Malware Analysis Report

2025-08-10 23:43

Sample ID 231011-y8evesdd95
Target 75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a
SHA256 75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a
Tags
amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google dropper evasion infostealer persistence phishing rat trojan breha kukish microsoft discovery spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a

Threat Level: Known bad

The file 75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a was found to be: Known bad.

Malicious Activity Summary

amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google dropper evasion infostealer persistence phishing rat trojan breha kukish microsoft discovery spyware

Detected google phishing page

SectopRAT payload

Modifies Windows Defender Real-time Protection settings

Amadey

SmokeLoader

SectopRAT

RedLine

Detects Healer an antivirus disabler dropper

DcRat

RedLine payload

Healer

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Windows security modification

Uses the VBS compiler for execution

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of SetThreadContext

Detected potential entity reuse from brand microsoft.

Enumerates physical storage devices

Program crash

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious behavior: GetForegroundWindowSpam

Uses Task Scheduler COM API

Creates scheduled task(s)

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-11 20:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-11 20:27

Reported

2023-10-12 15:14

Platform

win7-20230831-en

Max time kernel

128s

Max time network

162s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat

Detected google phishing page

phishing google

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\14C.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\14C.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\14C.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\14C.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\14C.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\14C.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\101C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14AF.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\14C.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\14C.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\ECBF.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403285411" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6630801-6911-11EE-9AD4-5EF5C936A496} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14C.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1C8E.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14AF.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2220 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\SysWOW64\WerFault.exe
PID 2220 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\SysWOW64\WerFault.exe
PID 2220 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\SysWOW64\WerFault.exe
PID 2220 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\SysWOW64\WerFault.exe
PID 1300 wrote to memory of 2684 N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe
PID 1300 wrote to memory of 2684 N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe
PID 1300 wrote to memory of 2684 N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe
PID 1300 wrote to memory of 2684 N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe
PID 1300 wrote to memory of 2684 N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe
PID 1300 wrote to memory of 2684 N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe
PID 1300 wrote to memory of 2684 N/A N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe
PID 1300 wrote to memory of 2840 N/A N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe
PID 1300 wrote to memory of 2840 N/A N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe
PID 1300 wrote to memory of 2840 N/A N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe
PID 1300 wrote to memory of 2840 N/A N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe
PID 1300 wrote to memory of 1536 N/A N/A C:\Windows\system32\cmd.exe
PID 1300 wrote to memory of 1536 N/A N/A C:\Windows\system32\cmd.exe
PID 1300 wrote to memory of 1536 N/A N/A C:\Windows\system32\cmd.exe
PID 1300 wrote to memory of 2496 N/A N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe
PID 1300 wrote to memory of 2496 N/A N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe
PID 1300 wrote to memory of 2496 N/A N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe
PID 1300 wrote to memory of 2496 N/A N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe
PID 1300 wrote to memory of 1948 N/A N/A C:\Users\Admin\AppData\Local\Temp\14C.exe
PID 1300 wrote to memory of 1948 N/A N/A C:\Users\Admin\AppData\Local\Temp\14C.exe
PID 1300 wrote to memory of 1948 N/A N/A C:\Users\Admin\AppData\Local\Temp\14C.exe
PID 1536 wrote to memory of 992 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1536 wrote to memory of 992 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1536 wrote to memory of 992 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2840 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe C:\Windows\SysWOW64\WerFault.exe
PID 2840 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe C:\Windows\SysWOW64\WerFault.exe
PID 2840 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe C:\Windows\SysWOW64\WerFault.exe
PID 2840 wrote to memory of 1512 N/A C:\Users\Admin\AppData\Local\Temp\EF5F.exe C:\Windows\SysWOW64\WerFault.exe
PID 2496 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe C:\Windows\SysWOW64\WerFault.exe
PID 2496 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe C:\Windows\SysWOW64\WerFault.exe
PID 2496 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe C:\Windows\SysWOW64\WerFault.exe
PID 2496 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\F3E3.exe C:\Windows\SysWOW64\WerFault.exe
PID 2684 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2684 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2684 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2684 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2684 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2684 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2684 wrote to memory of 1532 N/A C:\Users\Admin\AppData\Local\Temp\ECBF.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 1300 wrote to memory of 2776 N/A N/A C:\Users\Admin\AppData\Local\Temp\101C.exe
PID 1300 wrote to memory of 2776 N/A N/A C:\Users\Admin\AppData\Local\Temp\101C.exe
PID 1300 wrote to memory of 2776 N/A N/A C:\Users\Admin\AppData\Local\Temp\101C.exe
PID 1300 wrote to memory of 2776 N/A N/A C:\Users\Admin\AppData\Local\Temp\101C.exe
PID 992 wrote to memory of 864 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 992 wrote to memory of 864 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 992 wrote to memory of 864 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 992 wrote to memory of 864 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1300 wrote to memory of 2352 N/A N/A C:\Users\Admin\AppData\Local\Temp\14AF.exe
PID 1300 wrote to memory of 2352 N/A N/A C:\Users\Admin\AppData\Local\Temp\14AF.exe
PID 1300 wrote to memory of 2352 N/A N/A C:\Users\Admin\AppData\Local\Temp\14AF.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe

"C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 52

C:\Users\Admin\AppData\Local\Temp\ECBF.exe

C:\Users\Admin\AppData\Local\Temp\ECBF.exe

C:\Users\Admin\AppData\Local\Temp\EF5F.exe

C:\Users\Admin\AppData\Local\Temp\EF5F.exe

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\F02B.bat" "

C:\Users\Admin\AppData\Local\Temp\F3E3.exe

C:\Users\Admin\AppData\Local\Temp\F3E3.exe

C:\Users\Admin\AppData\Local\Temp\14C.exe

C:\Users\Admin\AppData\Local\Temp\14C.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 48

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 48

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Users\Admin\AppData\Local\Temp\101C.exe

C:\Users\Admin\AppData\Local\Temp\101C.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\14AF.exe

C:\Users\Admin\AppData\Local\Temp\14AF.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\178D.exe

C:\Users\Admin\AppData\Local\Temp\178D.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\1C8E.exe

C:\Users\Admin\AppData\Local\Temp\1C8E.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\20A4.exe

C:\Users\Admin\AppData\Local\Temp\20A4.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\2B8D.exe

C:\Users\Admin\AppData\Local\Temp\2B8D.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\36C5.exe

C:\Users\Admin\AppData\Local\Temp\36C5.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 36

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\62F4.exe

C:\Users\Admin\AppData\Local\Temp\62F4.exe

C:\Windows\system32\taskeng.exe

taskeng.exe {B8D2F158-9585-4778-84A0-B67E5A8C6FC9} S-1-5-21-3185155662-718608226-894467740-1000:YETUIZPU\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:668676 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Network

Country Destination Domain Proto
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 www.facebook.com udp
RU 5.42.65.80:80 5.42.65.80 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
BG 171.22.28.213:80 171.22.28.213 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
FI 77.91.124.1:80 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 facebook.com udp
GB 157.240.221.35:443 facebook.com tcp
GB 157.240.221.35:443 facebook.com tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
GB 157.240.221.35:443 fbsbx.com tcp
GB 157.240.221.35:443 fbsbx.com tcp
FI 77.91.124.1:80 77.91.124.1 tcp
MD 176.123.9.142:37637 tcp
IT 185.196.9.65:80 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 85.209.176.171:80 85.209.176.171 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
TR 185.216.70.238:37515 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 accounts.youtube.com udp
NL 142.250.179.206:443 accounts.youtube.com tcp
NL 142.250.179.206:443 accounts.youtube.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp

Files

memory/2024-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2024-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2024-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2024-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2024-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2024-6-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1300-5-0x0000000002A00000-0x0000000002A16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ECBF.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

C:\Users\Admin\AppData\Local\Temp\ECBF.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

C:\Users\Admin\AppData\Local\Temp\EF5F.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\EF5F.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\F02B.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\F3E3.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

C:\Users\Admin\AppData\Local\Temp\F02B.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\F3E3.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

C:\Users\Admin\AppData\Local\Temp\14C.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\14C.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

\Users\Admin\AppData\Local\Temp\ECBF.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

\Users\Admin\AppData\Local\Temp\EF5F.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\EF5F.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\EF5F.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\EF5F.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\F3E3.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

\Users\Admin\AppData\Local\Temp\F3E3.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

\Users\Admin\AppData\Local\Temp\F3E3.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\101C.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\101C.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\F3E3.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

C:\Users\Admin\AppData\Local\Temp\14AF.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\178D.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\178D.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

memory/2080-143-0x0000000000230000-0x000000000028A000-memory.dmp

memory/2080-142-0x0000000000400000-0x000000000046F000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\1C8E.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\1C8E.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\20A4.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/2832-177-0x0000000000AF0000-0x0000000000C48000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/2832-179-0x0000000000AF0000-0x0000000000C48000-memory.dmp

memory/2352-181-0x00000000003F0000-0x00000000003F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2B8D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\2B8D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/1936-192-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1936-187-0x0000000000080000-0x00000000000BE000-memory.dmp

memory/1936-183-0x0000000000080000-0x00000000000BE000-memory.dmp

memory/2832-194-0x0000000000AF0000-0x0000000000C48000-memory.dmp

memory/1936-196-0x0000000000080000-0x00000000000BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\36C5.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

memory/1936-198-0x0000000000080000-0x00000000000BE000-memory.dmp

memory/2400-201-0x0000000000230000-0x000000000028A000-memory.dmp

memory/2400-203-0x0000000000400000-0x000000000046F000-memory.dmp

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\36C5.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\14AF.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\178D.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/1036-222-0x0000000000060000-0x00000000000BA000-memory.dmp

memory/1204-221-0x00000000000A0000-0x00000000000BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\62F4.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

\Users\Admin\AppData\Local\Temp\62F4.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

memory/1948-227-0x0000000001000000-0x000000000100A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab78A9.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

