Malware Analysis Report

2025-08-10 23:43

Sample ID 231011-y2532aba6t
Target 51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f
SHA256 bb7aef3da5a750205d9689c78254daf2de52e86f3e2ded55cc2d60db9e19d410
Tags
amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan breha kukish microsoft
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bb7aef3da5a750205d9689c78254daf2de52e86f3e2ded55cc2d60db9e19d410

Threat Level: Known bad

The file 51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f was found to be: Known bad.

Malicious Activity Summary

amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan breha kukish microsoft

RedLine

RedLine payload

Modifies Windows Defender Real-time Protection settings

SectopRAT payload

Detects Healer an antivirus disabler dropper

Detected google phishing page

Healer

Amadey

SmokeLoader

SectopRAT

DcRat

Downloads MZ/PE file

Checks computer location settings

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Windows security modification

Loads dropped DLL

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of SetThreadContext

Detected potential entity reuse from brand microsoft.

Enumerates physical storage devices

Program crash

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: GetForegroundWindowSpam

Enumerates system info in registry

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

Modifies system certificate store

Suspicious use of UnmapMainImage

Uses Task Scheduler COM API

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-11 20:17

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-11 20:17

Reported

2023-10-12 14:48

Platform

win7-20230831-en

Max time kernel

153s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat

Detected google phishing page

phishing google

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\601E.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\601E.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\601E.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\601E.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\601E.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\601E.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6A5D.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\601E.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\601E.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\447F.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000446a931132a14a8fe1e556008f7ed96223349ff0d38c9789b6cd18c3ea6d3eb4000000000e8000000002000020000000b45bffb853c41f11410debcf221de791791db851da7d601e91fab0726ed9088290000000c4b569216059a82d1c78dc49391ce1d3dc971380749919fd2b680cf79b5218d917bc0af04f2965cd2efc6ddf503175b6c394fe329b8a50bdc6da143f247281503959a486cc9b30596f946dfd1cd21bf66120f8b0a77487ba1500f001354607cbdda0a6364d0c802fd98b6a3d7c762af3734d79bb80f83c36f62ef53f0bc62560b12d385e99d411b0f894174ccee031c740000000aec32e12450f6d9b38c0657a66bfaf81bfbe0d8f31665631e4d0960c1753eca83ad9e0e6e487895a0e2c98ed98faa6f05a23f22161e5238128722578c95d44c2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26A62791-690E-11EE-86CB-C6004B6B9118} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007832999c35766c4bae1b34334b3bf81200000000020000000000106600000001000020000000cfcad6d7388d7bc49a0619662d5fa0dfdbb5e9f310f079948b6e312ded4a1aff000000000e80000000020000200000000e4235a11d4c3135a461f9649b9e08cbd60fd2a5424d39c8b60da6f24b1b2ea7200000003f78255ffb7aaa0ff75c0fefd4442e87484a14114605a8d38b66a9a8e768b6bf40000000f3c4a96bc51364a872226b6897c09bf774e4eada60676d5539c99edcdf7eea90eb236c92a7f2524b0fe219dc7007f035e4a31d7df42730c94b9a525255f21445 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{291F5551-690E-11EE-86CB-C6004B6B9118} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403283874" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309557fe1afdd901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\78FF.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\78FF.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\78FF.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\601E.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\91DF.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7076.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6A5D.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2896 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\SysWOW64\WerFault.exe
PID 2896 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\SysWOW64\WerFault.exe
PID 2896 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\SysWOW64\WerFault.exe
PID 2896 wrote to memory of 2420 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\SysWOW64\WerFault.exe
PID 1276 wrote to memory of 2932 N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe
PID 1276 wrote to memory of 2932 N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe
PID 1276 wrote to memory of 2932 N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe
PID 1276 wrote to memory of 2932 N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe
PID 1276 wrote to memory of 2932 N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe
PID 1276 wrote to memory of 2932 N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe
PID 1276 wrote to memory of 2932 N/A N/A C:\Users\Admin\AppData\Local\Temp\447F.exe
PID 1276 wrote to memory of 2124 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe
PID 1276 wrote to memory of 2124 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe
PID 1276 wrote to memory of 2124 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe
PID 1276 wrote to memory of 2124 N/A N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe
PID 1276 wrote to memory of 2612 N/A N/A C:\Windows\system32\cmd.exe
PID 1276 wrote to memory of 2612 N/A N/A C:\Windows\system32\cmd.exe
PID 1276 wrote to memory of 2612 N/A N/A C:\Windows\system32\cmd.exe
PID 1276 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5074.exe
PID 1276 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5074.exe
PID 1276 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5074.exe
PID 1276 wrote to memory of 2560 N/A N/A C:\Users\Admin\AppData\Local\Temp\5074.exe
PID 2612 wrote to memory of 2456 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2612 wrote to memory of 2456 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2612 wrote to memory of 2456 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1276 wrote to memory of 1504 N/A N/A C:\Users\Admin\AppData\Local\Temp\601E.exe
PID 1276 wrote to memory of 1504 N/A N/A C:\Users\Admin\AppData\Local\Temp\601E.exe
PID 1276 wrote to memory of 1504 N/A N/A C:\Users\Admin\AppData\Local\Temp\601E.exe
PID 2124 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe C:\Windows\SysWOW64\WerFault.exe
PID 2124 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe C:\Windows\SysWOW64\WerFault.exe
PID 2124 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe C:\Windows\SysWOW64\WerFault.exe
PID 2124 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\49DD.exe C:\Windows\SysWOW64\WerFault.exe
PID 2612 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2612 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2612 wrote to memory of 1732 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2932 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\447F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 2932 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\447F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 2932 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\447F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 2932 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\447F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 2932 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\447F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 2932 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\447F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 2932 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\447F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 1276 wrote to memory of 1904 N/A N/A C:\Users\Admin\AppData\Local\Temp\6859.exe
PID 1276 wrote to memory of 1904 N/A N/A C:\Users\Admin\AppData\Local\Temp\6859.exe
PID 1276 wrote to memory of 1904 N/A N/A C:\Users\Admin\AppData\Local\Temp\6859.exe
PID 1276 wrote to memory of 1904 N/A N/A C:\Users\Admin\AppData\Local\Temp\6859.exe
PID 2456 wrote to memory of 1120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2456 wrote to memory of 1120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2456 wrote to memory of 1120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2456 wrote to memory of 1120 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1980 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe
PID 1980 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe
PID 1980 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe
PID 1980 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

Processes

C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe

"C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 52

C:\Users\Admin\AppData\Local\Temp\447F.exe

C:\Users\Admin\AppData\Local\Temp\447F.exe

C:\Users\Admin\AppData\Local\Temp\49DD.exe

C:\Users\Admin\AppData\Local\Temp\49DD.exe

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\4C3E.bat" "

