Malware Analysis Report

2025-08-10 23:43

Sample ID 231011-y41akabc6s
Target 5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46
SHA256 3d4427f3bd042bdb3865078ac08551d12497ef5df64fb69090ab929b582d1abe
Tags
amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan breha kukish microsoft
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3d4427f3bd042bdb3865078ac08551d12497ef5df64fb69090ab929b582d1abe

Threat Level: Known bad

The file 5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46 was found to be: Known bad.

Malicious Activity Summary

amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan breha kukish microsoft

SectopRAT

Amadey

SectopRAT payload

Detected google phishing page

Healer

Modifies Windows Defender Real-time Protection settings

RedLine

DcRat

RedLine payload

SmokeLoader

Detects Healer an antivirus disabler dropper

Downloads MZ/PE file

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Uses the VBS compiler for execution

Executes dropped EXE

Windows security modification

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Detected potential entity reuse from brand microsoft.

Enumerates physical storage devices

Program crash

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies system certificate store

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Suspicious use of UnmapMainImage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-11 20:21

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-11 20:21

Reported

2023-10-12 15:01

Platform

win7-20230831-en

Max time kernel

151s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat

Detected google phishing page

phishing google

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5AA3.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5DA1.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\35EF.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403284652" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F73B4291-690F-11EE-8DCD-5AE3C8A3AD14} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d15ee81cfdd901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000002395648820c339bab7c5d6c0297bf7335baa1e5ed708deaf5d659599fafbda2e000000000e8000000002000020000000c691b80d633282df7029e9368a747037c26adbc4a858b8adc3040f383e7c40dd20000000751fb73ec840f470fc9f3b07083562dfd61ab7af52132bcf98d76651929eca93400000005accde0ee67464ba709222282af91ab4f1420e8c2ced5baa2937e6bbbf0abba301ca2ca1f81685e7485b9d28b6a2a0602784a6a26bb3382df856f155c239d20f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002bccc567d90a0b479b49b1b2d43318c3000000000200000000001066000000010000200000003dedb46d954f39c2080b054ecea97f79c5ce69a01fa4422a42f66660d061c723000000000e8000000002000020000000866998b45043b75d70bdc7324bd2ae14f19e2aeea024d06b804c0be8bfea9fe790000000f05b738f08207d014106060ab23a43f0f1265c6147e42f004f8e8e35473a8f1eb3416356aa96367d9a5196b63315b16ec6b5d634c124073189e90d93bd11638a8b74db959f5fc3e354c052ccd0ae765ab0189a46665842c25e2a73cdf59fbf6b5c97837a894f65d1ae499f344b614fa6c208c91634e860c9d6aa47519abff1d1375a46bab8c917663e5ee6b0d414d71540000000878254f9e7e6a7ac4ae0bd54156a533c93d5354a4435fe9123b77221a225c8b1e30bbbfcd94991dccc72d7e5d8c9062687c8fd3857d1770d94cce60911d53605 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F87316B1-690F-11EE-8DCD-5AE3C8A3AD14} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\A701.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\A701.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\53BF.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\A701.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\E230.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CF89.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\62C0.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5DA1.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2160 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2912 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\SysWOW64\WerFault.exe
PID 2912 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\SysWOW64\WerFault.exe
PID 2912 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\SysWOW64\WerFault.exe
PID 2912 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\SysWOW64\WerFault.exe
PID 1252 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe
PID 1252 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe
PID 1252 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe
PID 1252 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe
PID 1252 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe
PID 1252 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe
PID 1252 wrote to memory of 2624 N/A N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe
PID 1252 wrote to memory of 2660 N/A N/A C:\Users\Admin\AppData\Local\Temp\3B9B.exe
PID 1252 wrote to memory of 2660 N/A N/A C:\Users\Admin\AppData\Local\Temp\3B9B.exe
PID 1252 wrote to memory of 2660 N/A N/A C:\Users\Admin\AppData\Local\Temp\3B9B.exe
PID 1252 wrote to memory of 2660 N/A N/A C:\Users\Admin\AppData\Local\Temp\3B9B.exe
PID 2624 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 2624 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 2624 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 2624 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 2624 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 2624 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 2624 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\35EF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 2688 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 2688 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 2688 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 2688 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 2688 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 2688 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 2688 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 2716 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 2716 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 2716 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 2716 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 2716 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 2716 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 2716 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 2620 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 2620 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 2620 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 2620 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 2620 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 2620 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 2620 wrote to memory of 848 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 1252 wrote to memory of 2828 N/A N/A C:\Windows\system32\cmd.exe
PID 1252 wrote to memory of 2828 N/A N/A C:\Windows\system32\cmd.exe
PID 1252 wrote to memory of 2828 N/A N/A C:\Windows\system32\cmd.exe
PID 848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 848 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 1252 wrote to memory of 436 N/A N/A C:\Users\Admin\AppData\Local\Temp\455D.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe

"C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 52

C:\Users\Admin\AppData\Local\Temp\35EF.exe

C:\Users\Admin\AppData\Local\Temp\35EF.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

C:\Users\Admin\AppData\Local\Temp\3B9B.exe

C:\Users\Admin\AppData\Local\Temp\3B9B.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\3FB1.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\455D.exe

C:\Users\Admin\AppData\Local\Temp\455D.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 48

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Users\Admin\AppData\Local\Temp\53BF.exe

C:\Users\Admin\AppData\Local\Temp\53BF.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 36

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\5AA3.exe

C:\Users\Admin\AppData\Local\Temp\5AA3.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\5DA1.exe

C:\Users\Admin\AppData\Local\Temp\5DA1.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 48

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\62C0.exe

C:\Users\Admin\AppData\Local\Temp\62C0.exe

C:\Users\Admin\AppData\Local\Temp\A701.exe

C:\Users\Admin\AppData\Local\Temp\A701.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\system32\taskeng.exe

taskeng.exe {A4A03FDD-542A-4DFB-AAFC-D373822153DE} S-1-5-21-607259312-1573743425-2763420908-1000:NGTQGRML\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\B2D4.exe

C:\Users\Admin\AppData\Local\Temp\B2D4.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\CF89.exe

C:\Users\Admin\AppData\Local\Temp\CF89.exe

C:\Users\Admin\AppData\Local\Temp\E230.exe

C:\Users\Admin\AppData\Local\Temp\E230.exe

C:\Users\Admin\AppData\Roaming\ttgiwwf

C:\Users\Admin\AppData\Roaming\ttgiwwf

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\E8A6.exe

C:\Users\Admin\AppData\Local\Temp\E8A6.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Network

Country Destination Domain Proto
FI 77.91.68.29:80 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 www.facebook.com udp
RU 5.42.65.80:80 5.42.65.80 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
BG 171.22.28.213:80 171.22.28.213 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 www.facebook.com udp
FI 77.91.124.1:80 77.91.124.1 tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
GB 157.240.221.35:443 facebook.com tcp
GB 157.240.221.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
GB 157.240.221.35:443 fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
MD 176.123.9.142:37637 tcp
BG 171.22.28.202:16706 tcp
IT 185.196.9.65:80 tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 accounts.youtube.com udp
NL 142.250.179.206:443 accounts.youtube.com tcp
NL 142.250.179.206:443 accounts.youtube.com tcp
TR 185.216.70.238:37515 tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 play.google.com udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 fbsbx.com udp
GB 157.240.221.35:443 fbsbx.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.201.15:443 static.xx.fbcdn.net tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp

Files

memory/2160-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2160-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2160-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2160-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2160-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2160-6-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1252-5-0x0000000003980000-0x0000000003996000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\35EF.exe

