | af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c |
C:\Users\Admin\AppData\Local\Temp\7DF8.exe
| MD5 | 387577cb83814176b06f8f0631fea132 |
| SHA1 | a204ff6e96ff6e6e4cbcc8d6e855132180591449 |
| SHA256 | 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea |
| SHA512 | af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c |
C:\Users\Admin\AppData\Local\Temp\7DF8.exe
| MD5 | 387577cb83814176b06f8f0631fea132 |
| SHA1 | a204ff6e96ff6e6e4cbcc8d6e855132180591449 |
| SHA256 | 1d7bbec9f8fa7660280d7c70ac3c7ac52415b8646d03f84644afc2acd0ade8ea |
| SHA512 | af799a35c5b4f6badd7e63784e5c446d9bf4c5b4ee434d8d91e77e368d6b0f626312c9e942ee948e913772327bfb4294286577b29686935bfd4e8f0363fd417c |
C:\Users\Admin\AppData\Local\Temp\7F9F.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
C:\Users\Admin\AppData\Local\Temp\7F9F.exe
| MD5 | 57543bf9a439bf01773d3d508a221fda |
| SHA1 | 5728a0b9f1856aa5183d15ba00774428be720c35 |
| SHA256 | 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e |
| SHA512 | 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20 |
memory/5232-349-0x0000000000F70000-0x0000000000F7A000-memory.dmp
memory/5232-351-0x00007FFA3FA90000-0x00007FFA40551000-memory.dmp
memory/5280-353-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5280-354-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5280-360-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\81B3.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\81B3.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/5376-363-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5376-362-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5376-365-0x0000000000400000-0x0000000000433000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\7C9D.tmp\7C9E.tmp\7C9F.bat
| MD5 | 0ec04fde104330459c151848382806e8 |
| SHA1 | 3b0b78d467f2db035a03e378f7b3a3823fa3d156 |
| SHA256 | 1ee0a6f7c4006a36891e2fd72a0257e89fd79ad811987c0e17f847fe99ea695f |
| SHA512 | 8b928989f17f09282e008da27e8b7fd373c99d5cafb85b5f623e02dbb6273f0ed76a9fbbfef0b080dbba53b6de8ee491ea379a38e5b6ca0763b11dd4de544b40 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
memory/5280-373-0x0000000000400000-0x0000000000433000-memory.dmp
memory/5448-372-0x0000000074090000-0x0000000074840000-memory.dmp
memory/5448-377-0x0000000007A70000-0x0000000007A80000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 78e5bc5b95cf1717fc889f1871f5daf6 |
| SHA1 | 65169a87dd4a0121cd84c9094d58686be468a74a |
| SHA256 | 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966 |
| SHA512 | d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe
| MD5 | bc0a6049eecddb65511b6c817c98e1ef |
| SHA1 | 5caa207b6abf9144c6feb9bffcff3a8a076241ee |
| SHA256 | 25823e6984c9b840c119386ef6ffe881aad8b16f00d6e8e3129c3ebec0702395 |
| SHA512 | a5b9959cc7b5ca98093430d51d10e971849865120865bf3b6ee303b4437a00a127289e2971412f47cce3e394cb81e07373367dd923cb75babb6b138fc66d0f94 |
memory/5824-381-0x00000000002E0000-0x000000000031E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2Ik712VL.exe
| MD5 | bc0a6049eecddb65511b6c817c98e1ef |
| SHA1 | 5caa207b6abf9144c6feb9bffcff3a8a076241ee |
| SHA256 | 25823e6984c9b840c119386ef6ffe881aad8b16f00d6e8e3129c3ebec0702395 |
| SHA512 | a5b9959cc7b5ca98093430d51d10e971849865120865bf3b6ee303b4437a00a127289e2971412f47cce3e394cb81e07373367dd923cb75babb6b138fc66d0f94 |
memory/5824-382-0x0000000074090000-0x0000000074840000-memory.dmp
memory/5824-383-0x0000000007260000-0x0000000007270000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4d25fc6e43a16159ebfd161f28e16ef7 |
| SHA1 | 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4 |
| SHA256 | cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5 |
| SHA512 | ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 4d25fc6e43a16159ebfd161f28e16ef7 |
| SHA1 | 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4 |
| SHA256 | cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5 |
| SHA512 | ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1 |