C:\Users\Admin\AppData\Local\Temp\Tar8C1E.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ac25e946e73a725070d35e073c7975d
SHA1 860f5812652438b9373671d568b8c9540de61a88
SHA256 cd60f396b1314b09feb6fb96b356b868bddffcd3ebabfe4d44485b70c0e8a1c4
SHA512 2016bcb7ef5c2f25e1cc4fed64bd56211e9bde523aa1508bce828543a4fe59180aa024d5c5b6a1d4c9960e2700267bc9b33183bf7cc5aa4e81e59ab3ae5001ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ddb39e31fc3489435ded917d112c0081
SHA1 11a4e9affb39f50f80119d96d21ea9279b99ede5
SHA256 275458cac3164ff90fb14f90f50b2cf0ad207f823fb7ba92428072d7c1417547
SHA512 f8cfc654949b9548d0017000420fe19b54cf983e48c384f2ba5e051d4702baa95ca92fcf27ffc73f58a1f4324376d5d338efea47ef228a882d103c7acb562cde

memory/1948-319-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

memory/2252-320-0x000000013F9E0000-0x000000013FCDF000-memory.dmp

memory/2080-330-0x00000000715B0000-0x0000000071C9E000-memory.dmp

memory/2252-331-0x000000013F9E0000-0x000000013FCDF000-memory.dmp

memory/1936-332-0x00000000715B0000-0x0000000071C9E000-memory.dmp

memory/2252-333-0x000000013F9E0000-0x000000013FCDF000-memory.dmp

memory/1036-334-0x00000000715B0000-0x0000000071C9E000-memory.dmp

memory/1936-335-0x0000000004B50000-0x0000000004B90000-memory.dmp

memory/1036-336-0x0000000004960000-0x00000000049A0000-memory.dmp

memory/2080-337-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2080-345-0x0000000004850000-0x0000000004890000-memory.dmp

memory/1204-344-0x00000000715B0000-0x0000000071C9E000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

memory/2252-369-0x000000013F9E0000-0x000000013FCDF000-memory.dmp

memory/2080-370-0x00000000715B0000-0x0000000071C9E000-memory.dmp

memory/1948-371-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

memory/1936-372-0x00000000715B0000-0x0000000071C9E000-memory.dmp

memory/1936-374-0x0000000004B50000-0x0000000004B90000-memory.dmp

memory/1204-376-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

memory/1036-375-0x0000000004960000-0x00000000049A0000-memory.dmp

memory/1036-373-0x00000000715B0000-0x0000000071C9E000-memory.dmp

memory/1204-391-0x00000000715B0000-0x0000000071C9E000-memory.dmp

memory/2080-392-0x0000000004850000-0x0000000004890000-memory.dmp

memory/2084-393-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2084-395-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2084-396-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2084-398-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2084-399-0x0000000000080000-0x00000000000B3000-memory.dmp

memory/2252-400-0x000000013F9E0000-0x000000013FCDF000-memory.dmp

memory/1948-401-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

memory/2252-402-0x000000013F9E0000-0x000000013FCDF000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eb081df2b4671df0a0c244fd3e143d9a
SHA1 72de6636d9ac90aa0b15d88aa1aa1a78657c40f0
SHA256 1484e6d756e1b658df3d2e4c683fab7b17bb4a995bbab61174ccd0751599fbdd
SHA512 30d522ba3effa9bb07cbfee01849fb43068e5993152c9f9564f739283309e8911649dd140e9735c0c33c35e3c4ce0673b34c8dffc5bc38b476fed2f8ad6db533

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 23581cd0d63fc759811726e56c51eda9
SHA1 06afe97bfe6b4e58bb8a7a6c0a5af545bbb13fd3
SHA256 363b71bc9bfa3e09fb58f16dcc2f35d08e0e6a1cf9b9cc886b2472b209e1f169
SHA512 4621797a6cd2a989f049963009c8a1fbbf038011fb1900687bb3ba6cb9b9499edd204171a29189652afd0b773108432062f0d44af123436ee4d01ad7dbbc523f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2a3daad5853f7eb614bc55b0461f0e91
SHA1 24e7de943974830df928496d5bf386bfc0ac1686
SHA256 571a13027e72c0167143eb34d30e180ef01a78b019a3722853334f9df0439ae9
SHA512 d661b3aebd8c2020956f91281cb3a1cc8692548f2b3181ea2fb9f38533f02e5be07e87cab6f8ecc932ffaa464f9519595e7611317ea05d196dca1615e8d5889d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0de9b2982eb329bb15a3aad6d3c263ed
SHA1 b9edb2ec871ebb30610e166486bba448da9f17d5
SHA256 d791b58f2256c3db128d91189864e57aa54a4b9b590cc4f2aff2c3870e4440c6
SHA512 efb46e7aaf9a166b168993c1dde9db497f814022eabd59392b20522fe5ce28daa7f067df45be9dc896a3944131eea4443400dc646f3b3c542f2fccf2548b4fe7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7ec0a71b1efb045de17df1f1e29262ad
SHA1 13aaca86981073b7d1cc37ab44063c3681c3804e
SHA256 ba934847a36d1469d6947ba3af262042e87b04c1aee43721373f91a4d7cd893f
SHA512 404b67c273787ab8c83c57b13537330d6012fd5382c2c626e469355b2ecf9a0c246bd14d283521346390a81dc588604c132a2ecb47a41ae9d69b2d3fdeb4405b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e802f5ce51f6c61bf2bf1bf902b82a64
SHA1 7d789caa29f0012ec742174ef6897b507574dd99
SHA256 66eaf8b0770d191a593a041291f75d1fe496ecee186e892c9b2f090f55d86f62
SHA512 b6a8b0287292f1ebc810208333d1720aaeac3b7078018f8f6b1730300459e989509d1569e1d06bdfc2c860ea9dd4033edcf774bee555953f8b134656a018df05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 648d2169464c68734238b6fe615a3a24
SHA1 e26adbe777d29a3b6f16c08db05b9a01faeb6b55
SHA256 6837ed39c5cd2d4ac8e57559a12f0a9584a7c4aa12c840f781a26b73eb32410e
SHA512 d418ae46777368cf0a66e89fb7452e831163a4ecf9253eda956210ffd743f9b67014ec3fa382a9844c81d6f9c6113b2068e4425717160b8a8cdac9d1e5f0ab73