MD5 c36b3237039a0094f563964364f50e24
SHA1 61d903e1f4667e9e2565e5c50c6dbe9976f45282
SHA256 0954e90783c2c369a6b2df16e19bda360669d72c77e4c8295df973067758844a
SHA512 9e087b9d01cccf4650859881f6ea95e7e82750d75cf48d86f7de7654f88c2eb8af4e1d10cd1d36bc75acf1f8c365900b8a7632e3c3f7ce78327eec95caa6c1c2

C:\Users\Admin\AppData\Local\Temp\35EF.exe

MD5 c36b3237039a0094f563964364f50e24
SHA1 61d903e1f4667e9e2565e5c50c6dbe9976f45282
SHA256 0954e90783c2c369a6b2df16e19bda360669d72c77e4c8295df973067758844a
SHA512 9e087b9d01cccf4650859881f6ea95e7e82750d75cf48d86f7de7654f88c2eb8af4e1d10cd1d36bc75acf1f8c365900b8a7632e3c3f7ce78327eec95caa6c1c2

\Users\Admin\AppData\Local\Temp\35EF.exe

MD5 c36b3237039a0094f563964364f50e24
SHA1 61d903e1f4667e9e2565e5c50c6dbe9976f45282
SHA256 0954e90783c2c369a6b2df16e19bda360669d72c77e4c8295df973067758844a
SHA512 9e087b9d01cccf4650859881f6ea95e7e82750d75cf48d86f7de7654f88c2eb8af4e1d10cd1d36bc75acf1f8c365900b8a7632e3c3f7ce78327eec95caa6c1c2

\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

MD5 264645e6949faa6016f9b985467c88ea
SHA1 efc3e10e30f07b0bd97049d7dd8c87a3de9e4c0e
SHA256 aabc3d235483d7ecd8317c0c897385cefe42bbd41aafcd614a58f48ec57b6517
SHA512 88e3abf2fbe57d6628c55b469b6f0653b313686045b7412a09dfb4c3e2edfd0afa62e60adb1020a7bc3f9b08bb782e868e6b32b246185d199ff55d6c475eaf96

C:\Users\Admin\AppData\Local\Temp\3B9B.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\3B9B.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

MD5 264645e6949faa6016f9b985467c88ea
SHA1 efc3e10e30f07b0bd97049d7dd8c87a3de9e4c0e
SHA256 aabc3d235483d7ecd8317c0c897385cefe42bbd41aafcd614a58f48ec57b6517
SHA512 88e3abf2fbe57d6628c55b469b6f0653b313686045b7412a09dfb4c3e2edfd0afa62e60adb1020a7bc3f9b08bb782e868e6b32b246185d199ff55d6c475eaf96

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

MD5 264645e6949faa6016f9b985467c88ea
SHA1 efc3e10e30f07b0bd97049d7dd8c87a3de9e4c0e
SHA256 aabc3d235483d7ecd8317c0c897385cefe42bbd41aafcd614a58f48ec57b6517
SHA512 88e3abf2fbe57d6628c55b469b6f0653b313686045b7412a09dfb4c3e2edfd0afa62e60adb1020a7bc3f9b08bb782e868e6b32b246185d199ff55d6c475eaf96

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

MD5 264645e6949faa6016f9b985467c88ea
SHA1 efc3e10e30f07b0bd97049d7dd8c87a3de9e4c0e
SHA256 aabc3d235483d7ecd8317c0c897385cefe42bbd41aafcd614a58f48ec57b6517
SHA512 88e3abf2fbe57d6628c55b469b6f0653b313686045b7412a09dfb4c3e2edfd0afa62e60adb1020a7bc3f9b08bb782e868e6b32b246185d199ff55d6c475eaf96

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

MD5 9fe34a518445397968659dce6da60c18
SHA1 52eae1b19718ca1357bf9c6466e22947a77c1930
SHA256 7c31c8606c9f90f67a7f068d2a3f2acb074dd8f32cf16a752ba042fc7ca4a5cb
SHA512 9129739b89123c5ed9ab42462ec1c59b06647b68a463819ba78b645454a606a62664b205308bc9d8be7066cd0b37e41834b621f1353178e67ddfc1fc23a7daf6

\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

MD5 9fe34a518445397968659dce6da60c18
SHA1 52eae1b19718ca1357bf9c6466e22947a77c1930
SHA256 7c31c8606c9f90f67a7f068d2a3f2acb074dd8f32cf16a752ba042fc7ca4a5cb
SHA512 9129739b89123c5ed9ab42462ec1c59b06647b68a463819ba78b645454a606a62664b205308bc9d8be7066cd0b37e41834b621f1353178e67ddfc1fc23a7daf6

\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

MD5 9fe34a518445397968659dce6da60c18
SHA1 52eae1b19718ca1357bf9c6466e22947a77c1930
SHA256 7c31c8606c9f90f67a7f068d2a3f2acb074dd8f32cf16a752ba042fc7ca4a5cb
SHA512 9129739b89123c5ed9ab42462ec1c59b06647b68a463819ba78b645454a606a62664b205308bc9d8be7066cd0b37e41834b621f1353178e67ddfc1fc23a7daf6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

MD5 9fe34a518445397968659dce6da60c18
SHA1 52eae1b19718ca1357bf9c6466e22947a77c1930
SHA256 7c31c8606c9f90f67a7f068d2a3f2acb074dd8f32cf16a752ba042fc7ca4a5cb
SHA512 9129739b89123c5ed9ab42462ec1c59b06647b68a463819ba78b645454a606a62664b205308bc9d8be7066cd0b37e41834b621f1353178e67ddfc1fc23a7daf6

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

MD5 ad9fff6459a8fc45d5422347648c4a5f
SHA1 c9fc0372a5d7ebc17a9e90cd05db7246fec63cbf
SHA256 198191aa01e71bafcba1f391aef25c7a72953ddfc8c088c49027bd6817c5699c
SHA512 181a61658a83f6c8d3f662ea7fc2fe8c2695263de09a4493cf922881212fb3a91ec99477bcbf0a820b58b7a122a8e868712435f081d728be416fe4b0b77c402a

\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

MD5 ad9fff6459a8fc45d5422347648c4a5f
SHA1 c9fc0372a5d7ebc17a9e90cd05db7246fec63cbf
SHA256 198191aa01e71bafcba1f391aef25c7a72953ddfc8c088c49027bd6817c5699c
SHA512 181a61658a83f6c8d3f662ea7fc2fe8c2695263de09a4493cf922881212fb3a91ec99477bcbf0a820b58b7a122a8e868712435f081d728be416fe4b0b77c402a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

MD5 ad9fff6459a8fc45d5422347648c4a5f
SHA1 c9fc0372a5d7ebc17a9e90cd05db7246fec63cbf
SHA256 198191aa01e71bafcba1f391aef25c7a72953ddfc8c088c49027bd6817c5699c
SHA512 181a61658a83f6c8d3f662ea7fc2fe8c2695263de09a4493cf922881212fb3a91ec99477bcbf0a820b58b7a122a8e868712435f081d728be416fe4b0b77c402a

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

MD5 0bbb36ddd1e4621672f2ef69da9105e5
SHA1 fa6a570e0a934e9f91e4689ea31560dfa99f3c84
SHA256 8ee308b30bf187c3a6f86302d360bc6a3e839bc94a1a9ab829b628c9b66b822d
SHA512 675fcc2f15175db261db4731e261e814863e84e96bdc640dadce77e5cd09eac96876d175f01b533a8c4b21744e9983b8e232d36c3e064b87dedbe8de60252fe0