C:\Users\Admin\AppData\Local\Temp\5074.exe

C:\Users\Admin\AppData\Local\Temp\5074.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\601E.exe

C:\Users\Admin\AppData\Local\Temp\601E.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 48

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

C:\Users\Admin\AppData\Local\Temp\6859.exe

C:\Users\Admin\AppData\Local\Temp\6859.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:340993 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

C:\Users\Admin\AppData\Local\Temp\6A5D.exe

C:\Users\Admin\AppData\Local\Temp\6A5D.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 48

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

C:\Users\Admin\AppData\Local\Temp\7076.exe

C:\Users\Admin\AppData\Local\Temp\7076.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\78FF.exe

C:\Users\Admin\AppData\Local\Temp\78FF.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

C:\Users\Admin\AppData\Local\Temp\7C2B.exe

C:\Users\Admin\AppData\Local\Temp\7C2B.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\815A.exe

C:\Users\Admin\AppData\Local\Temp\815A.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 36

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\91DF.exe

C:\Users\Admin\AppData\Local\Temp\91DF.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\system32\taskeng.exe

taskeng.exe {0644DB8F-C77C-4835-BBAD-162363C4FA3A} S-1-5-21-3185155662-718608226-894467740-1000:YETUIZPU\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275463 /prefetch:2

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Network

Country Destination Domain Proto
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 www.facebook.com udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 accounts.google.com udp
TR 185.216.70.222:80 185.216.70.222 tcp
BG 171.22.28.213:80 171.22.28.213 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
GB 157.240.221.35:443 facebook.com tcp
GB 157.240.221.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
GB 157.240.221.35:443 fbsbx.com tcp
GB 157.240.221.35:443 fbsbx.com tcp
MD 176.123.9.142:37637 tcp
IT 185.196.9.65:80 tcp
NL 85.209.176.171:80 85.209.176.171 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
TR 185.216.70.238:37515 tcp
US 8.8.8.8:53 accounts.youtube.com udp
NL 142.250.179.206:443 accounts.youtube.com tcp
NL 142.250.179.206:443 accounts.youtube.com tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
GB 157.240.221.35:443 fbsbx.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2312-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2312-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2312-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2312-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2312-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1276-5-0x0000000002B40000-0x0000000002B56000-memory.dmp

memory/2312-6-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\447F.exe

MD5 8d8bb56f32eb8c429dc5508745235c55
SHA1 359f631d7c056a3262a1b756c5c72f261eed97ad
SHA256 f849ea0a82ed039f8c726ab554550d3ac56ff807faa122fc7f64621a4c83c09d
SHA512 5a5b0f3ea34b8a8e9edbcf2899299c84ce0d0f8dc0b0883e507236a85643fdb13873dfefd91ff6e693ce5a3d3b1ab0ba23326ef38447a9b4921f398253d21cbe

C:\Users\Admin\AppData\Local\Temp\49DD.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

C:\Users\Admin\AppData\Local\Temp\49DD.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

C:\Users\Admin\AppData\Local\Temp\447F.exe

MD5 8d8bb56f32eb8c429dc5508745235c55
SHA1 359f631d7c056a3262a1b756c5c72f261eed97ad
SHA256 f849ea0a82ed039f8c726ab554550d3ac56ff807faa122fc7f64621a4c83c09d
SHA512 5a5b0f3ea34b8a8e9edbcf2899299c84ce0d0f8dc0b0883e507236a85643fdb13873dfefd91ff6e693ce5a3d3b1ab0ba23326ef38447a9b4921f398253d21cbe

C:\Users\Admin\AppData\Local\Temp\4C3E.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\4C3E.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\5074.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

C:\Users\Admin\AppData\Local\Temp\5074.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

\Users\Admin\AppData\Local\Temp\447F.exe

MD5 8d8bb56f32eb8c429dc5508745235c55
SHA1 359f631d7c056a3262a1b756c5c72f261eed97ad
SHA256 f849ea0a82ed039f8c726ab554550d3ac56ff807faa122fc7f64621a4c83c09d
SHA512 5a5b0f3ea34b8a8e9edbcf2899299c84ce0d0f8dc0b0883e507236a85643fdb13873dfefd91ff6e693ce5a3d3b1ab0ba23326ef38447a9b4921f398253d21cbe

C:\Users\Admin\AppData\Local\Temp\601E.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\601E.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

\Users\Admin\AppData\Local\Temp\49DD.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

\Users\Admin\AppData\Local\Temp\49DD.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

\Users\Admin\AppData\Local\Temp\49DD.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

\Users\Admin\AppData\Local\Temp\49DD.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

MD5 e9ebaab9a3606a72b7bc15db6ede99d0
SHA1 aa452c5eb3a6e3b5e4f92852de56cf65a1d9ccc7
SHA256 28c121e7fe0c5dbcba40c2848ebaf4610265978122884c451362d519fbb11f25
SHA512 2720c84b23963a862f6c40b91b8f75855ba2b54f1558b2f8baf37814a291f6fda79bab5196a6be2694b4d4449fcf313d229529dffe4a843d68fbf476b4f70afd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

MD5 e9ebaab9a3606a72b7bc15db6ede99d0
SHA1 aa452c5eb3a6e3b5e4f92852de56cf65a1d9ccc7
SHA256 28c121e7fe0c5dbcba40c2848ebaf4610265978122884c451362d519fbb11f25
SHA512 2720c84b23963a862f6c40b91b8f75855ba2b54f1558b2f8baf37814a291f6fda79bab5196a6be2694b4d4449fcf313d229529dffe4a843d68fbf476b4f70afd

\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

MD5 e9ebaab9a3606a72b7bc15db6ede99d0
SHA1 aa452c5eb3a6e3b5e4f92852de56cf65a1d9ccc7
SHA256 28c121e7fe0c5dbcba40c2848ebaf4610265978122884c451362d519fbb11f25
SHA512 2720c84b23963a862f6c40b91b8f75855ba2b54f1558b2f8baf37814a291f6fda79bab5196a6be2694b4d4449fcf313d229529dffe4a843d68fbf476b4f70afd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

MD5 e9ebaab9a3606a72b7bc15db6ede99d0
SHA1 aa452c5eb3a6e3b5e4f92852de56cf65a1d9ccc7
SHA256 28c121e7fe0c5dbcba40c2848ebaf4610265978122884c451362d519fbb11f25
SHA512 2720c84b23963a862f6c40b91b8f75855ba2b54f1558b2f8baf37814a291f6fda79bab5196a6be2694b4d4449fcf313d229529dffe4a843d68fbf476b4f70afd

C:\Users\Admin\AppData\Local\Temp\6859.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\6859.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

MD5 965fd26a4bd59232f88748e2db1d49e2
SHA1 b21ab06321fd86baf207f7867be195a1855f619e
SHA256 4b13637e1d389d2095dfe1a7ef6f13c4a5a27599e1f05b2a31f7da3332d67690
SHA512 746dc3f57a489e823135c43acef45e55c8a20684d7036102f71de9d377f0c24365576a508ce0ae8ae35c5f25b1c7f4dff5cce262e8f4868426aa4af040e64f7f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

MD5 965fd26a4bd59232f88748e2db1d49e2
SHA1 b21ab06321fd86baf207f7867be195a1855f619e
SHA256 4b13637e1d389d2095dfe1a7ef6f13c4a5a27599e1f05b2a31f7da3332d67690
SHA512 746dc3f57a489e823135c43acef45e55c8a20684d7036102f71de9d377f0c24365576a508ce0ae8ae35c5f25b1c7f4dff5cce262e8f4868426aa4af040e64f7f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

MD5 965fd26a4bd59232f88748e2db1d49e2
SHA1 b21ab06321fd86baf207f7867be195a1855f619e
SHA256 4b13637e1d389d2095dfe1a7ef6f13c4a5a27599e1f05b2a31f7da3332d67690
SHA512 746dc3f57a489e823135c43acef45e55c8a20684d7036102f71de9d377f0c24365576a508ce0ae8ae35c5f25b1c7f4dff5cce262e8f4868426aa4af040e64f7f

\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

MD5 965fd26a4bd59232f88748e2db1d49e2
SHA1 b21ab06321fd86baf207f7867be195a1855f619e
SHA256 4b13637e1d389d2095dfe1a7ef6f13c4a5a27599e1f05b2a31f7da3332d67690
SHA512 746dc3f57a489e823135c43acef45e55c8a20684d7036102f71de9d377f0c24365576a508ce0ae8ae35c5f25b1c7f4dff5cce262e8f4868426aa4af040e64f7f

C:\Users\Admin\AppData\Local\Temp\6A5D.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

MD5 fa401b9dfca460e40d158f6674234a3f
SHA1 6b2a11107e70b3ffa2ff6ee9ae8b004c0a726d06
SHA256 e877bdcde12a96e02952b76d13eac141bee541e6e2f12d1f833f76d76d5ee5ab
SHA512 6fb1720f06f705ac8bc67f4aa483b55b8ce7672cf58fe5da22108c28a52f18a2b05bd8e60eb08096fb80dfec595cf47a1315ce4805c064e4b32d3a291153ad32

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

MD5 fa401b9dfca460e40d158f6674234a3f
SHA1 6b2a11107e70b3ffa2ff6ee9ae8b004c0a726d06
SHA256 e877bdcde12a96e02952b76d13eac141bee541e6e2f12d1f833f76d76d5ee5ab
SHA512 6fb1720f06f705ac8bc67f4aa483b55b8ce7672cf58fe5da22108c28a52f18a2b05bd8e60eb08096fb80dfec595cf47a1315ce4805c064e4b32d3a291153ad32

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{26A62791-690E-11EE-86CB-C6004B6B9118}.dat

MD5 1eb1023f2fb6b27b5918d5d15eaf3816
SHA1 7042ef74d54d8140f1e233a40b20d4aabb98aa5c
SHA256 3f7a3a452fe47dff9068261e2043cbe85125fbd4cb7428469e1744d3e7474b4d
SHA512 a2904c61f81c8f43a63a30d54aadce4a5ddc877f394b7e8b0c791158dc2e7fa18208db8b783a11981e76ddd1bf2ceff4ddde72fbdd306fc09a83a8c3c4100f7a

\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

MD5 fa401b9dfca460e40d158f6674234a3f
SHA1 6b2a11107e70b3ffa2ff6ee9ae8b004c0a726d06
SHA256 e877bdcde12a96e02952b76d13eac141bee541e6e2f12d1f833f76d76d5ee5ab
SHA512 6fb1720f06f705ac8bc67f4aa483b55b8ce7672cf58fe5da22108c28a52f18a2b05bd8e60eb08096fb80dfec595cf47a1315ce4805c064e4b32d3a291153ad32

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

MD5 fa401b9dfca460e40d158f6674234a3f
SHA1 6b2a11107e70b3ffa2ff6ee9ae8b004c0a726d06
SHA256 e877bdcde12a96e02952b76d13eac141bee541e6e2f12d1f833f76d76d5ee5ab
SHA512 6fb1720f06f705ac8bc67f4aa483b55b8ce7672cf58fe5da22108c28a52f18a2b05bd8e60eb08096fb80dfec595cf47a1315ce4805c064e4b32d3a291153ad32

\Users\Admin\AppData\Local\Temp\5074.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

\Users\Admin\AppData\Local\Temp\5074.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

\Users\Admin\AppData\Local\Temp\5074.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

\Users\Admin\AppData\Local\Temp\5074.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

MD5 5002a42decacdb21c42ccd9fb10d9a9f
SHA1 e17bdfc577e44c35c04ab9efa8fe7f8dc190d1ce
SHA256 b16e51a6bc19a24f6e477dcea5e07547672e5154b8bbdb80a722246d7a9e4988
SHA512 c021b324384c5f33e5c94a4953b6a18b04a4a2d895403d6d1259b4fd942a6f0851f23c463739d110ec8edd61a75aed3e8473bbe13414cccfe4aab20c965a26eb

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

MD5 5002a42decacdb21c42ccd9fb10d9a9f
SHA1 e17bdfc577e44c35c04ab9efa8fe7f8dc190d1ce
SHA256 b16e51a6bc19a24f6e477dcea5e07547672e5154b8bbdb80a722246d7a9e4988
SHA512 c021b324384c5f33e5c94a4953b6a18b04a4a2d895403d6d1259b4fd942a6f0851f23c463739d110ec8edd61a75aed3e8473bbe13414cccfe4aab20c965a26eb

C:\Users\Admin\AppData\Local\Temp\7076.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\7076.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

MD5 5002a42decacdb21c42ccd9fb10d9a9f
SHA1 e17bdfc577e44c35c04ab9efa8fe7f8dc190d1ce
SHA256 b16e51a6bc19a24f6e477dcea5e07547672e5154b8bbdb80a722246d7a9e4988
SHA512 c021b324384c5f33e5c94a4953b6a18b04a4a2d895403d6d1259b4fd942a6f0851f23c463739d110ec8edd61a75aed3e8473bbe13414cccfe4aab20c965a26eb

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

MD5 5002a42decacdb21c42ccd9fb10d9a9f
SHA1 e17bdfc577e44c35c04ab9efa8fe7f8dc190d1ce
SHA256 b16e51a6bc19a24f6e477dcea5e07547672e5154b8bbdb80a722246d7a9e4988
SHA512 c021b324384c5f33e5c94a4953b6a18b04a4a2d895403d6d1259b4fd942a6f0851f23c463739d110ec8edd61a75aed3e8473bbe13414cccfe4aab20c965a26eb