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2c7d2e8123aec7689b432d135bf99858
SHA1 bb25d99fe597bc5e5cbfc4fcc16ef7b053915177
SHA256 2affed1b674c62558fa862a5125814a797ebe1aa3115f8bc9b66fe7fb580c007
SHA512 df2e9557c84d02d2c5f34f1fb6899dd29aa752ad10d8a199041205d92a5599acd870a048e9f853f73bf2f5648ec49a7d3b2e8999db28f9b38776f90137077982

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c952894c57f0c4f800dcd7829d836350
SHA1 1e0d4474ba8f1ec63102d3d3e8731e86c63226c5
SHA256 ff3b116fe7617a580b9811110a213cc2e4051c9686009065e51f50ce34bfca8a
SHA512 44344cf8982cb926577dbcb0fa537a30f21b70651a4999a05ea9df4c069f5474d58088a6b97edf46cc505baec72eb0b1f668afe52bac85c6126de23cf3bba3ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 424c4c6c6cabdd6308f295c31e423a0d
SHA1 b0d21139ef5d87f6e6300dc40278edb98270fe4a
SHA256 dc5ab3dfe8d9488fe2b4e71175261ef1ad63a40f93bd6627e6885e7c31e881f7
SHA512 94fd82bce76edad486e06dc417207743243042e995fd12e93f844d7830834b347fb4179ed209bdfa0bdd2321cc3c8c7e4656656b0b0a8b57b92ffd720f1ae611

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

memory/1204-945-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3UYVU6FI\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O3E62B0W\favicon[2].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-11 20:27

Reported

2023-10-12 15:14

Platform

win10v2004-20230915-en

Max time kernel

114s

Max time network

164s

Command Line

"C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\5090.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\5090.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\5090.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\5090.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\5090.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\5090.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\52B4.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5620.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\5090.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\45CE.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A

Checks installed software on the system

discovery

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5090.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5620.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4092 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4092 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4092 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4092 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4092 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4092 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3160 wrote to memory of 3000 N/A N/A C:\Users\Admin\AppData\Local\Temp\45CE.exe
PID 3160 wrote to memory of 3000 N/A N/A C:\Users\Admin\AppData\Local\Temp\45CE.exe
PID 3160 wrote to memory of 3000 N/A N/A C:\Users\Admin\AppData\Local\Temp\45CE.exe
PID 3160 wrote to memory of 4220 N/A N/A C:\Users\Admin\AppData\Local\Temp\4B2E.exe
PID 3160 wrote to memory of 4220 N/A N/A C:\Users\Admin\AppData\Local\Temp\4B2E.exe
PID 3160 wrote to memory of 4220 N/A N/A C:\Users\Admin\AppData\Local\Temp\4B2E.exe
PID 3160 wrote to memory of 888 N/A N/A C:\Windows\system32\cmd.exe
PID 3160 wrote to memory of 888 N/A N/A C:\Windows\system32\cmd.exe
PID 3160 wrote to memory of 2644 N/A N/A C:\Users\Admin\AppData\Local\Temp\4EDA.exe
PID 3160 wrote to memory of 2644 N/A N/A C:\Users\Admin\AppData\Local\Temp\4EDA.exe
PID 3160 wrote to memory of 2644 N/A N/A C:\Users\Admin\AppData\Local\Temp\4EDA.exe
PID 3160 wrote to memory of 1164 N/A N/A C:\Users\Admin\AppData\Local\Temp\5090.exe
PID 3160 wrote to memory of 1164 N/A N/A C:\Users\Admin\AppData\Local\Temp\5090.exe
PID 888 wrote to memory of 3744 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 888 wrote to memory of 3744 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3160 wrote to memory of 3792 N/A N/A C:\Users\Admin\AppData\Local\Temp\52B4.exe
PID 3160 wrote to memory of 3792 N/A N/A C:\Users\Admin\AppData\Local\Temp\52B4.exe
PID 3160 wrote to memory of 3792 N/A N/A C:\Users\Admin\AppData\Local\Temp\52B4.exe
PID 3160 wrote to memory of 1860 N/A N/A C:\Users\Admin\AppData\Local\Temp\5620.exe
PID 3160 wrote to memory of 1860 N/A N/A C:\Users\Admin\AppData\Local\Temp\5620.exe
PID 3160 wrote to memory of 1860 N/A N/A C:\Users\Admin\AppData\Local\Temp\5620.exe
PID 3160 wrote to memory of 4996 N/A N/A C:\Users\Admin\AppData\Local\Temp\5844.exe
PID 3160 wrote to memory of 4996 N/A N/A C:\Users\Admin\AppData\Local\Temp\5844.exe
PID 3160 wrote to memory of 4996 N/A N/A C:\Users\Admin\AppData\Local\Temp\5844.exe
PID 3160 wrote to memory of 2652 N/A N/A C:\Users\Admin\AppData\Local\Temp\593F.exe
PID 3160 wrote to memory of 2652 N/A N/A C:\Users\Admin\AppData\Local\Temp\593F.exe
PID 3160 wrote to memory of 2652 N/A N/A C:\Users\Admin\AppData\Local\Temp\593F.exe
PID 3160 wrote to memory of 3880 N/A N/A C:\Users\Admin\AppData\Local\Temp\5D09.exe
PID 3160 wrote to memory of 3880 N/A N/A C:\Users\Admin\AppData\Local\Temp\5D09.exe
PID 3160 wrote to memory of 3880 N/A N/A C:\Users\Admin\AppData\Local\Temp\5D09.exe
PID 3000 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\45CE.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 3000 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\45CE.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 3000 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\45CE.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 3160 wrote to memory of 1328 N/A N/A C:\Users\Admin\AppData\Local\Temp\60A3.exe
PID 3160 wrote to memory of 1328 N/A N/A C:\Users\Admin\AppData\Local\Temp\60A3.exe
PID 3160 wrote to memory of 1328 N/A N/A C:\Users\Admin\AppData\Local\Temp\60A3.exe
PID 4860 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 4860 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 4860 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 3744 wrote to memory of 404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3744 wrote to memory of 404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3160 wrote to memory of 4432 N/A N/A C:\Users\Admin\AppData\Local\Temp\6400.exe
PID 3160 wrote to memory of 4432 N/A N/A C:\Users\Admin\AppData\Local\Temp\6400.exe
PID 3160 wrote to memory of 4432 N/A N/A C:\Users\Admin\AppData\Local\Temp\6400.exe
PID 560 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 560 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 560 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 2328 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2328 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2328 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 4220 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\4B2E.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4220 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\4B2E.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4220 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\4B2E.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 888 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 888 wrote to memory of 4360 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 2384 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4220 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\4B2E.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe

"C:\Users\Admin\AppData\Local\Temp\75da61b3e9dee861137ba25a9cff4f1b0c165eae9b0e3b3343eaabd7b0d7d84a.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4092 -ip 4092

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 240

C:\Users\Admin\AppData\Local\Temp\45CE.exe

C:\Users\Admin\AppData\Local\Temp\45CE.exe

C:\Users\Admin\AppData\Local\Temp\4B2E.exe

C:\Users\Admin\AppData\Local\Temp\4B2E.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4C48.bat" "

C:\Users\Admin\AppData\Local\Temp\4EDA.exe

C:\Users\Admin\AppData\Local\Temp\4EDA.exe

C:\Users\Admin\AppData\Local\Temp\5090.exe

C:\Users\Admin\AppData\Local\Temp\5090.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\52B4.exe

C:\Users\Admin\AppData\Local\Temp\52B4.exe

C:\Users\Admin\AppData\Local\Temp\5620.exe

C:\Users\Admin\AppData\Local\Temp\5620.exe

C:\Users\Admin\AppData\Local\Temp\5844.exe

C:\Users\Admin\AppData\Local\Temp\5844.exe

C:\Users\Admin\AppData\Local\Temp\593F.exe

C:\Users\Admin\AppData\Local\Temp\593F.exe

C:\Users\Admin\AppData\Local\Temp\5D09.exe

C:\Users\Admin\AppData\Local\Temp\5D09.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Users\Admin\AppData\Local\Temp\60A3.exe

C:\Users\Admin\AppData\Local\Temp\60A3.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\6400.exe

C:\Users\Admin\AppData\Local\Temp\6400.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffad23f46f8,0x7ffad23f4708,0x7ffad23f4718

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad23f46f8,0x7ffad23f4708,0x7ffad23f4718

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4220 -ip 4220

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 252

C:\Users\Admin\AppData\Local\Temp\6F6B.exe

C:\Users\Admin\AppData\Local\Temp\6F6B.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2644 -ip 2644

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7682663187916603712,15519625204566947775,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7682663187916603712,15519625204566947775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5068 -ip 5068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1224 -ip 1224

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 564

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 540

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5844.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad23f46f8,0x7ffad23f4708,0x7ffad23f4718

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5844.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad23f46f8,0x7ffad23f4708,0x7ffad23f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15370768668096780920,4902300512006490477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 183.2.85.104.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 mdec.nelreports.net udp
NL 84.53.175.67:443 mdec.nelreports.net tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
NL 157.240.247.8:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 8.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
GB 157.240.221.35:443 facebook.com tcp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.67:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 mscom.demdex.net udp
IE 34.251.64.143:443 mscom.demdex.net tcp
US 8.8.8.8:53 143.64.251.34.in-addr.arpa udp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 target.microsoft.com udp
IT 185.196.9.65:80 tcp
BG 171.22.28.202:16706 tcp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
US 20.189.173.13:443 browser.events.data.microsoft.com tcp
US 20.189.173.13:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 65.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 202.28.22.171.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
TR 185.216.70.238:37515 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 238.70.216.185.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
NL 142.251.36.14:443 play.google.com udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
NL 84.53.175.67:443 mdec.nelreports.net tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4236-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4236-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3160-2-0x0000000003640000-0x0000000003656000-memory.dmp

memory/4236-3-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\45CE.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

C:\Users\Admin\AppData\Local\Temp\45CE.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

C:\Users\Admin\AppData\Local\Temp\4B2E.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\4B2E.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\4C48.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\4EDA.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

C:\Users\Admin\AppData\Local\Temp\4EDA.exe

MD5 b44d189558c43ec513980110f73d62e1
SHA1 adb31ccec38074f773245b280bff2eb977263d01
SHA256 94feb8d4f372c9e40fd618767d6becfdd98c0dd911f42e9c71962ba6cbc79e77
SHA512 c27244fd75e9935b4b872ed1e5bc8ffd5debfd3737632e323badc09a02067e060db8f33e184f6f90ed85a2942e4e6ae2a9a2df8fa684ec7c99d872426b76dc6f

C:\Users\Admin\AppData\Local\Temp\5090.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\5090.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/1164-30-0x0000000000910000-0x000000000091A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\52B4.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\52B4.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\5620.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\5620.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\5844.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\5844.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\593F.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/1164-50-0x00007FFAD11E0000-0x00007FFAD1CA1000-memory.dmp

memory/4996-51-0x0000000000400000-0x000000000046F000-memory.dmp

memory/4996-55-0x0000000002070000-0x00000000020CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5D09.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/3880-63-0x0000000000CD0000-0x0000000000E28000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\5D09.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

C:\Users\Admin\AppData\Local\Temp\593F.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Temp\60A3.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\60A3.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\6400.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\6400.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

memory/1328-97-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

memory/1328-98-0x0000000002070000-0x00000000020CA000-memory.dmp

memory/3880-106-0x0000000000CD0000-0x0000000000E28000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 451fddf78747a5a4ebf64cabb4ac94e7
SHA1 6925bd970418494447d800e213bfd85368ac8dc9
SHA256 64d12f59d409aa1b03f0b2924e0b2419b65c231de9e04fce15cc3a76e1b9894d
SHA512 edb85a2a94c207815360820731d55f6b4710161551c74008df0c2ae10596e1886c8a9e11d43ddf121878ae35ac9f06fc66b4c325b01ed4e7bf4d3841b27e0864

memory/4672-110-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4672-112-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4672-111-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

memory/4672-115-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6F6B.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

memory/4784-129-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3880-134-0x0000000000CD0000-0x0000000000E28000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\??\pipe\LOCAL\crashpad_4360_JWLMBLTYTSAYRTAS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1164-150-0x00007FFAD11E0000-0x00007FFAD1CA1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

memory/1816-156-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0b03b3e8741d38b8c4172cb2350fc7f3
SHA1 00011f5bf0f2337ed190058758981a30edd564e0
SHA256 f770aa7f41039b42d2300f8c61fdacce79ebe3293342d103ace0506f36b32e01
SHA512 5d9287770c42aaa46d651f568b142bf55eb35a319dfd670ab3a2792366956cc03f563a1686422dd83355475cff04af8ff55563f64aa74a77e769c675691cd142

\??\pipe\LOCAL\crashpad_3744_SRYZWYEMOLZKZMCQ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5f50c7f86e68a4b49c18164bdab6458f
SHA1 d6a7028361cc5eaf97f3a4b30da03ddd7f2ebea4
SHA256 84501805b5ebdd9661a117063e9bc2e73065784e4686e93068dda87437ae71dd
SHA512 2d166b9170a7b89c0db79fe613f0f69c2606d247459d1f6e5f9c18037e0ad113917e25f2f6613dda1c6a11a4c2d173137a3734be3354ec4d7bf120db29c79fee

memory/1164-194-0x00007FFAD11E0000-0x00007FFAD1CA1000-memory.dmp

memory/2652-195-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/4432-196-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/1816-197-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/1328-200-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/4784-201-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/4672-207-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1224-210-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1224-209-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1224-212-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4488-213-0x00007FF7D32A0000-0x00007FF7D359F000-memory.dmp

memory/4432-215-0x00000000006E0000-0x000000000073A000-memory.dmp

memory/2652-214-0x0000000000810000-0x000000000082E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1ea77ea59c19115d1e8b7e635c4fd008
SHA1 75ef63495f78baa5a2b4c47f0538828405621b15
SHA256 00f41b36a57fa11550bf56500fe6c2724e351c415bc1d8def8d00f629216f175
SHA512 8368572a516ed3d241aef5684fa0656a62e3e869131389fa84084ba2de72e0625ec38cc26ae2ca983797bdefa1505af5008ae8620085fea4f199d2c5d6813ec7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 0b03b3e8741d38b8c4172cb2350fc7f3
SHA1 00011f5bf0f2337ed190058758981a30edd564e0
SHA256 f770aa7f41039b42d2300f8c61fdacce79ebe3293342d103ace0506f36b32e01
SHA512 5d9287770c42aaa46d651f568b142bf55eb35a319dfd670ab3a2792366956cc03f563a1686422dd83355475cff04af8ff55563f64aa74a77e769c675691cd142

memory/1532-225-0x0000000001000000-0x0000000001033000-memory.dmp

memory/4488-226-0x00007FF7D32A0000-0x00007FF7D359F000-memory.dmp

memory/1532-228-0x0000000001000000-0x0000000001033000-memory.dmp

memory/1532-227-0x0000000001000000-0x0000000001033000-memory.dmp

memory/1532-230-0x0000000001000000-0x0000000001033000-memory.dmp

memory/1532-229-0x0000000001000000-0x0000000001033000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8f6a646b91dbbcf0eaed0e489607e800
SHA1 6e33802e4898c88e18c0a25d1c50ed3a96aa1c91
SHA256 9fdea6be9af6cc6ec64cb9c2330ea6f89fa9e77b59a91fd97a5fc08885c8df7c
SHA512 dd284f7b858c8853e6493bd3cdca7f647c6b105f3599245c354270cac3d7d47d018a014a1c6261597c319c19f332bcb53e86cf665b75d7b6bec17f82469cff0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

memory/4784-256-0x0000000007D10000-0x00000000082B4000-memory.dmp

memory/2652-257-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/4432-258-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/1816-259-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/1328-260-0x0000000072BE0000-0x0000000073390000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

MD5 0e3b0fb5f1507fb187e678cc24ed088f
SHA1 b34a2460545e5fee0e256d157c8a89150e7f8fc4
SHA256 c22cb222976ee0b1f8bd96b1f10154e1285e354b4481961036c2392c456f94b2
SHA512 ee9f6aa0a5e9f9637d9f0ed9d493bc52d9cd711ab32ed84ef29c919744afeb191b83b94990b673d20f83111365f789cb2f5233dfc60281714ebe950231f2cd51

memory/4784-264-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/1876-265-0x0000000072BE0000-0x0000000073390000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

MD5 0e3b0fb5f1507fb187e678cc24ed088f
SHA1 b34a2460545e5fee0e256d157c8a89150e7f8fc4
SHA256 c22cb222976ee0b1f8bd96b1f10154e1285e354b4481961036c2392c456f94b2
SHA512 ee9f6aa0a5e9f9637d9f0ed9d493bc52d9cd711ab32ed84ef29c919744afeb191b83b94990b673d20f83111365f789cb2f5233dfc60281714ebe950231f2cd51

memory/1876-266-0x0000000000BA0000-0x0000000000BDE000-memory.dmp

memory/4432-267-0x00000000075F0000-0x0000000007682000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/2652-284-0x0000000005810000-0x0000000005E28000-memory.dmp

memory/2652-287-0x00000000051F0000-0x0000000005202000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dedd7c0dca1809ebee6765a8adc8070b
SHA1 7e3b9ddca89c435bab6e545cf0de0dc1abe15e74
SHA256 fb57ed09f6422cc3ca53b6f8bdaf73c8c92e9dfc75d6126b8d8e68ce23002a5c
SHA512 1011ffa194f8773d031a0161140e3dc4602d379a71f31ca83d5ea947ac545ebeafed62408c9a0a3070e79b48b956ce7b72a92f14950cb09389dbd9ba67629a8c

memory/2652-374-0x0000000005250000-0x000000000528C000-memory.dmp

memory/4432-382-0x00000000075A0000-0x00000000075B0000-memory.dmp

memory/4784-380-0x00000000078C0000-0x00000000078D0000-memory.dmp

memory/1876-381-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

memory/1816-379-0x0000000005800000-0x0000000005810000-memory.dmp

memory/1328-378-0x00000000076B0000-0x00000000076C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d044cdbb8f8b7f5e458f70677ae48a7f
SHA1 8d9133ea5a2b1f1d25190a845d347d8a6f522e66
SHA256 5cff8eb83c7fd2f75125f4ac2ac3c28fb7e0e94aa8a443becb7f0007a5342cfd
SHA512 cd38a6678048bbd83690f654b175f509b0eb77f98c9a9c00b384fc90245745caa3f9f2c709401935a9ed41b959f461ac828098a73382c70b6ad01cdf9fbaf206

memory/2652-414-0x00000000051E0000-0x00000000051F0000-memory.dmp

memory/1876-413-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/2652-415-0x0000000005290000-0x00000000052DC000-memory.dmp

memory/1876-416-0x0000000007A20000-0x0000000007A2A000-memory.dmp

memory/1328-417-0x0000000007E50000-0x0000000007F5A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ed0b6902be3ee0635f4e79a36311950d
SHA1 fd57568775695cebe0bc13de39d9b3061fec27d9
SHA256 0ddb8f4d3d08d96298db9880c5841a60e4355540434e4fb8d8b83b6718fb27e2
SHA512 b4d7becf67271eed3afafbfe807a2b7985e97ebb44a4d08d1f656058444cbd96db73637d3c26952419054e2733e0c389bf8e778ec624c5f213f2a501a4d32ff3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58eab9.TMP

MD5 1884e9c22debf7630f9d14f4b3f09198
SHA1 e460f284ce50c7e303d1825eb3956d7fa51fb698
SHA256 a23632c526313522889afc3166f8df0898e2af09e690ed7c998f1b9e83fbd287
SHA512 cbb573e617d230787ee3d581538d4d7251f1a757553ee64e430168b68d828c3214bb132f8dd46771df5e39f9f6e4ace2d496cb2e00f842d59a3c33e0f7d7a2ef

memory/1876-437-0x0000000007AC0000-0x0000000007AD0000-memory.dmp

memory/4432-438-0x00000000075A0000-0x00000000075B0000-memory.dmp

memory/4784-436-0x00000000078C0000-0x00000000078D0000-memory.dmp

memory/1816-435-0x0000000005800000-0x0000000005810000-memory.dmp

memory/1328-434-0x00000000076B0000-0x00000000076C0000-memory.dmp

memory/2652-457-0x00000000051E0000-0x00000000051F0000-memory.dmp

memory/4432-472-0x0000000008430000-0x0000000008496000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 36b6b55b7bc78f2e8bcc749c67725f45
SHA1 1610d85b7e29b4af5e297fa83d6884c9644077d9
SHA256 27cd3235aaff3d536e74a4679a88a9c99c03047363f90eb8838dc1502274cea2
SHA512 c9be7fd52bc78000d93f5e583faf33d7887941f37f213c9dde643ee064a3298b2adb8d82b7ac2e28a0745155f505b8a6740fd9f32317049c9d3b679134f8d076

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dc156a4b597a16e0e5fca2ea1c6f9c62
SHA1 c2e36716d932c245a62203c6897f7514165bdb18
SHA256 4018a688b3abb2f207018addf6bd36580f4b446475beb91b6720b5b3993b8331
SHA512 798a49946cc53530c96ed8043b33218654774037908bf29bee8e71504fbfcc45c0ce6600e640938f24d4bcb5bf9e2a028653bd34b3c19d9b3e8733f553956d85

memory/2652-503-0x0000000006680000-0x0000000006842000-memory.dmp

memory/2652-513-0x0000000006D80000-0x00000000072AC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 fc86c9d9cda28eef633101f4ec9e5498
SHA1 bac8b4979765e6dd7fa6f37d58823aab849a46b0
SHA256 625500bd5c78ddcbfbb18e0983ac0d18ec5f0dec8a80f85beb357d751a1c8d64
SHA512 50f6b42dac193e2b3f2c35755bc5a82a643283715337ec23ac5ac8a4d47383ee3aaa402a9d7ad368c36f08c5ecbc5d60832a442e2a2c1fb4dd057a35bdef0aa1

memory/2652-519-0x0000000006BD0000-0x0000000006C46000-memory.dmp

memory/2652-520-0x0000000006D50000-0x0000000006D6E000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Temp\tmp8312.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp8347.tmp

MD5 5b39e7698deffeb690fbd206e7640238
SHA1 327f6e6b5d84a0285eefe9914a067e9b51251863
SHA256 53209f64c96b342ff3493441cefa4f49d50f028bd1e5cc45fe1d8b4c9d9a38f8
SHA512 f1f9bc156af008b9686d5e76f41c40e5186f563f416c73c3205e6242b41539516b02f62a1d9f6bcc608ccde759c81def339ccd1633bc8acdd6a69dc4a6477cc7

C:\Users\Admin\AppData\Local\Temp\tmp85B4.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp85D9.tmp

MD5 613cfe1a1d8465129d67068e306964cf
SHA1 79ee3163d77ffdef0e5ae0b36aaa42c25189bd14
SHA256 b686eaa5387efbb527262e6dd9d290fd53a38165a790acb0359439bbb63bfa2b
SHA512 4484c70eb63bba3b58e2807786f2cbfee0ffdad71e89fb4cec4fab700a5ffdcd66761a357883bb64467d9da5b5ab630f3637d0d3273c7ef58b162e6006f75c62

memory/2652-625-0x0000000007E60000-0x0000000007EB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp886C.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp88A6.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/4432-717-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/1328-718-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/4784-721-0x0000000072BE0000-0x0000000073390000-memory.dmp

memory/2652-722-0x0000000072BE0000-0x0000000073390000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 6811da2e84e78b4821439f68f634a001
SHA1 e9649c28366a32aeb27442d7838564874f204e12
SHA256 1c10e87eb73a4daefea1b28deb317ade65d29f649a95d35387c032abeda23429
SHA512 6d487c1f6cdf1e28c820216904c73c31d1ed9822d418ee38b75d7337dbf1953cd644fe4871db8ccd731b08c5c7376e76982f5a1915ec6cb5176f11f62b1bd3e1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a70125b5e192418420433d1c6af1081c
SHA1 85b5c9ce959dc51fa16b8120b9df8ce9090b587e
SHA256 f3b73d0b56d8ad5b6a4bd21aa8c4ff0d842bfa5ce7ff872912bd6ba3876bd0bb
SHA512 038ff06300d2c519efa0a17954c2ac08968f34f0f886e8393c8313bbc0fad4fbd0a18cac43a4a4a4fdbf0341e43406695eab22c98addc4d74ecc45e1326bc8f1