\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

MD5 0bbb36ddd1e4621672f2ef69da9105e5
SHA1 fa6a570e0a934e9f91e4689ea31560dfa99f3c84
SHA256 8ee308b30bf187c3a6f86302d360bc6a3e839bc94a1a9ab829b628c9b66b822d
SHA512 675fcc2f15175db261db4731e261e814863e84e96bdc640dadce77e5cd09eac96876d175f01b533a8c4b21744e9983b8e232d36c3e064b87dedbe8de60252fe0

\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

MD5 ad9fff6459a8fc45d5422347648c4a5f
SHA1 c9fc0372a5d7ebc17a9e90cd05db7246fec63cbf
SHA256 198191aa01e71bafcba1f391aef25c7a72953ddfc8c088c49027bd6817c5699c
SHA512 181a61658a83f6c8d3f662ea7fc2fe8c2695263de09a4493cf922881212fb3a91ec99477bcbf0a820b58b7a122a8e868712435f081d728be416fe4b0b77c402a

\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

MD5 0bbb36ddd1e4621672f2ef69da9105e5
SHA1 fa6a570e0a934e9f91e4689ea31560dfa99f3c84
SHA256 8ee308b30bf187c3a6f86302d360bc6a3e839bc94a1a9ab829b628c9b66b822d
SHA512 675fcc2f15175db261db4731e261e814863e84e96bdc640dadce77e5cd09eac96876d175f01b533a8c4b21744e9983b8e232d36c3e064b87dedbe8de60252fe0

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

MD5 0bbb36ddd1e4621672f2ef69da9105e5
SHA1 fa6a570e0a934e9f91e4689ea31560dfa99f3c84
SHA256 8ee308b30bf187c3a6f86302d360bc6a3e839bc94a1a9ab829b628c9b66b822d
SHA512 675fcc2f15175db261db4731e261e814863e84e96bdc640dadce77e5cd09eac96876d175f01b533a8c4b21744e9983b8e232d36c3e064b87dedbe8de60252fe0

C:\Users\Admin\AppData\Local\Temp\3FB1.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\3FB1.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\455D.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

C:\Users\Admin\AppData\Local\Temp\455D.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

\Users\Admin\AppData\Local\Temp\3B9B.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\3B9B.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\3B9B.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\53BF.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\53BF.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

\Users\Admin\AppData\Local\Temp\3B9B.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\5AA3.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\5AA3.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F73B4291-690F-11EE-8DCD-5AE3C8A3AD14}.dat

MD5 f6858c424a895f7a070e5fd088d83dae
SHA1 5b593cd307706a3996ee9549337f65b4f4cf3e63
SHA256 3050f5a5169fb4375c06d5db69f11278b2ee6359bab2d98b13d472c278be3856
SHA512 4521be8565d34d80785ff5f19701e813643ae0028b4bab48c7995c1b61fae7920e368ff022cdda79eb19e42ef2f911dced5158cd3bc5fa12a987eb3dbe91ad0f

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{F87316B1-690F-11EE-8DCD-5AE3C8A3AD14}.dat

MD5 2e1a4e614fd8bc362d4793da913bae80
SHA1 c7a1e9fc7f60fea50784e84e11f47a9dabb53698
SHA256 7cca6ace03d47bff42fc880c0076cb1dcb67affaef66ee9727f9006ac1506306
SHA512 7415a4146f258f40fc6ed3b78d8a7f9e6c971ce7530b1788b930a0adfadebf088e53a7b7c6765521308ff16b92063a4732ad1470f729a0f90b7fa5640424cb07

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2020-163-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

memory/2020-165-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5DA1.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\455D.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

\Users\Admin\AppData\Local\Temp\455D.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

\Users\Admin\AppData\Local\Temp\455D.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

\Users\Admin\AppData\Local\Temp\455D.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

memory/2020-175-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\62C0.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\62C0.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\A701.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/2580-185-0x0000000000270000-0x00000000002CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A701.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/2580-191-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1740-192-0x0000000000210000-0x0000000000211000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B2D4.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/2044-203-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2044-199-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2044-197-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3000-206-0x0000000000CA0000-0x0000000000DF8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CF89.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\CF89.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/2044-213-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2044-212-0x0000000000400000-0x000000000043E000-memory.dmp

memory/664-214-0x00000000004E0000-0x000000000053A000-memory.dmp

C:\Users\Admin\AppData\Roaming\ttgiwwf

MD5 7825cad99621dd288da81d8d8ae13cf5
SHA1 f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c
SHA256 529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5
SHA512 2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

C:\Users\Admin\AppData\Roaming\ttgiwwf

MD5 7825cad99621dd288da81d8d8ae13cf5
SHA1 f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c
SHA256 529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5
SHA512 2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

C:\Users\Admin\AppData\Local\Temp\E230.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\5DA1.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/664-227-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\E230.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

\Users\Admin\AppData\Local\Temp\E8A6.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

C:\Users\Admin\AppData\Local\Temp\E8A6.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

memory/2632-242-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2044-243-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2632-245-0x0000000000310000-0x000000000032E000-memory.dmp

memory/2788-246-0x0000000000E90000-0x0000000000EEA000-memory.dmp

memory/2580-244-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/664-247-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2788-248-0x0000000071380000-0x0000000071A6E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabF318.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\TarF3D6.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aff506597b0d28443c73b4ce4beefcbd
SHA1 10f65930d84e21f86ee804a2cbbd4fae003f8e31
SHA256 0a76d1fcd6b5e6e1b0aea58ef71abcc353f2bb9b44236eedce6051e0e72f3c60
SHA512 1fc8d34f4ed44025c8b30c138a0b0d0d3fea37015424c999affac1beb7be52369edec793ae2fd4e138c2e67ab8c12946af99ad0ba5518a88f53d3bfd61596bcc

memory/664-371-0x0000000006F40000-0x0000000006F80000-memory.dmp

memory/2580-372-0x0000000006F10000-0x0000000006F50000-memory.dmp

memory/2788-373-0x0000000000CD0000-0x0000000000D10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PL78BP4I\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

memory/2632-551-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2044-586-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2580-587-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/664-588-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2788-589-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/1180-590-0x000000013F140000-0x000000013F43F000-memory.dmp

memory/1180-595-0x000000013F140000-0x000000013F43F000-memory.dmp

memory/2836-597-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2836-594-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2836-598-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2836-593-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2836-591-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2836-599-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/664-600-0x0000000006F40000-0x0000000006F80000-memory.dmp