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\78FF.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/620-166-0x0000000000280000-0x00000000002DA000-memory.dmp

memory/620-165-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\78FF.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

C:\Users\Admin\AppData\Local\Temp\7C2B.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/1480-184-0x00000000003A0000-0x00000000004F8000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

memory/1480-186-0x00000000003A0000-0x00000000004F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\815A.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\815A.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/2216-188-0x0000000000900000-0x0000000000901000-memory.dmp

memory/2540-194-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2984-195-0x0000000000230000-0x000000000028A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2984-197-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\815A.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/2540-203-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2540-207-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1480-209-0x00000000003A0000-0x00000000004F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\91DF.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

memory/2540-217-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2540-218-0x0000000000400000-0x000000000043E000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

C:\Users\Admin\AppData\Local\Temp\91DF.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

memory/1504-222-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

memory/620-223-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/2676-224-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/1900-225-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/2540-226-0x00000000718C0000-0x0000000071FAE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6A5D.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\7076.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

memory/1504-238-0x0000000000ED0000-0x0000000000EDA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/1900-240-0x0000000001260000-0x000000000127E000-memory.dmp

memory/2676-241-0x0000000000A00000-0x0000000000A5A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabB7AD.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarB990.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 069040d89a8d300cb86b06a101aa8730
SHA1 156fb534b7db23cd1388d9f47e293dde1108d718
SHA256 ba7eef0c8a2b8d003be41974ea45b78a0397e0198a42f8c63ebc01869614965c
SHA512 5f69cd9711adf5aee31a628c70d1ad3973b321c67ba48d35170bf6fc126425b1f03b82371e2b7a388cd678dfba9221395f71ca3b2809a26fc0c7ba4da5e44bf8

memory/1900-306-0x0000000004730000-0x0000000004770000-memory.dmp

memory/2540-309-0x0000000007320000-0x0000000007360000-memory.dmp

memory/2676-310-0x0000000004A60000-0x0000000004AA0000-memory.dmp

memory/1504-311-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

memory/620-312-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/1900-313-0x00000000718C0000-0x0000000071FAE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b209922180652e5097a0697d50aee598
SHA1 83c7d2bf990eb3925cea9820d9e4a88d7c4dbbaa
SHA256 c553b08aeae2af11cbcfd2ab038e3de5dd200c322f84f3493632468abce105fa
SHA512 a9db1008fc01bba89cff56c5b44bf1a68710161d1b261003d44cf20a9823908fb44409ca93a27cbc83b62a85b0b62d31f8aae60d2f0655fa88795dc40261deae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 802528754082ea617ed8d994b8b499ae
SHA1 ab521075d3097e358fe151a0530870334e271817
SHA256 cdaee185993db16d2f99d01238a52f0be0e053673f3c36244deffe8e7aa36181
SHA512 ec4647e6e0a98888055c970f66a91b495969bbdd71298cef402a5d2b98084454a1f3f974fa3d47417a422898b1ef4db67726126a965d83f204f20eb53e6bb066

memory/2676-379-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/2540-380-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/1900-441-0x0000000004730000-0x0000000004770000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O3E62B0W\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lbgq45t\imagestore.dat

MD5 5498c7b68fd5c7e15fa1875250f79b8c
SHA1 17e9d8ce30a1d4480bfc5aa5df17963c95657e3b
SHA256 3abf82241e40aeaf4f4e30742472a6c3c3e937038b676ef56b7609a2d4f79e2f
SHA512 a89e633badef0f4ab810ab389889f31174238b570ecdee05aa1f2e881185db82d53af20604f4cd230dc378c464a6b8d23447baa1267771903a02d79e2900b902

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JXO65VIN\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

memory/620-564-0x0000000007110000-0x0000000007150000-memory.dmp

memory/2540-565-0x0000000007320000-0x0000000007360000-memory.dmp

memory/2676-576-0x0000000004A60000-0x0000000004AA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpA82.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpB05.tmp

MD5 9de8f5c2b2916ab8ca2989f2fe8b3fe2
SHA1 64e7ec07d4d201ad2a5067be2e43429240394339
SHA256 ace3173e6cbc20b7b89aba8db456417a654e26147b9f0a97e8289147782324b8
SHA512 ba3bacb0e8639c763015791dc19411ccc1f3eaca807815988cafd8d4ebe7ced1e02daab55583df505bd42275589509e98c967466015afff5e9792ac74cb432f4

memory/1504-690-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

memory/2676-715-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/620-717-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/2540-718-0x00000000718C0000-0x0000000071FAE000-memory.dmp

memory/1900-719-0x00000000718C0000-0x0000000071FAE000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89a633a75f8c435433d07f6be417e47d
SHA1 18db5f8ba3794903c3d64d33fbb486987789e410
SHA256 7da5b6f8d07c865582aef0ccd268e688f5d66c8f39746869abb0e04dab4bb9c7
SHA512 093b98dbfce75f87ff9ff2b4cea839c45c727f22a2985c838b158d172cb4811a17062975a5171233c575c965920d0b70b8a44fe0bace1bb8da8f95fbd0d7ff36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 bc46be23be0d8e1aa55d2f9998a8f7af
SHA1 e3e7461b9e0123a5447ac353c80a5f7b9c45e1ea
SHA256 2af478d5f03b9ea0afbffb971365fa97a1a00e62f5c645f47b06851bdb2da344
SHA512 b13caf7b76db4b462fa6eeff3e69a71dc97936276d0654d78e595666249b8819cada35ec1cd935950b0014acd786ad3be65beb9aa48feb1d7f50ab8b5abf3753

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ad882c7a5a7da67dad6873e8b728d6b3
SHA1 a5003501314388310b052792cfb1395c6e0f4757
SHA256 6faf2eb7a275eadda310890d2cc696ef86d42bae36ce59ded8ff1a75d58e24c0
SHA512 19cd398989514d436ce3f4078374ffe8e116f5c4cd0df3465e450e36785460607604cd277a9b2c965d0dc09aa094ca83cb2f6a33c1ef3b50fe68a75dee642efa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4196e0436bfc84b0390fc250cd645ff6
SHA1 88e361aa71ad6d04eee8b34784da353cbfeb11a1
SHA256 147988560fe8066a1cad7f20e7aa6b08af1280748241bc11645600bbfcc4a058
SHA512 c1c29683d5149cabc88abc8628cd0dfcac2740c57c5fd34323367d687a1ed4c2b3f61833b351de4b32cd207f24c7c06c7fc97d478405e58fba0cd09fc0c30896

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb3da8a5b974b0f6a81e1b036b0e0166
SHA1 4760aba0b1ced7dee6fa1e1ff4bc991013013b14
SHA256 51eb2a0d98abc1638cdb593ee780374db4ec163ec6a11724db3c4a443cc21de8
SHA512 7d45f9f186b006d57d69de220b1f839159a39fb5ca73abb5dd8abf1b30c0083efeb5aba998e0318b213d29e89f1ea67bc994e9b0941c3bc8189879f515c1feac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e751502e05409373db2707a28feca10
SHA1 3d10d50279999e86e2b21ef256caab6c8a62ef7d
SHA256 4f5f566a345f11e527e1062a913c4f0d77b0de4f1f7f407424bce428fd79487c
SHA512 10c03e0148b9e94e263d5144dd488921e8963cb5edacb70102a7935ff9f4103af9cb783083a615ea34fde436e5bc34a3b2400aa270b3c095019f94ae83fe6115

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75f9d5fcd6cd00763a77a1b6211290a1
SHA1 9a2750439c3434fa2c09cf56c1125ec119f0087f
SHA256 eacae5dc743d3f1594da85dd5639217a992a7b5018ea4fb91618729f62a01924
SHA512 fdeaf02b867991b0039af7cf8bf5d4c07a706714c6ee25a08f39a99c4a4d19c5fe4c9abe7856bd967bc283aa5a3835001e57e92828904194531704c1f6093ca8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 5c9639253bb6dc596b5a5ed8625705f0
SHA1 e361b9b5b0c87b98c981bee13b3f39cd3551d27e
SHA256 bacd7d9757a44ce0df285b793d18421476befbc4aec786d3cd7a9d50052c38f3
SHA512 a2148d483a3548af43fdeaf7d8dd5f917bfcb8e3c6a038b42608c1333db935de3bbc741c9a253157abab413dd53306b39b0f18e77f9243dafd97b664a4447639

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 283b7b55caa8e06dd82dd4a102ed5989
SHA1 ccc1f97a0df40828a38a20b34af135d8b17fa999
SHA256 81a5b0e6431d986ea15a9ff44278330cdc89b3398a36496adc57970500b76b3b
SHA512 91779fbfa087e8f1fd05f101847faddcf068a9796a768f208c0d8d3e9780c559fd256163f60a62bce3e01136091f2cebeaed13a8d018622bb1b2c746630db339

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a09ef8d00a18bc4ee5faf2965b5aad00
SHA1 e03c419abf47adc530c4ddb23fba0fb7b07ce504
SHA256 878e5b91ba968eb7524f5f10ddd2e6c8c30e63e811f87b2e853693099f1a3327
SHA512 f1bd5f6633f5a1d7514a690e7624444be7524d6b013ba7f09220d00b14483085c698ef90f7f6c12d774aedb331053562bff3080c29fcfb645899f9a67cb039f9

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-11 20:17

Reported

2023-10-12 14:49

Platform

win10v2004-20230915-en

Max time kernel

151s

Max time network

165s

Command Line

"C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe"

Signatures

Amadey

trojan amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1A8E.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\18D7.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\EFEE.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe N/A

Checks installed software on the system

discovery

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16B4.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1A8E.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2084 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2084 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2084 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2084 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2084 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2084 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3268 wrote to memory of 3128 N/A N/A C:\Users\Admin\AppData\Local\Temp\EFEE.exe
PID 3268 wrote to memory of 3128 N/A N/A C:\Users\Admin\AppData\Local\Temp\EFEE.exe
PID 3268 wrote to memory of 3128 N/A N/A C:\Users\Admin\AppData\Local\Temp\EFEE.exe
PID 3128 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\EFEE.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 3128 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\EFEE.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 3128 wrote to memory of 1292 N/A C:\Users\Admin\AppData\Local\Temp\EFEE.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe
PID 1292 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe
PID 1292 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe
PID 1292 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe
PID 4872 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe
PID 4872 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe
PID 4872 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe
PID 1160 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe
PID 1160 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe
PID 1160 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe
PID 1276 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe
PID 1276 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe
PID 1276 wrote to memory of 3080 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe
PID 3268 wrote to memory of 4716 N/A N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe
PID 3268 wrote to memory of 4716 N/A N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe
PID 3268 wrote to memory of 4716 N/A N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe
PID 3268 wrote to memory of 4644 N/A N/A C:\Windows\system32\cmd.exe
PID 3268 wrote to memory of 4644 N/A N/A C:\Windows\system32\cmd.exe
PID 3268 wrote to memory of 380 N/A N/A C:\Users\Admin\AppData\Local\Temp\15F7.exe
PID 3268 wrote to memory of 380 N/A N/A C:\Users\Admin\AppData\Local\Temp\15F7.exe
PID 3268 wrote to memory of 380 N/A N/A C:\Users\Admin\AppData\Local\Temp\15F7.exe
PID 3268 wrote to memory of 3864 N/A N/A C:\Users\Admin\AppData\Local\Temp\16B4.exe
PID 3268 wrote to memory of 3864 N/A N/A C:\Users\Admin\AppData\Local\Temp\16B4.exe
PID 3268 wrote to memory of 3140 N/A N/A C:\Users\Admin\AppData\Local\Temp\18D7.exe
PID 3268 wrote to memory of 3140 N/A N/A C:\Users\Admin\AppData\Local\Temp\18D7.exe
PID 3268 wrote to memory of 3140 N/A N/A C:\Users\Admin\AppData\Local\Temp\18D7.exe
PID 3268 wrote to memory of 4568 N/A N/A C:\Users\Admin\AppData\Local\Temp\1A8E.exe
PID 3268 wrote to memory of 4568 N/A N/A C:\Users\Admin\AppData\Local\Temp\1A8E.exe
PID 3268 wrote to memory of 4568 N/A N/A C:\Users\Admin\AppData\Local\Temp\1A8E.exe
PID 4716 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3140 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\18D7.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 3140 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\18D7.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 3140 wrote to memory of 2004 N/A C:\Users\Admin\AppData\Local\Temp\18D7.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 3080 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3080 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3080 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4716 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\F9B3.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3080 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3080 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe

"C:\Users\Admin\AppData\Local\Temp\51bea9241d27464131e42b0454fc78ccb93fe70af53a23e5c3cc08b387f4d72f.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2084 -ip 2084

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 252

C:\Users\Admin\AppData\Local\Temp\EFEE.exe

C:\Users\Admin\AppData\Local\Temp\EFEE.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

C:\Users\Admin\AppData\Local\Temp\F9B3.exe

C:\Users\Admin\AppData\Local\Temp\F9B3.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C42.bat" "

C:\Users\Admin\AppData\Local\Temp\15F7.exe

C:\Users\Admin\AppData\Local\Temp\15F7.exe

C:\Users\Admin\AppData\Local\Temp\16B4.exe

C:\Users\Admin\AppData\Local\Temp\16B4.exe

C:\Users\Admin\AppData\Local\Temp\18D7.exe

C:\Users\Admin\AppData\Local\Temp\18D7.exe

C:\Users\Admin\AppData\Local\Temp\1A8E.exe

C:\Users\Admin\AppData\Local\Temp\1A8E.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\1EE4.exe