memory/5232-465-0x00007FFA3FA90000-0x00007FFA40551000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589eeb.TMP
| MD5 | c4921eac49235d5067614af746c25369 |
| SHA1 | c4ee2820e92e138c687ea42f9fe40779f716b786 |
| SHA256 | 57d90fd9dd30c74eae8d0d55d1a24cba6bfc985b77ac998652f57dd21d0037df |
| SHA512 | ffee5e9db5ea5dc98580eae21d6b79ca4a271e34889c8c9883767c20cdd67ef55c85adc15d7f2ce7df951569b1cdcbbce78624a8f2437ebbe3f6d40f7c32c346 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | a3e76c99b865001dce2ff295cf68b1da |
| SHA1 | 396ef0c22b4b172895fd2d32c9e733df31d42996 |
| SHA256 | b1aaef4502b1665cdce80082eb7ddaaca74871dd7c35c045e2e64b076585633a |
| SHA512 | d0bbe26e7edfa9915bac17ed45b50ff67f0e908abd5a14fb56744182097f42f61295003764e4168922873a03cc56452539162820bdae67354e29c9bd75bf8094 |
memory/5448-494-0x0000000074090000-0x0000000074840000-memory.dmp
memory/5232-496-0x00007FFA3FA90000-0x00007FFA40551000-memory.dmp
memory/5448-497-0x0000000007A70000-0x0000000007A80000-memory.dmp
memory/5824-498-0x0000000074090000-0x0000000074840000-memory.dmp
memory/5824-499-0x0000000007260000-0x0000000007270000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | e3f37f7f47f2d67f1390858271d0c543 |
| SHA1 | 0d116cdb59f0e3a8e2501a8aef4e04f1a6f1e15d |
| SHA256 | 7f739d3c7b2e6d6edc094082fe11140ae824f2473e160d7462e502111f7a95fb |
| SHA512 | 366f0f64bdc9a21f4aab7692e41f2f3e0d4800488e2d4f89b7fb990bcf8ce9dec11519439329bb58a7335dc63bca81d0df80cc11b645f567767dc211997e0a25 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 52027521be157551c2d088cac4d90a5e |
| SHA1 | cfc2591d3f535036807a5d4d83428869d31ac7ba |
| SHA256 | b7426fb5e84c842d61881e89dedb8525ac60df7083282b7eb47f702094e4a494 |
| SHA512 | cce862e55e8d3705213c6bdeb4273008006145c6bb206f017365f17397aaf844af6e6520710337a29b01e46646342091467cb8440ef66254b0ac94bd136f10d2 |
memory/2880-520-0x0000000074090000-0x0000000074840000-memory.dmp
memory/2880-521-0x0000000000A10000-0x000000000193A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | b44f3ea702caf5fba20474d4678e67f6 |
| SHA1 | d33da22fcd5674123807aaf01123d49a69901e33 |
| SHA256 | 6b066c420ab228bf788f1abda2911eefbb89834640e64d8d6b4f14cb963e4eb8 |
| SHA512 | ed0dcd43d8bb8bab253daaf069353d1c720aa13217230d643e2c056089d56753aa4df5ee478833f716e248277c2553e81ae9c21f0f1502fdaf5bbac726d2a0c3 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | aa6f521d78f6e9101a1a99f8bfdfbf08 |
| SHA1 | 81abd59d8275c1a1d35933f76282b411310323be |
| SHA256 | 3d5c0be6aafffa6324a44619131ff8994b0b59856dedf444ced072cae1ebc39d |
| SHA512 | 43ce4ad2d8295880ca1560c7a14cff89f2dfa70942d7679faae417f58177f63ae436604bbe914bd8fbbaedfb992ab6da4637af907e2b28696be53843d7ed8153 |
C:\Users\Admin\AppData\Local\Temp\source1.exe
| MD5 | e082a92a00272a3c1cd4b0de30967a79 |
| SHA1 | 16c391acf0f8c637d36a93e217591d8319e3f041 |
| SHA256 | eb318c91e0a9f49ad218298a13f7d8981e6ab145097107e5316d857943bc1cdc |
| SHA512 | 26b77179a46e1a72dab0cfa99e030133e99057d10e14a36ed3ef4935e7778b0f6505bad43b14523275e7dc5937bb2f5f7c650cb7ec6e7012cbbe874e52c15288 |
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
memory/2328-548-0x0000000074090000-0x0000000074840000-memory.dmp
memory/2328-549-0x0000000000010000-0x0000000000526000-memory.dmp
memory/2880-552-0x0000000074090000-0x0000000074840000-memory.dmp
memory/2328-553-0x0000000004DB0000-0x0000000004DC0000-memory.dmp
memory/2328-554-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/2328-555-0x00000000050A0000-0x000000000513C000-memory.dmp
memory/3768-557-0x0000000002340000-0x0000000002440000-memory.dmp
memory/3768-558-0x0000000002320000-0x0000000002329000-memory.dmp
memory/5432-559-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5432-561-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5548-562-0x0000000004250000-0x0000000004656000-memory.dmp
memory/5548-563-0x0000000004760000-0x000000000504B000-memory.dmp
memory/5548-573-0x0000000000400000-0x000000000266D000-memory.dmp
memory/2328-575-0x0000000074090000-0x0000000074840000-memory.dmp
memory/3516-574-0x00000000049C0000-0x00000000049F6000-memory.dmp