memory/2580-601-0x0000000006F10000-0x0000000006F50000-memory.dmp

memory/2788-602-0x0000000000CD0000-0x0000000000D10000-memory.dmp

memory/2044-604-0x00000000074A0000-0x00000000074E0000-memory.dmp

memory/2632-605-0x0000000004860000-0x00000000048A0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e7b1faf45deea24ec7956ef79cb33af8
SHA1 3b4562537ee065dbb33e1d619babbec089a02113
SHA256 8d3a0bbacd79d343b7c77cde524f812dd4f0bf14adc6d3916a8e32b13d34f084
SHA512 e92d394bd892fbb4ce13557fec9984d97de1e1ade8f268f9a6dba35f184268d44ae27749ad570d0cd893fcdb6ad9bb84536b355000880aceff0a069d407ac6b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5de1aa68d4cd32a21fd3b45024f24b9e
SHA1 7c9ffa57eb2400e9423a40bff1ff9703a6f075e2
SHA256 bb5c3356b375afc35424a23827746a22e27501559241b48d69475ab6e914e513
SHA512 85377563a9e23bc1c3a6c13b191f596c5015ae33c70732b741e6209c3d1f12e346789b21f8ab7cb30728c867cd6557c0f37a933fae47a5c1d433d34ac5643b60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a93403911600d1c8f0d413de5724dbdb
SHA1 2d96f5805eb04d359e8f5fdcf89d28b22517b0a5
SHA256 a4b4ed4c22e62bd815c8da9944ef80b0f2a8d9476907f0315fe76b820bbe76d1
SHA512 9ce3335575a7f94fe2a3b731581192a1ab1f35ac669e320a46153c20ccf3963b7485e97375a1d4a4614a5d0d0fcb9305489ce3a61bb8e8c3f370d5771f7c03c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3dc5f21998899bfe859334aea77b7486
SHA1 7dfbf3da239693f40387c2b9385fcc3c5e3cfabf
SHA256 6ec984593b99971a3ff3dde95dd2f4cbc3c9ed0973fd9fccffd729ed5623ae4d
SHA512 efe39269adb14f5583ce01d5642956971c3b44cded80202e0ea3e8603642a3f06314fed7bd570af4f1a91863e03f9b5436186f2b765ae75510f61da0cc70cec0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf7bb67208b357816ea14f410f8cb65c
SHA1 0610d81e2c5e85b6716dd3bb59429d0ee27dc2be
SHA256 d3c728c7cf037fc34d26af85f01a0387bb33952ce5fdd072d39cf2ed58b1b0f3
SHA512 b34cda4490c6d51cac0a5c17c60f74192502c12b1f4176116c381e515f47d5ec4ffc78fad624f42b4d552bb853b0da38e59b0fa6f31d55eb99ba5fc361c66570

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1fde647d37688c176adb949bf7502578
SHA1 7efb58953951c8a55d7300fced0ad5dfb34dab08
SHA256 3d1e8934bb96fd0cf861613f1c47d5d69614885809ba07d6084492db12d5a8a3
SHA512 528ab3a36e5b14e12ec9634b3959598aa7f4dff3db7fd271acd942260a7468bdffbaf7a97fe84b914065ac24e23c1c9452de67e03709299509b43b997567892a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 baa1d35f3238a75cd85ccad35cd04868
SHA1 bfff4fac6a81a6487a709f4d94e3a6d0e38a5179
SHA256 548fcc8eb3d16814f412b08e50c8da8f4796fd3aca19236766a8d35f2f6265e6
SHA512 f5efe3a3914b56d0ccf4aa0dac133d2459d58999ed4b406e3fe1df960ec0a3b658448f5d3da85b4feeda815d36d57b573fd2dfef8431221ef5d8641bb3a75fb5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b0da294a719bd495681d81f87b19ed45
SHA1 86ed52472092e5bb7c96a648db118da197b04961
SHA256 9601db3a39e994fcb898adf1eb2fd2dad45c8b137bb2d7cfd8c8d1652fc0136f
SHA512 d46809c924f38eb104465b77f4e2bd86671351a002006d047dc1d86badd2d1d825bce54f50949bb79ea58ad291742a4feadfc855b353dffb535ef8e2d521ec48

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 142e5675ab2b4cbeaa495c830dad7698
SHA1 fe7b408ae284a7a113320c38c489d7e44054d50e
SHA256 043f556d38d388278be0ad2cb684845ef6afe2b608b612fc6c2ea5b7d7781def
SHA512 9fd442f960a82289bbd791384a12b61a3037d769a96907e08e05e121339e15655008a32cb4b17ee92716d3f36ffc2cd36fc8beacaea7188a14d92aad3aca25af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7a5f7ed05c9618962364427dcd29563f
SHA1 f93d85be662abbe0e432bf0cd4e2798677d21055
SHA256 a528276cd19286421cfe23dc1ac21a8b19631ee81efb34ce39abb67e886f43fc
SHA512 5ee1a1208b5afceedce7ae3010b56579ad73fdbfb5f3b6b414f4f3454086ad7b430f8a1efc72392b60d7f608a3154d0887a690568dced033effd61a4876b1800

memory/2020-994-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8BT23REO\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Temp\tmp52E9.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp531E.tmp

MD5 f53b7e590a4c6068513b2b42ceaf6292
SHA1 7d48901a22cd17519884cef703088b16eb8ab04f
SHA256 1ba7ecb5cecec10e4cc16b2e5668ba5ea4f52307f5543aba78e83de61e9fb3bf
SHA512 db510c474e4736ae8d23ee020bc029966f8ff2a9146dfc6a79604b05c4d95a4ce7a3d91a26c7d056e925012d62f459744db1d6df91e65c3da77ef6a1ab0ee231

memory/664-1161-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2580-1163-0x0000000071380000-0x0000000071A6E000-memory.dmp

memory/2788-1164-0x0000000071380000-0x0000000071A6E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4994da42b77b432825c55e1a02128895
SHA1 c9b0c7c8ff6ba0f7a58d4685ee653b49ed90e5ac
SHA256 164c85d2d1c5b6d44e5ac2228270ac4ddc3e52996a7d44eb1d646afa1827041f
SHA512 24bea09ef24a33f853c2067059cb2a6f300063147a6359d3eef0763a080a350c289b1110520c1b0a0a96acdbbaca24d303c7a6d36d35b20840bfea2f5f749c64

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3bc1e01241f97ed52539e65dffe92f12
SHA1 7c52c5e9c7073e0555f2c53fae873a5ef76a1e1d
SHA256 b936a9876f3937247c7dc8be4f10b778c3e8650eb8c075042899b836820e6b00
SHA512 55c46d76f11e287c7826597c42920e5cdbc1c136963986be1da97b24e636bddbe3c41cd7ed508fb142b7c7be23c2ad2ffdae665a0a610bee15058684dddeabaa

memory/2632-1269-0x0000000071380000-0x0000000071A6E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 26df16bf57b9b10567d2c2bb45b5f96b
SHA1 671bd09cb88089eca9282d57df3c951bfee01729
SHA256 6407e4a1305b6e875154056d36e30a55ef222a266483bf76396335d198079015
SHA512 f5154de4b58d6139d5b2659c2c556c3a71cb75203d12e03c02cfeb1736c9d4038d7c0387e0c9e32078309eadb1fd43cd01e69764dfc9336568c4a0f77871ee09

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 de5c9b640745f2713ce540d53977d93d
SHA1 d7962fe6b80fbae683e0605bacead5a460aa9c33
SHA256 14f0e574c7a782ef7445219c224762802a6561b0a42029d03736a630c49bcd12
SHA512 d427b10da1a568dcf25e870bf9e5b1505de35c7e9a649e7430533c0a659ec281d6a78e07c2c26e2f1ed962acf19664c39f01edc3ed5c19326f2e1bb3883a4d85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ae2106857cd989f6e5b2a821a0ebee49
SHA1 b2a2dff8d81f699c87ee443547af2d9eb99e44bd
SHA256 f3a11f422e7c5158be52b757a2df1c84b9c76c854dbebbac0c5fb853273eaec7
SHA512 89c0d0cc4339d2f86c771e9e2bc098c37004b7a48b41e0b2a557a3489f588ccf87cb4f92af6ccafda85778d37d9f84faae1eb750a4241ee07c1c598ec2174072

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20c16303452da33368d08a78d52ac0fe
SHA1 4dbc09da05f00a63c701a93a95d15429a58ee5a4
SHA256 4b2444fbe6f0c8d33e75d8d37da46ff513f9707058067a62afc9a10f315b9728
SHA512 5885a6c6d5fe90a77e1741685063f8ec8b9458382bcb9bc3fb939d034c7656aaaca990824a8110554981f0a4667a2423043f10dc0e3b48c7076c60fea91f50da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 55c26167ab0e32dd9e9c66c98c6d67c3
SHA1 0d77e4e4838c90d05cb537aa2109fb9c81803693
SHA256 a86ddb3fa4d6f53ec682ffa68811dbe3e350da1b79e449960a7008173ed9ac40
SHA512 6a56b5c520315695517640b156821974145f5cd92314f10b651963db37c47c5b102d01551438fdd687ca3e4d5dfa785264d1488ba99c5dc64ad9e054005d310b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 003a36e218fe70464c437b8d2a415180
SHA1 9926ecb5b438ad5539f2241aff337b5faa7ba69c
SHA256 5aac6db9e5123a5566482aad8aa4b5229c634a57d7110b1bb1beebee064f3e9c
SHA512 5c0c831cfb7c14e0ef09ad731be84fc5eabfd67624991a6f460084a173fca7580790f03c5b8095f6a158cd13422d56ff0d62d1cf852490560556ef906fc523f6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b0a8335a9a175852bbffb03a71d46de
SHA1 312ba7261cfa0cca14724f1f33c80d6725957e13
SHA256 98dc7494451f6e07870aadc394478848c0cf1b27a3a59e2f56d7ae32594eedc3
SHA512 7d8ff3f5a11ae81403fdf2b4fe07960a9a7ee4f1215e9b74a18d8d8fa40859038c95c558cdce51470edf1db3a8460ec3e97326bfe7b073803d7fc73dfa04025f

memory/2044-1495-0x0000000071380000-0x0000000071A6E000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-11 20:21

Reported

2023-10-12 15:02

Platform

win10v2004-20230915-en

Max time kernel

159s

Max time network

165s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\37A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\37A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\37A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\37A.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\37A.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\37A.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\55F.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7A2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\37A.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\EA6F.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe N/A

Checks installed software on the system

discovery

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\37A.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7A2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3868 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3868 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3868 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3868 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3868 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3868 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3252 wrote to memory of 3856 N/A N/A C:\Users\Admin\AppData\Local\Temp\EA6F.exe
PID 3252 wrote to memory of 3856 N/A N/A C:\Users\Admin\AppData\Local\Temp\EA6F.exe
PID 3252 wrote to memory of 3856 N/A N/A C:\Users\Admin\AppData\Local\Temp\EA6F.exe
PID 3252 wrote to memory of 2264 N/A N/A C:\Users\Admin\AppData\Local\Temp\FBC6.exe
PID 3252 wrote to memory of 2264 N/A N/A C:\Users\Admin\AppData\Local\Temp\FBC6.exe
PID 3252 wrote to memory of 2264 N/A N/A C:\Users\Admin\AppData\Local\Temp\FBC6.exe
PID 3252 wrote to memory of 4528 N/A N/A C:\Windows\system32\cmd.exe
PID 3252 wrote to memory of 4528 N/A N/A C:\Windows\system32\cmd.exe
PID 3252 wrote to memory of 4648 N/A N/A C:\Users\Admin\AppData\Local\Temp\28E.exe
PID 3252 wrote to memory of 4648 N/A N/A C:\Users\Admin\AppData\Local\Temp\28E.exe
PID 3252 wrote to memory of 4648 N/A N/A C:\Users\Admin\AppData\Local\Temp\28E.exe
PID 3252 wrote to memory of 1848 N/A N/A C:\Users\Admin\AppData\Local\Temp\37A.exe
PID 3252 wrote to memory of 1848 N/A N/A C:\Users\Admin\AppData\Local\Temp\37A.exe
PID 3856 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\EA6F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 3856 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\EA6F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 3856 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\EA6F.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe
PID 4528 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4528 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4148 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 4148 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 4148 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe
PID 3572 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 3572 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 3572 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe
PID 3252 wrote to memory of 5040 N/A N/A C:\Users\Admin\AppData\Local\Temp\55F.exe
PID 3252 wrote to memory of 5040 N/A N/A C:\Users\Admin\AppData\Local\Temp\55F.exe
PID 3252 wrote to memory of 5040 N/A N/A C:\Users\Admin\AppData\Local\Temp\55F.exe
PID 3228 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 3228 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 3228 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe
PID 3692 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 3692 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 3692 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe
PID 3252 wrote to memory of 2952 N/A N/A C:\Users\Admin\AppData\Local\Temp\7A2.exe
PID 3252 wrote to memory of 2952 N/A N/A C:\Users\Admin\AppData\Local\Temp\7A2.exe
PID 3252 wrote to memory of 2952 N/A N/A C:\Users\Admin\AppData\Local\Temp\7A2.exe
PID 3252 wrote to memory of 4716 N/A N/A C:\Users\Admin\AppData\Local\Temp\BD9.exe
PID 3252 wrote to memory of 4716 N/A N/A C:\Users\Admin\AppData\Local\Temp\BD9.exe
PID 3252 wrote to memory of 4716 N/A N/A C:\Users\Admin\AppData\Local\Temp\BD9.exe
PID 3252 wrote to memory of 312 N/A N/A C:\Users\Admin\AppData\Local\Temp\1010.exe
PID 3252 wrote to memory of 312 N/A N/A C:\Users\Admin\AppData\Local\Temp\1010.exe
PID 3252 wrote to memory of 312 N/A N/A C:\Users\Admin\AppData\Local\Temp\1010.exe
PID 536 wrote to memory of 2684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 536 wrote to memory of 2684 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3252 wrote to memory of 1404 N/A N/A C:\Users\Admin\AppData\Local\Temp\164B.exe
PID 3252 wrote to memory of 1404 N/A N/A C:\Users\Admin\AppData\Local\Temp\164B.exe
PID 3252 wrote to memory of 1404 N/A N/A C:\Users\Admin\AppData\Local\Temp\164B.exe
PID 3252 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\Temp\1B6D.exe
PID 3252 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\Temp\1B6D.exe
PID 3252 wrote to memory of 2744 N/A N/A C:\Users\Admin\AppData\Local\Temp\1B6D.exe
PID 5040 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\55F.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 5040 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\55F.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 5040 wrote to memory of 4804 N/A C:\Users\Admin\AppData\Local\Temp\55F.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 2952 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\7A2.exe C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
PID 2952 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\7A2.exe C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
PID 2952 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\7A2.exe C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
PID 4528 wrote to memory of 2488 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4528 wrote to memory of 2488 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe

"C:\Users\Admin\AppData\Local\Temp\5e87bbba79e1fc228bd12c22c66298f592b4b0b472a611cb5cb0c61d3accdd46.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3868 -ip 3868

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 260

C:\Users\Admin\AppData\Local\Temp\EA6F.exe

C:\Users\Admin\AppData\Local\Temp\EA6F.exe

C:\Users\Admin\AppData\Local\Temp\FBC6.exe

C:\Users\Admin\AppData\Local\Temp\FBC6.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FE76.bat" "

C:\Users\Admin\AppData\Local\Temp\28E.exe

C:\Users\Admin\AppData\Local\Temp\28E.exe

C:\Users\Admin\AppData\Local\Temp\37A.exe

C:\Users\Admin\AppData\Local\Temp\37A.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

C:\Users\Admin\AppData\Local\Temp\55F.exe

C:\Users\Admin\AppData\Local\Temp\55F.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

C:\Users\Admin\AppData\Local\Temp\7A2.exe

C:\Users\Admin\AppData\Local\Temp\7A2.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

C:\Users\Admin\AppData\Local\Temp\BD9.exe

C:\Users\Admin\AppData\Local\Temp\BD9.exe

C:\Users\Admin\AppData\Local\Temp\1010.exe

C:\Users\Admin\AppData\Local\Temp\1010.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9027146f8,0x7ff902714708,0x7ff902714718

C:\Users\Admin\AppData\Local\Temp\164B.exe

C:\Users\Admin\AppData\Local\Temp\164B.exe

C:\Users\Admin\AppData\Local\Temp\1B6D.exe

C:\Users\Admin\AppData\Local\Temp\1B6D.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9027146f8,0x7ff902714708,0x7ff902714718

C:\Users\Admin\AppData\Local\Temp\205F.exe

C:\Users\Admin\AppData\Local\Temp\205F.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2264 -ip 2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3404 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4648 -ip 4648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1448 -ip 1448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2960 -ip 2960

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 136

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 236

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\2ED7.exe

C:\Users\Admin\AppData\Local\Temp\2ED7.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Yu966Qp.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Yu966Qp.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1B6D.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xec,0x108,0x7ff9027146f8,0x7ff902714708,0x7ff902714718

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=1B6D.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9027146f8,0x7ff902714708,0x7ff902714718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13947408763178821875,2892516053842521334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

Network

Country Destination Domain Proto
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.1.85.104.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 254.210.247.8.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 16.221.240.157.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
MD 176.123.9.142:37637 tcp
RU 5.42.92.211:80 5.42.92.211 tcp
IT 185.196.9.65:80 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 65.9.196.185.in-addr.arpa udp
NL 85.209.176.171:80 85.209.176.171 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
TR 185.216.70.238:37515 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 238.70.216.185.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 183.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 facebook.com udp
GB 157.240.221.35:443 facebook.com tcp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 mscom.demdex.net udp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 target.microsoft.com udp
IE 54.229.208.26:443 mscom.demdex.net tcp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 26.208.229.54.in-addr.arpa udp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
GB 51.104.15.253:443 browser.events.data.microsoft.com tcp
GB 51.104.15.253:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 253.15.104.51.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
NL 142.251.36.14:443 play.google.com udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
NL 142.250.179.141:443 accounts.google.com udp

Files

memory/4484-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4484-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4484-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3252-2-0x0000000002EA0000-0x0000000002EB6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EA6F.exe

MD5 c36b3237039a0094f563964364f50e24
SHA1 61d903e1f4667e9e2565e5c50c6dbe9976f45282
SHA256 0954e90783c2c369a6b2df16e19bda360669d72c77e4c8295df973067758844a
SHA512 9e087b9d01cccf4650859881f6ea95e7e82750d75cf48d86f7de7654f88c2eb8af4e1d10cd1d36bc75acf1f8c365900b8a7632e3c3f7ce78327eec95caa6c1c2

C:\Users\Admin\AppData\Local\Temp\EA6F.exe

MD5 c36b3237039a0094f563964364f50e24
SHA1 61d903e1f4667e9e2565e5c50c6dbe9976f45282
SHA256 0954e90783c2c369a6b2df16e19bda360669d72c77e4c8295df973067758844a
SHA512 9e087b9d01cccf4650859881f6ea95e7e82750d75cf48d86f7de7654f88c2eb8af4e1d10cd1d36bc75acf1f8c365900b8a7632e3c3f7ce78327eec95caa6c1c2

C:\Users\Admin\AppData\Local\Temp\FBC6.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\FBC6.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\FE76.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\28E.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

MD5 264645e6949faa6016f9b985467c88ea
SHA1 efc3e10e30f07b0bd97049d7dd8c87a3de9e4c0e
SHA256 aabc3d235483d7ecd8317c0c897385cefe42bbd41aafcd614a58f48ec57b6517
SHA512 88e3abf2fbe57d6628c55b469b6f0653b313686045b7412a09dfb4c3e2edfd0afa62e60adb1020a7bc3f9b08bb782e868e6b32b246185d199ff55d6c475eaf96

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

MD5 ad9fff6459a8fc45d5422347648c4a5f
SHA1 c9fc0372a5d7ebc17a9e90cd05db7246fec63cbf
SHA256 198191aa01e71bafcba1f391aef25c7a72953ddfc8c088c49027bd6817c5699c
SHA512 181a61658a83f6c8d3f662ea7fc2fe8c2695263de09a4493cf922881212fb3a91ec99477bcbf0a820b58b7a122a8e868712435f081d728be416fe4b0b77c402a

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oy3TK5PJ.exe

MD5 ad9fff6459a8fc45d5422347648c4a5f
SHA1 c9fc0372a5d7ebc17a9e90cd05db7246fec63cbf
SHA256 198191aa01e71bafcba1f391aef25c7a72953ddfc8c088c49027bd6817c5699c
SHA512 181a61658a83f6c8d3f662ea7fc2fe8c2695263de09a4493cf922881212fb3a91ec99477bcbf0a820b58b7a122a8e868712435f081d728be416fe4b0b77c402a

C:\Users\Admin\AppData\Local\Temp\55F.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/1848-59-0x00007FF8FFED0000-0x00007FF900991000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

MD5 0bbb36ddd1e4621672f2ef69da9105e5
SHA1 fa6a570e0a934e9f91e4689ea31560dfa99f3c84
SHA256 8ee308b30bf187c3a6f86302d360bc6a3e839bc94a1a9ab829b628c9b66b822d
SHA512 675fcc2f15175db261db4731e261e814863e84e96bdc640dadce77e5cd09eac96876d175f01b533a8c4b21744e9983b8e232d36c3e064b87dedbe8de60252fe0

C:\Users\Admin\AppData\Local\Temp\55F.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zh2vK7dI.exe

MD5 0bbb36ddd1e4621672f2ef69da9105e5
SHA1 fa6a570e0a934e9f91e4689ea31560dfa99f3c84
SHA256 8ee308b30bf187c3a6f86302d360bc6a3e839bc94a1a9ab829b628c9b66b822d
SHA512 675fcc2f15175db261db4731e261e814863e84e96bdc640dadce77e5cd09eac96876d175f01b533a8c4b21744e9983b8e232d36c3e064b87dedbe8de60252fe0

C:\Users\Admin\AppData\Local\Temp\7A2.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\7A2.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

MD5 9fe34a518445397968659dce6da60c18
SHA1 52eae1b19718ca1357bf9c6466e22947a77c1930
SHA256 7c31c8606c9f90f67a7f068d2a3f2acb074dd8f32cf16a752ba042fc7ca4a5cb
SHA512 9129739b89123c5ed9ab42462ec1c59b06647b68a463819ba78b645454a606a62664b205308bc9d8be7066cd0b37e41834b621f1353178e67ddfc1fc23a7daf6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rN1Jp6KH.exe

MD5 9fe34a518445397968659dce6da60c18
SHA1 52eae1b19718ca1357bf9c6466e22947a77c1930
SHA256 7c31c8606c9f90f67a7f068d2a3f2acb074dd8f32cf16a752ba042fc7ca4a5cb
SHA512 9129739b89123c5ed9ab42462ec1c59b06647b68a463819ba78b645454a606a62664b205308bc9d8be7066cd0b37e41834b621f1353178e67ddfc1fc23a7daf6

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JP83Dm7.exe

MD5 c744cde6a13370a7d6c1c0081899275c
SHA1 4fc5ac716a6c99b0fd107e53c49ce8d95bad5955
SHA256 eb87e4b3b1a68abac9dfe25d1cb6de511f9483e4b8974c859690dee68e6a844f
SHA512 6c112c801247611efebc931b8fb95a0ae0990bc9cf7adaa40dc9955d1441d559aa947088d835fe3fb4351425e60c8194ab05cceabe23460d44b2df17619b0feb

C:\Users\Admin\AppData\Local\Temp\28E.exe

MD5 a410f2978782614af3d5e20abf2f3ac9
SHA1 bbbfd08cf58add22f347b217b2a69be389aaf24c
SHA256 1c32ea981f5d489fb1e71212f0915e347c3744c43a5877fb138abe08c220efab
SHA512 905663ced4fae3da2df420b02d01ed7a343f3cb9ee0c718401567e532adf786857eaae43f68d5d9925e9fe57f6c1e28414ba58b759ec1ed32b9d3c4a0abe23c0

memory/1848-33-0x0000000000130000-0x000000000013A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pd7St1zm.exe

MD5 264645e6949faa6016f9b985467c88ea
SHA1 efc3e10e30f07b0bd97049d7dd8c87a3de9e4c0e
SHA256 aabc3d235483d7ecd8317c0c897385cefe42bbd41aafcd614a58f48ec57b6517
SHA512 88e3abf2fbe57d6628c55b469b6f0653b313686045b7412a09dfb4c3e2edfd0afa62e60adb1020a7bc3f9b08bb782e868e6b32b246185d199ff55d6c475eaf96

C:\Users\Admin\AppData\Local\Temp\37A.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\37A.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\BD9.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\1010.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Temp\BD9.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\1010.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/4716-86-0x0000000000400000-0x000000000046F000-memory.dmp

memory/4716-88-0x00000000006E0000-0x000000000073A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Temp\164B.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/1404-100-0x0000000000680000-0x00000000007D8000-memory.dmp

memory/312-101-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4716-104-0x0000000073650000-0x0000000073E00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\164B.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

C:\Users\Admin\AppData\Local\Temp\1B6D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/312-110-0x0000000000620000-0x000000000063E000-memory.dmp

memory/312-115-0x0000000005610000-0x0000000005C28000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/4716-122-0x00000000074A0000-0x0000000007532000-memory.dmp

memory/312-127-0x0000000004F00000-0x0000000004F3C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/312-123-0x0000000004EA0000-0x0000000004EB2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/4716-112-0x0000000006EE0000-0x0000000007484000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Temp\1B6D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\205F.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

memory/3392-144-0x0000000073650000-0x0000000073E00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\205F.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/4716-145-0x00000000076D0000-0x00000000076DA000-memory.dmp

memory/4716-148-0x0000000007750000-0x0000000007760000-memory.dmp

memory/4352-151-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4352-147-0x0000000000400000-0x0000000000433000-memory.dmp

memory/312-143-0x0000000004F40000-0x0000000004F8C000-memory.dmp

memory/4352-142-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3392-141-0x00000000008C0000-0x000000000091A000-memory.dmp

memory/1848-154-0x00007FF8FFED0000-0x00007FF900991000-memory.dmp

memory/3392-158-0x00000000078F0000-0x0000000007900000-memory.dmp

memory/4352-159-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4716-153-0x00000000077C0000-0x00000000078CA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

memory/2744-160-0x00000000020D0000-0x000000000212A000-memory.dmp

memory/2744-162-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2960-168-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2960-167-0x0000000000400000-0x0000000000433000-memory.dmp

memory/2976-170-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2960-171-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1404-174-0x0000000000680000-0x00000000007D8000-memory.dmp

memory/1404-175-0x0000000000680000-0x00000000007D8000-memory.dmp

memory/312-176-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4716-177-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/2976-180-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/3392-181-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/4716-182-0x0000000007750000-0x0000000007760000-memory.dmp

memory/312-184-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

memory/3392-185-0x00000000078F0000-0x0000000007900000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 fa6104444f1154ed3c3e3f04853231a3
SHA1 65dda0e8b1d1373827ce27413ded289c3711e85a
SHA256 c666aa18398ec5910f7ef8787c1ba1bf44e6ba3abb3c43cea0f74cc8b93e1b9f
SHA512 f799fdfda2ab874381188e4d8f77cfc794d94d84d38bd0e9f758ede9e3d2d7fbc8b1038554704fec5ac5000d51aa1e5670f5844fe4890c664d43c192355a63f4

memory/2976-193-0x0000000007B10000-0x0000000007B20000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2ED7.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c09bf85f5af2c5de8cb505f6b6ea1d5e
SHA1 01399fef62311696c58809faca72d62f7666b945
SHA256 e017f67664848ae40b15c2c0f16a4db439848155089b698fb61cb2af68ba7317
SHA512 2b3eef83c892a5204eb89c14d9cbf959e3931ccd9e60e8ad3e5ddaf0da0c310b5c0e63c772266df533f08651608dd04b47b9542c464b53a482c8a13713c93374

memory/1848-214-0x00007FF8FFED0000-0x00007FF900991000-memory.dmp

memory/5396-217-0x0000000000630000-0x000000000066E000-memory.dmp

memory/1404-224-0x0000000000680000-0x00000000007D8000-memory.dmp

memory/2820-225-0x00007FF6A1FA0000-0x00007FF6A229F000-memory.dmp

memory/5396-226-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/5396-228-0x00000000074B0000-0x00000000074C0000-memory.dmp

memory/3392-229-0x00000000084D0000-0x0000000008536000-memory.dmp

memory/4352-230-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Yu966Qp.exe

MD5 0e19769e1f0bb8e5ad0a561189fa67d8
SHA1 e96e111d73329225611a553118878ddc92816230
SHA256 4878678d86879b014280fb0c1479968f25d50e2aeadc30ef1e306ec58d06fbeb
SHA512 e52ff5acc44ca82700927292f33c1c098c67e7196bff5712020ca459ff65fdb44d9ce36a0fbbc98f782b30247ff81ebd62815db9c291af8aebbc44e73a889bcf

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Yu966Qp.exe

MD5 0e19769e1f0bb8e5ad0a561189fa67d8
SHA1 e96e111d73329225611a553118878ddc92816230
SHA256 4878678d86879b014280fb0c1479968f25d50e2aeadc30ef1e306ec58d06fbeb
SHA512 e52ff5acc44ca82700927292f33c1c098c67e7196bff5712020ca459ff65fdb44d9ce36a0fbbc98f782b30247ff81ebd62815db9c291af8aebbc44e73a889bcf

memory/6108-234-0x00000000005D0000-0x000000000060E000-memory.dmp

memory/6108-235-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/2976-236-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/6108-237-0x0000000007510000-0x0000000007520000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

memory/4716-242-0x00000000089F0000-0x0000000008A40000-memory.dmp

memory/4716-243-0x0000000008A50000-0x0000000008AC6000-memory.dmp

memory/2820-247-0x00007FF6A1FA0000-0x00007FF6A229F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

memory/3452-252-0x0000000000DB0000-0x0000000000DE3000-memory.dmp

memory/2820-253-0x00007FF6A1FA0000-0x00007FF6A229F000-memory.dmp

memory/3452-254-0x0000000000DB0000-0x0000000000DE3000-memory.dmp

memory/3452-255-0x0000000000DB0000-0x0000000000DE3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6675325d1fce5fe9ed5c0a74cbe4d671
SHA1 a3f7de27c0d4b2e2410fd15b2c6bb9e7c80450fe
SHA256 57859cb980650029d22f662154334ed25474e3dd75e6cb46fab7a16aa8e86cf1
SHA512 1e289b6e8e697f1c0c7fb1c1de220d461d87a8c0fff95b3512e1b845c3f21c4a0f3ac1b4a82cc4369c4e3f1c7b258824769b455e27d96c33d79af7ea70f9df70

memory/3452-265-0x0000000000DB0000-0x0000000000DE3000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 700ae41b0ec7e4819da54ccbb2647da8
SHA1 0b7fdb63a3fa5942c7932c6c5b5930c84403dc8e
SHA256 d3bfc4fe920f8b12b32816a6a4cd14b25ef88c187557f8f7f68bc888c524113b
SHA512 08f17635516a16c1b2a0991c6cc5d0977f8f1065f61ff69d54a7d2cee4e4e2ccd43a44ef71961a96bb04725fdf5603846730f394b43542b7c7806e5506417c3f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 4a078fb8a7c67594a6c2aa724e2ac684
SHA1 92bc5b49985c8588c60f6f85c50a516fae0332f4
SHA256 c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee
SHA512 188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f8e57f7ba1e0dac05752a7b44283b799
SHA1 a6fd000ac78a4ab7749652f08b9a4cb1ddb61ec9
SHA256 8c54ca206bc9906305355d8e7fcf3de73d1709a883b011605f0801431bc6135f
SHA512 8cb194d66f476e08c7b1904a1b1cde9fc02eef14f44ed80dd09980f3247a3cd274f568608a0a0f175b75a7da37586e3e936751341cff0416e3b3f7a335e128c4

memory/5396-332-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/5396-333-0x00000000074B0000-0x00000000074C0000-memory.dmp

memory/312-340-0x0000000006490000-0x0000000006652000-memory.dmp

memory/312-357-0x0000000006B90000-0x00000000070BC000-memory.dmp

memory/3392-364-0x000000000A820000-0x000000000A83E000-memory.dmp

memory/6108-370-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/6108-380-0x0000000007510000-0x0000000007520000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

MD5 708b9fbd5d1d6cde452e8b8df04259a8
SHA1 c86befaddd22fd8af7555a1d675a5ac23ff3aafb
SHA256 5e3a4f32062a430c26d0b79438a4a74e58e9a1abd23b8d930a10fcde40efd781
SHA512 a1ae5961eb30387e9b1bfe275d67a607aec6333a0762e03d90b3037f4710e9517bf4f7de8c322429552cfff657d26b4d0c0654b54b88dfd3ee242cc6e9ba0706

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 09da24b9502fda9fa643e9329768b364
SHA1 dbb18f5c318a2f34a4ae017d20cf10dbd86b1277
SHA256 f7d81814ec4e4a7cfeb5ae7d54b0b276d1a823b7bdcd75b0afb2ecd24e9cda13
SHA512 582a9649793b598b65e9acb65d3205594cd016e0cbdb36ded532eb8404b42591c7c0aaf3d4b7647f61017367e9bb14da01d12560447daea51dabdd0f595aff00

C:\Users\Admin\AppData\Local\Temp\tmpC24.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpC49.tmp

MD5 9bea288e5e9ccef093ddee3a5ab588f3
SHA1 02a72684263b4bcd2858f48b0a1aec5d636782e3
SHA256 a77cae820a99813a04bbcf7b80b7a56a03b8d53813b441ef7542e81dcdad3257
SHA512 68f9a928cabfc886131f047b0fe74ba67af5b1082083ae5543ba8b1b3189bdd02f15929736e6cc0c561a02915f29bf58bbc4022e6f823549344d9f14a3c2be07

C:\Users\Admin\AppData\Local\Temp\tmpC93.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmpCA9.tmp

MD5 708b9fbd5d1d6cde452e8b8df04259a8
SHA1 c86befaddd22fd8af7555a1d675a5ac23ff3aafb
SHA256 5e3a4f32062a430c26d0b79438a4a74e58e9a1abd23b8d930a10fcde40efd781
SHA512 a1ae5961eb30387e9b1bfe275d67a607aec6333a0762e03d90b3037f4710e9517bf4f7de8c322429552cfff657d26b4d0c0654b54b88dfd3ee242cc6e9ba0706

C:\Users\Admin\AppData\Local\Temp\tmpCBB.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmpCE6.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d6cf1f99d2c12a1065312e1fe31e69f9
SHA1 ace270a102ecf75554d604c7e4e3c99f239e7317
SHA256 4273739ed15daff0b495b2b7899ea38c64567d52fc26ca65f0f2aecaf2dab177
SHA512 78755a52a795f77a265b647acd9b9ceaa62d4c7d7ab3676d5f1ddd10bd598d7ed3b3efabb03d35a85c3d96289fff691d924d8a3643a18ee5debaa4b269b4ee0c

memory/3392-630-0x0000000073650000-0x0000000073E00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c55db7bc27c98b18b736d3a13b0f9629
SHA1 eac314340d7c99128390a3b6176ba661376df4ab
SHA256 4b8816b1bbfbaa209bf4f3b7c94a60e4213cf536dd4a8d6a3c57784099e2d872
SHA512 32be98d373d358fe7cd39d4ed0bf3e60e1035e71baade7a154165dfa747843b679045fae6240d299767766b5cf6a101d20fc1a50ecc436ce5cdc67a6a984c21c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5943f5.TMP

MD5 bf4590560c944aced0b35eaac744d61c
SHA1 d4e4ac3d2fa30d81adc147bcabe64b34dc35aeac
SHA256 00fc7abb4980d83d535c476ffe1bea1bf058954c04d4eec9e5b41ac957eb3740
SHA512 d9d7c79aa1d5843be28ac79602bb76fe0c5cd6fdfc9aabac6998ff1a0d9d1a9824609b9a4cb71cdb0bcc485f472e4495d7be9530ae125eea6894979365b533c4

memory/4716-647-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/312-646-0x0000000073650000-0x0000000073E00000-memory.dmp

memory/5396-656-0x0000000073650000-0x0000000073E00000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 2680421406d7487a0491ce61c00fb35b
SHA1 fad3f51a586b9ad46c66c268405daa569d7b0aa8
SHA256 c0496d57d53cb4271d981dac6ebdc1b0efda78c3e185710ce3e13068e72f5031
SHA512 a9fa658156f098743bd2e9fefe34ce821751c6598c7ae00682c4c50262024026a24a879ae0f56d68da13d7a529dbb93f37f1440c42835e81f643739397370241

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 16157a748c8b87d730ee8e8a056a34c0
SHA1 7267a2ea3b678de516ff0b8a75fc96c767ec7c3a
SHA256 c09026e2c815c3f0f5c66644d6dc80c9774a6fb57431f8701a840639e9abcd29
SHA512 799e02cd9b85ba52751ae6bb047d8f0223869521647008bc6c0e61b2a9fcba2831abcbfe61b5ec1a2cd331f6d1f0559b12b084d2a8a27ded8b7ba1f7e6ad9aad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 31c587d61d7222223db14a07eef86b9a
SHA1 b27f97177b3e3f55c17548a8e64775935101fa9a
SHA256 3fc5b8bcdbfdee65e8ffd70df304936b788b8d039c25fc9de11ef324e8eb7faa
SHA512 40f384a75f17c774885bf045a474398e14937cef3b8202439f284a09c5fb27689977facc7b80b8009bb6c89757fd6997a93793c42eab05cb00ec3e434e2c8916

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1acfb22261ede090c82e9b75967d475a
SHA1 4152f06e147055052fa97f767d096ec40fbb32f2
SHA256 9e56c65df860b9e0e3e2dc748153df5f6091e5745033640f8667c1b6935a7aa7
SHA512 014e41d133434b7dcae5eaf30d8f13caaf0bc553bb00a3f9e28773808821672a664a070fe26efe8416b080636b40c56703803344aab1074484309ae8d1e85579

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4