C:\Users\Admin\AppData\Local\Temp\1EE4.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4716 -ip 4716

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3080 -ip 3080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1728 -ip 1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\2156.exe

C:\Users\Admin\AppData\Local\Temp\2156.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 252

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 572

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 380 -ip 380

C:\Users\Admin\AppData\Local\Temp\328E.exe

C:\Users\Admin\AppData\Local\Temp\328E.exe

C:\Users\Admin\AppData\Local\Temp\3965.exe

C:\Users\Admin\AppData\Local\Temp\3965.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Users\Admin\AppData\Local\Temp\44C0.exe

C:\Users\Admin\AppData\Local\Temp\44C0.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 252

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd21dd46f8,0x7ffd21dd4708,0x7ffd21dd4718

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd21dd46f8,0x7ffd21dd4708,0x7ffd21dd4718

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2GC271vg.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2GC271vg.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,11223071594346587193,16803894992102573635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,11223071594346587193,16803894992102573635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1780 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1EE4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd21dd46f8,0x7ffd21dd4708,0x7ffd21dd4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1EE4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd21dd46f8,0x7ffd21dd4708,0x7ffd21dd4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6776 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6776 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,10302009499178802382,15654707345342213483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 126.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
US 8.8.8.8:53 113.208.253.8.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
US 8.8.8.8:53 35.201.240.157.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
GB 157.240.221.35:443 facebook.com tcp
US 8.8.8.8:53 8.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
IT 185.196.9.65:80 tcp
BG 171.22.28.202:16706 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
TR 185.216.70.238:37515 tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 65.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 202.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 238.70.216.185.in-addr.arpa udp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 98.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 mscom.demdex.net udp
US 8.8.8.8:53 target.microsoft.com udp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
IE 63.33.121.220:443 mscom.demdex.net tcp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 220.121.33.63.in-addr.arpa udp
US 13.107.246.67:443 js.monitor.azure.com tcp
IE 63.33.121.220:443 mscom.demdex.net tcp
US 104.26.12.31:443 api.ip.sb tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 3.17.178.52.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp

Files

memory/1728-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1728-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3268-2-0x00000000026F0000-0x0000000002706000-memory.dmp

memory/1728-4-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EFEE.exe

MD5 8d8bb56f32eb8c429dc5508745235c55
SHA1 359f631d7c056a3262a1b756c5c72f261eed97ad
SHA256 f849ea0a82ed039f8c726ab554550d3ac56ff807faa122fc7f64621a4c83c09d
SHA512 5a5b0f3ea34b8a8e9edbcf2899299c84ce0d0f8dc0b0883e507236a85643fdb13873dfefd91ff6e693ce5a3d3b1ab0ba23326ef38447a9b4921f398253d21cbe

C:\Users\Admin\AppData\Local\Temp\EFEE.exe

MD5 8d8bb56f32eb8c429dc5508745235c55
SHA1 359f631d7c056a3262a1b756c5c72f261eed97ad
SHA256 f849ea0a82ed039f8c726ab554550d3ac56ff807faa122fc7f64621a4c83c09d
SHA512 5a5b0f3ea34b8a8e9edbcf2899299c84ce0d0f8dc0b0883e507236a85643fdb13873dfefd91ff6e693ce5a3d3b1ab0ba23326ef38447a9b4921f398253d21cbe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

MD5 e9ebaab9a3606a72b7bc15db6ede99d0
SHA1 aa452c5eb3a6e3b5e4f92852de56cf65a1d9ccc7
SHA256 28c121e7fe0c5dbcba40c2848ebaf4610265978122884c451362d519fbb11f25
SHA512 2720c84b23963a862f6c40b91b8f75855ba2b54f1558b2f8baf37814a291f6fda79bab5196a6be2694b4d4449fcf313d229529dffe4a843d68fbf476b4f70afd

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lC2vI0uI.exe

MD5 e9ebaab9a3606a72b7bc15db6ede99d0
SHA1 aa452c5eb3a6e3b5e4f92852de56cf65a1d9ccc7
SHA256 28c121e7fe0c5dbcba40c2848ebaf4610265978122884c451362d519fbb11f25
SHA512 2720c84b23963a862f6c40b91b8f75855ba2b54f1558b2f8baf37814a291f6fda79bab5196a6be2694b4d4449fcf313d229529dffe4a843d68fbf476b4f70afd

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

MD5 965fd26a4bd59232f88748e2db1d49e2
SHA1 b21ab06321fd86baf207f7867be195a1855f619e
SHA256 4b13637e1d389d2095dfe1a7ef6f13c4a5a27599e1f05b2a31f7da3332d67690
SHA512 746dc3f57a489e823135c43acef45e55c8a20684d7036102f71de9d377f0c24365576a508ce0ae8ae35c5f25b1c7f4dff5cce262e8f4868426aa4af040e64f7f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FO1zF6nE.exe

MD5 965fd26a4bd59232f88748e2db1d49e2
SHA1 b21ab06321fd86baf207f7867be195a1855f619e
SHA256 4b13637e1d389d2095dfe1a7ef6f13c4a5a27599e1f05b2a31f7da3332d67690
SHA512 746dc3f57a489e823135c43acef45e55c8a20684d7036102f71de9d377f0c24365576a508ce0ae8ae35c5f25b1c7f4dff5cce262e8f4868426aa4af040e64f7f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

MD5 fa401b9dfca460e40d158f6674234a3f
SHA1 6b2a11107e70b3ffa2ff6ee9ae8b004c0a726d06
SHA256 e877bdcde12a96e02952b76d13eac141bee541e6e2f12d1f833f76d76d5ee5ab
SHA512 6fb1720f06f705ac8bc67f4aa483b55b8ce7672cf58fe5da22108c28a52f18a2b05bd8e60eb08096fb80dfec595cf47a1315ce4805c064e4b32d3a291153ad32

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Jd7hw0FL.exe

MD5 fa401b9dfca460e40d158f6674234a3f
SHA1 6b2a11107e70b3ffa2ff6ee9ae8b004c0a726d06
SHA256 e877bdcde12a96e02952b76d13eac141bee541e6e2f12d1f833f76d76d5ee5ab
SHA512 6fb1720f06f705ac8bc67f4aa483b55b8ce7672cf58fe5da22108c28a52f18a2b05bd8e60eb08096fb80dfec595cf47a1315ce4805c064e4b32d3a291153ad32

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

MD5 5002a42decacdb21c42ccd9fb10d9a9f
SHA1 e17bdfc577e44c35c04ab9efa8fe7f8dc190d1ce
SHA256 b16e51a6bc19a24f6e477dcea5e07547672e5154b8bbdb80a722246d7a9e4988
SHA512 c021b324384c5f33e5c94a4953b6a18b04a4a2d895403d6d1259b4fd942a6f0851f23c463739d110ec8edd61a75aed3e8473bbe13414cccfe4aab20c965a26eb

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pe9jZ9lK.exe

MD5 5002a42decacdb21c42ccd9fb10d9a9f
SHA1 e17bdfc577e44c35c04ab9efa8fe7f8dc190d1ce
SHA256 b16e51a6bc19a24f6e477dcea5e07547672e5154b8bbdb80a722246d7a9e4988
SHA512 c021b324384c5f33e5c94a4953b6a18b04a4a2d895403d6d1259b4fd942a6f0851f23c463739d110ec8edd61a75aed3e8473bbe13414cccfe4aab20c965a26eb

C:\Users\Admin\AppData\Local\Temp\F9B3.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1hz04XB0.exe

MD5 19477110aa849bd70f20614b555876eb
SHA1 e8c97d0945742ac3b123e4d41d11370473819798
SHA256 b01b105c170f1a886ab90dd1d96ccabdff92ab4635e470d95c488d5f0194836f
SHA512 44138fa8f621f436337b3a1c8cee7a447239ea057ea92d7ae98dd75b549b9507721da32a5846d42528e8538128f56fbe64cb9e7b23efd9971e551197edcadd34

C:\Users\Admin\AppData\Local\Temp\F9B3.exe

MD5 d0f02f3f6b2bd42f675db325295172a9
SHA1 219389381210781cea233d17dc764f94c88802a4
SHA256 10aab7a19d1567a650d6b3149aaf149f8b94cbad65d01209353ae3c61a21919e
SHA512 d480067dafe98f490b200fa95b9e182b735cda6058d0b67e736eb446d2188119645b366421242d0a530d55664eaea1a49529202971c98dab8e37027bfcf199ec

C:\Users\Admin\AppData\Local\Temp\C42.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\15F7.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

memory/3864-64-0x0000000000C90000-0x0000000000C9A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\16B4.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\16B4.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/3864-65-0x00007FFD11A00000-0x00007FFD124C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\15F7.exe

MD5 60ad52a697b3e7c161d312ee4c41867b
SHA1 b86558a3e107dedad416d12e6b52a5324d65a735
SHA256 15924fe2ecca0759730bf05c34d17d7e31421b1a454925434fa30c99fcebeaf1
SHA512 7af7e9d4b72cfc1f7b0eb8d01516d25bec5916d414e32599daf47cdb261e887bbf6cf3a4cb460fe06706971c537965bc351aaacf9882e3dfdd122ba616ad6835

C:\Users\Admin\AppData\Local\Temp\18D7.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\18D7.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\1A8E.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\1A8E.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2840-82-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1728-87-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2840-86-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2840-90-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1EE4.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

memory/1728-89-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2840-94-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1728-95-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1EE4.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\2156.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/4560-100-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2012-102-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\328E.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/1500-105-0x00000000003C0000-0x0000000000518000-memory.dmp

memory/3864-107-0x00007FFD11A00000-0x00007FFD124C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3965.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/4560-112-0x0000000001F70000-0x0000000001FCA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\328E.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

C:\Users\Admin\AppData\Local\Temp\2156.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Temp\3965.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\44C0.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\44C0.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/3088-131-0x00000000005C0000-0x000000000061A000-memory.dmp

memory/3088-135-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1500-136-0x00000000003C0000-0x0000000000518000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

memory/1776-146-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3864-145-0x00007FFD11A00000-0x00007FFD124C1000-memory.dmp

memory/2788-147-0x0000000000420000-0x000000000043E000-memory.dmp

memory/3088-149-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/652-151-0x00000000008D0000-0x000000000092A000-memory.dmp

memory/652-153-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/2788-155-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/1500-156-0x00000000003C0000-0x0000000000518000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2GC271vg.exe

MD5 5f11b5411a364c7049ea8df25a6a34cf
SHA1 64bd9f5938f53407f6d529810a739e8a0945cc66
SHA256 8036d126b40643884ae4147359c0f62bac0ee481fbd01956042ca10a99db8122
SHA512 e7163d9ffee21b24a1f862be8eda9cc4c07ca44ea18de2a1769325ec82448e6046466b3cf0c034efec2c6a693edd85fa2132e675a95858e0648119b837a9b3c7

memory/2012-162-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/1776-163-0x00000000725E0000-0x0000000072D90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2GC271vg.exe

MD5 5f11b5411a364c7049ea8df25a6a34cf
SHA1 64bd9f5938f53407f6d529810a739e8a0945cc66
SHA256 8036d126b40643884ae4147359c0f62bac0ee481fbd01956042ca10a99db8122
SHA512 e7163d9ffee21b24a1f862be8eda9cc4c07ca44ea18de2a1769325ec82448e6046466b3cf0c034efec2c6a693edd85fa2132e675a95858e0648119b837a9b3c7

memory/2840-158-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2204-170-0x00000000725E0000-0x0000000072D90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

\??\pipe\LOCAL\crashpad_3312_IQMTMEYGYGJLOGMF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2204-169-0x0000000000470000-0x00000000004AE000-memory.dmp

memory/3088-183-0x0000000006EE0000-0x0000000007484000-memory.dmp

memory/2788-185-0x0000000005440000-0x0000000005A58000-memory.dmp

memory/2204-184-0x0000000007240000-0x00000000072D2000-memory.dmp

memory/2788-186-0x00000000013A0000-0x00000000013B2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fe38d03072591988292cedf35d5fcd15
SHA1 03a5fb121a2a21727406722b96876e4856858a88
SHA256 be76189b8bc708fc945c564dbacec7b96104731a77c48bfb51693230589344c4
SHA512 dde1d566a12128e58adc7374581e5fd37a3ff5a5a0bcc4b70b6d9d02ed36389079c4ecf7e58bd3a6aa3cd0546a70c489412527554c2f6b6db05c1756d00238ad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

\??\pipe\LOCAL\crashpad_3612_WNGNDOVYULHFCZGN

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2788-212-0x0000000004E60000-0x0000000004E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4614dd25c6c867d2255e3ef27c627bd0
SHA1 900a4b33610b718f8533d32e8cf337f74b9da443
SHA256 ad9cbf288ac5bc8a4d5536248e80592912196045fc5528187d22fa9c12cc694f
SHA512 9e668a1e0e1fa6be70fc5ae1e15be632b7d3282638b5d2e4f21ee5c703510e3f03d8b795ca7125fad9d2620050152fd07d6ead35e8650a6c7d65b46ece26a33e

memory/652-214-0x0000000007770000-0x0000000007780000-memory.dmp

memory/2012-215-0x0000000005520000-0x0000000005530000-memory.dmp

memory/2204-216-0x00000000073F0000-0x00000000073FA000-memory.dmp

memory/1776-218-0x0000000007B10000-0x0000000007B20000-memory.dmp

memory/2788-219-0x0000000001320000-0x0000000001330000-memory.dmp

memory/2788-217-0x0000000004EA0000-0x0000000004EEC000-memory.dmp

memory/2204-213-0x00000000073D0000-0x00000000073E0000-memory.dmp

memory/3088-223-0x00000000077C0000-0x00000000078CA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

memory/652-286-0x00000000083A0000-0x0000000008406000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1222f8c867acd00b1fc43a44dacce158
SHA1 586ba251caf62b5012a03db9ba3a70890fc5af01
SHA256 1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a
SHA512 ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

memory/3088-300-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/652-319-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/652-320-0x0000000009940000-0x00000000099B6000-memory.dmp

memory/2788-324-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/652-325-0x0000000009920000-0x000000000993E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1cb87a7b5f02b994b33e60db3f29932c
SHA1 501ab5e4e4b314dd2ac5557f319439b3d24450f7
SHA256 38189d82f206abe249c8e4817f9aafe8aaf13c22d104b00d692721044e47e86d
SHA512 32ad37f3859b0fc585dbe23268fa12f63a971b4d2154759c9a50b9cea765e5956e6e6756879c70093f988c2f2de0b8153bde7680cf51d451ec633747c0b54f43

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4614dd25c6c867d2255e3ef27c627bd0
SHA1 900a4b33610b718f8533d32e8cf337f74b9da443
SHA256 ad9cbf288ac5bc8a4d5536248e80592912196045fc5528187d22fa9c12cc694f
SHA512 9e668a1e0e1fa6be70fc5ae1e15be632b7d3282638b5d2e4f21ee5c703510e3f03d8b795ca7125fad9d2620050152fd07d6ead35e8650a6c7d65b46ece26a33e

memory/652-333-0x0000000009A70000-0x0000000009AC0000-memory.dmp

memory/2012-338-0x00000000725E0000-0x0000000072D90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/1776-340-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/652-341-0x0000000009FB0000-0x000000000A172000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/652-347-0x000000000A6B0000-0x000000000ABDC000-memory.dmp

memory/2204-369-0x00000000725E0000-0x0000000072D90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f3e0dacca3fc3800df09264b966cab71
SHA1 2e025c26f46c181ce5b35873c89f5d0e738f61ba
SHA256 96900c7e22c26f893481937021e921ff55ebd0024b47305b65bf3a5ae929f4b6
SHA512 69c107bd8b0a62a2fba14179912568d512edee5700b2de726d88b4e4cc72bdb54e3359b6dfbbf8a8d451314251248b0d228f9949796f641c35728b41ebc5c3fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1cb87a7b5f02b994b33e60db3f29932c
SHA1 501ab5e4e4b314dd2ac5557f319439b3d24450f7
SHA256 38189d82f206abe249c8e4817f9aafe8aaf13c22d104b00d692721044e47e86d
SHA512 32ad37f3859b0fc585dbe23268fa12f63a971b4d2154759c9a50b9cea765e5956e6e6756879c70093f988c2f2de0b8153bde7680cf51d451ec633747c0b54f43

C:\Users\Admin\AppData\Local\Temp\tmp8691.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp86B6.tmp

MD5 02f8652ecec423d1ebd72ff3863579fe
SHA1 d9772bd7f3978dc302b44216d2e3a2d62e0b0544
SHA256 37c53e07bac027475dbc6122b2e105a431effa21c8e554f5c44e8652c8fa84b9
SHA512 c319907b9f0e8606e783a7f782c0d4241c3aedf5b783961c77f72feee94709c080569979ac5c005bc35aba65e9a4f1e37d658f4baac44b114b4c5234900c47a9

C:\Users\Admin\AppData\Local\Temp\tmp86E2.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp86F7.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmp871D.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp8748.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/2204-537-0x00000000073D0000-0x00000000073E0000-memory.dmp

memory/652-538-0x0000000007770000-0x0000000007780000-memory.dmp

memory/3088-547-0x00000000725E0000-0x0000000072D90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 15ad31a14e9a92d2937174141e80c28d
SHA1 b09e8d44c07123754008ba2f9ff4b8d4e332d4e5
SHA256 bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde
SHA512 ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

memory/2012-557-0x0000000005520000-0x0000000005530000-memory.dmp

memory/1776-558-0x0000000007B10000-0x0000000007B20000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/2788-562-0x0000000001320000-0x0000000001330000-memory.dmp

memory/652-589-0x00000000725E0000-0x0000000072D90000-memory.dmp

memory/2788-588-0x00000000725E0000-0x0000000072D90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/1776-610-0x00000000725E0000-0x0000000072D90000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b959fe63efaad52fff363f6cfc8ac32a
SHA1 1816a73aafc6055a087eff0fb4d89a2702c9d04a
SHA256 6603ed033bfedf88b50944463d5b9014f96606e8f922b1279d299c7d2b4a3daf
SHA512 114c6a2371e7b2cd5293fd4b7cb47e994522ec541df5194013c327be70aa3a9a847d7dad48cc80b16c10bf73636238fedc6561b36afdfde7dfa136907a98bcc6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bb9a.TMP

MD5 61dcaf4ba811c32846b1c663754218ac
SHA1 e9e0d7d2daca0d209797f36d6c8970afd39c1ba2
SHA256 9b4fe039fd937446137e0b0678498a59ba2d8410d5eee9465076d389342acd87
SHA512 b9cb350b4348e39bc9eb94ef36d3ff18d4605ed6da04c03a0f930e9b2156659640f4ecfafe42937a5a2d2d73e07ab40655dd7c0ea06a8d65c2ab8bd2de3579db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 a48cffce3c7fafe3fd833eb1b2e864e2
SHA1 26e868b7cc39e2742765ff174b6e5168aadeefa2
SHA256 470e384a83999efc4d347908d7979bdacbb89d214a249e5ec47a537a64ea0a9e
SHA512 20465545c551743c8189ff123a1d554e8975267cccd90e236493c1e404c8b26e291d48a5233b21bb41405fcc94656b40351781b93a5fa8ae79b499952ccd6065

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 58a789f25888e340601e7b0fdc305ec0
SHA1 9283b78abf64db7405ccc23a1b0953f56ed2e6ee
SHA256 69eed7d01083e66a6c56c8509d1ffdea3e3f363690c703e381b52ec8ae48bf59
SHA512 3d28fb52d3a070b833147507994dd548001be0aeb2d05f6947f94512d02c5609fa20ab9197df1d7fd59474a4f4a64aef46ac90f65af8eca2207efbc752c426d9