memory/3516-577-0x0000000074090000-0x0000000074840000-memory.dmp
memory/2328-579-0x0000000004DB0000-0x0000000004DC0000-memory.dmp
memory/3516-578-0x00000000049B0000-0x00000000049C0000-memory.dmp
memory/3516-580-0x00000000057C0000-0x00000000057E2000-memory.dmp
memory/3516-576-0x0000000005030000-0x0000000005658000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_szexxfo3.0m3.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3516-587-0x0000000005940000-0x00000000059A6000-memory.dmp
memory/3516-581-0x0000000005860000-0x00000000058C6000-memory.dmp
memory/3516-592-0x0000000005B70000-0x0000000005EC4000-memory.dmp
memory/3516-593-0x0000000005F70000-0x0000000005F8E000-memory.dmp
memory/3152-598-0x0000000008560000-0x0000000008576000-memory.dmp
memory/5432-599-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4560-604-0x00000000020A0000-0x00000000020FA000-memory.dmp
memory/4560-603-0x0000000000400000-0x000000000046F000-memory.dmp
memory/4244-610-0x00000000001C0000-0x00000000001DE000-memory.dmp
memory/5548-623-0x0000000000400000-0x000000000266D000-memory.dmp
memory/5464-625-0x00007FF778400000-0x00007FF7789A1000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | e26cf54ae8837592d1ccbac222909ec3 |
| SHA1 | d2ab10f0cacf3eaf1203033bf2030469d26731eb |
| SHA256 | 25acce6d066e6423e2fa55f4ed13915027e09405b427e80fd5cfb07e2182687a |
| SHA512 | 8f1dda8e6d351403a0a58ff8011f5497cb4cfb7047c27ac4d32c2bd417f94468a74535c50f0c6b30b303f6aa240de85142596b9dacb945a0097f539219bb6650 |
memory/2328-643-0x0000000005070000-0x0000000005085000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 3a32a6fc59b70a4283ac1ec6e5213de1 |
| SHA1 | 18f761839725e3b301efa24ba4953b87b4022287 |
| SHA256 | edaef2783f2a28fa5a77e2bb235d6e06d4e6deb4bd80fbb434cf3386e7ec6365 |
| SHA512 | dfb85df84a06192a278b70e08b21a5c86e1e36105e0242259feb3ceb2823ed981a996bea5605f0417edbc625c7de30aa2b876ff010f169610750f47493132c32 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | ca8c0a0e18308d7f1acd9cff2b4bbc4a |
| SHA1 | 119a4d740368bee6946ce19a1475f3ef79439fdf |
| SHA256 | d9833d2a9b461552423428f64a011c154d63001b347fdf69456c47b125c003e7 |
| SHA512 | 90c1efadb4e59432d7efc342e35f6003e8ae42c3099ef9d65ec7d27ddb320201375766f7d77791ea31cd8b5a108250f87811e74ba985c2d4ec82af3063c82cd3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 98c425ed07c9e8d0bccab4844bbd21f6 |
| SHA1 | f8874ef324c8ce96ff38e57acc8df44c61b9a530 |
| SHA256 | 9536ba4b81ae88ec16e75951bb781bd73e797636f054e682f79548e84cbf8991 |
| SHA512 | dff38678f0a788a7d8fd85585bbeb34e36104a794dc3673a83df719454f4fe69b101a70926282cc4944768f830e1951e091be7864f7b597606a28ab7d1bf6c4e |
C:\Users\Admin\AppData\Local\Temp\tmpF97.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Temp\tmp1059.tmp
| MD5 | 8395952fd7f884ddb74e81045da7a35e |
| SHA1 | f0f7f233824600f49147252374bc4cdfab3594b9 |
| SHA256 | 248c0c254592c08684c603ac37896813354c88ab5992fadf9d719ec5b958af58 |
| SHA512 | ea296a74758c94f98c352ff7d64c85dcd23410f9b4d3b1713218b8ee45c6b02febff53073819c973da0207471c7d70309461d47949e4d40ba7423328cf23f6cd |
C:\Users\Admin\AppData\Local\Temp\tmp119D.tmp
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\tmp11A3.tmp
| MD5 | 1129fed11612bec767b4cfca52e6a811 |
| SHA1 | 18c21dbf1882a35d1c750038064bc444574b4032 |
| SHA256 | ad4bb71db25bed0f9d4bc3efc78386fc02db02c472556a9382279b99d1562ce0 |
| SHA512 | 947085d6625ddc8641fddb5f7243e2824e78ac11c325599cd89425c395af2e832add9155ee00392eec5565870daf70e149ae1bb28739b5be2cf95cfbb686284e |
C:\Users\Admin\AppData\Local\Temp\tmp125D.tmp
| MD5 | d367ddfda80fdcf578726bc3b0bc3e3c |
| SHA1 | 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671 |
| SHA256 | 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0 |
| SHA512 | 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77 |
C:\Users\Admin\AppData\Local\Temp\tmp1232.tmp
| MD5 | f70aa3fa04f0536280f872ad17973c3d |
| SHA1 | 50a7b889329a92de1b272d0ecf5fce87395d3123 |
| SHA256 | 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8 |
| SHA512 | 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |