Malware Analysis Report

2025-08-10 23:43

Sample ID 231011-y9ldlade84
Target abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5
SHA256 abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5
Tags
amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan breha kukish microsoft
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5

Threat Level: Known bad

The file abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5 was found to be: Known bad.

Malicious Activity Summary

amadey dcrat healer redline sectoprat smokeloader @ytlogsbot pixelscloud backdoor google discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan breha kukish microsoft

RedLine payload

SectopRAT

Healer

Modifies Windows Defender Real-time Protection settings

SmokeLoader

Amadey

Detects Healer an antivirus disabler dropper

RedLine

Detected google phishing page

SectopRAT payload

DcRat

Downloads MZ/PE file

Executes dropped EXE

Windows security modification

Uses the VBS compiler for execution

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Detected potential entity reuse from brand microsoft.

Program crash

Enumerates physical storage devices

Enumerates system info in registry

Suspicious use of UnmapMainImage

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Modifies Internet Explorer settings

Suspicious use of SetWindowsHookEx

Uses Task Scheduler COM API

Suspicious use of FindShellTrayWindow

Modifies system certificate store

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-11 20:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-11 20:29

Reported

2023-10-12 15:20

Platform

win7-20230831-en

Max time kernel

195s

Max time network

198s

Command Line

"C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detected google phishing page

phishing google

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4974.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4C43.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\DE6D.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a7140000000000200000000001066000000010000200000000b5ef4444266eecab8d6e48b0798f07f30cad8b8992aeb5ae0d34ff606d5b218000000000e8000000002000020000000aca512672510fdb65a0a45ffd2ada23ca9595518f4c70e5ae41a4cbf6780a86f90000000b57b6ef2c5ba0b9c8189ef4aa3e1578b8f73080647213112ab5d336fad095f0fd3572eafb9e3cd61890048359fc065681c448d8551be9708fd4b05736b5230a041ad0efab259d4a95eb7322cde3f9f9128dd1c964b635e1fc974fed7c59a3058b090663d788bbae9bda222d26692c4dd8e1f720685ae589aa68bae7afbd68c5cafc6ed0d318dc17af00543fe13a85cbd40000000892c68260df52731639a6746dba3a16b2d0133850676326ee08737155b2cf4908aad6a0a89d66edb4d0939f54d2fc54b732d7ea32cce8d2c16775cb7a8670188 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a8a3931ffdd901 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD8C1270-6912-11EE-9E19-FAEDD45E79E3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008c66dacf3255794896cbcb5ac20a714000000000020000000000106600000001000020000000bf0452f716c8af0406457f3b313539036ef28a601d8d8637ee171293878ad7bc000000000e800000000200002000000090b8e99d07999640ef4fc5cbe0133549677d7ef1976ecc64f655c62bbd7b4ca92000000047452d1b85c7aac27bec8bf496b6dde1deed63cf07987d302c76551a1651ce4940000000712ac32b26047cb2f047b5375f16d3d1decbccf776596606195fa39f67793966b30b1dbf8016a59de8c3398ae1c807a51e33bc1452569954795750d2fef4a179 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5C87651-6912-11EE-9E19-FAEDD45E79E3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Users\Admin\AppData\Local\Temp\5069.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Users\Admin\AppData\Local\Temp\5069.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2D6B.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5069.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\92F8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4EF2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\90B5.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4C43.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2624 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\SysWOW64\WerFault.exe
PID 2624 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\SysWOW64\WerFault.exe
PID 2624 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\SysWOW64\WerFault.exe
PID 2624 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\SysWOW64\WerFault.exe
PID 1256 wrote to memory of 2500 N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe
PID 1256 wrote to memory of 2500 N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe
PID 1256 wrote to memory of 2500 N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe
PID 1256 wrote to memory of 2500 N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe
PID 1256 wrote to memory of 2500 N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe
PID 1256 wrote to memory of 2500 N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe
PID 1256 wrote to memory of 2500 N/A N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe
PID 2500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2500 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\DE6D.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 2616 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2428 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 2428 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 2428 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 2428 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 2428 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 2428 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 2428 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 1256 wrote to memory of 2868 N/A N/A C:\Users\Admin\AppData\Local\Temp\EEB3.exe
PID 1256 wrote to memory of 2868 N/A N/A C:\Users\Admin\AppData\Local\Temp\EEB3.exe
PID 1256 wrote to memory of 2868 N/A N/A C:\Users\Admin\AppData\Local\Temp\EEB3.exe
PID 1256 wrote to memory of 2868 N/A N/A C:\Users\Admin\AppData\Local\Temp\EEB3.exe
PID 1256 wrote to memory of 1208 N/A N/A C:\Windows\system32\cmd.exe
PID 1256 wrote to memory of 1208 N/A N/A C:\Windows\system32\cmd.exe
PID 1256 wrote to memory of 1208 N/A N/A C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2840 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2840 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2840 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2840 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2840 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 2840 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe
PID 1972 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe
PID 1972 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe
PID 1972 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe
PID 1972 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe
PID 1972 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe
PID 1972 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe
PID 1972 wrote to memory of 2548 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe
PID 1208 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Program Files\Internet Explorer\iexplore.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe

"C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 52

C:\Users\Admin\AppData\Local\Temp\DE6D.exe

C:\Users\Admin\AppData\Local\Temp\DE6D.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Users\Admin\AppData\Local\Temp\EEB3.exe

C:\Users\Admin\AppData\Local\Temp\EEB3.exe

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\EFFC.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/login

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 48

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:340993 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 36

C:\Users\Admin\AppData\Local\Temp\12C.exe

C:\Users\Admin\AppData\Local\Temp\12C.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 48

C:\Users\Admin\AppData\Local\Temp\2D6B.exe

C:\Users\Admin\AppData\Local\Temp\2D6B.exe

C:\Users\Admin\AppData\Local\Temp\4974.exe

C:\Users\Admin\AppData\Local\Temp\4974.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\4C43.exe

C:\Users\Admin\AppData\Local\Temp\4C43.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\4EF2.exe

C:\Users\Admin\AppData\Local\Temp\4EF2.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\5069.exe

C:\Users\Admin\AppData\Local\Temp\5069.exe

C:\Users\Admin\AppData\Local\Temp\6E94.exe

C:\Users\Admin\AppData\Local\Temp\6E94.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Users\Admin\AppData\Local\Temp\90B5.exe

C:\Users\Admin\AppData\Local\Temp\90B5.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\92F8.exe

C:\Users\Admin\AppData\Local\Temp\92F8.exe

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Users\Admin\AppData\Local\Temp\A679.exe

C:\Users\Admin\AppData\Local\Temp\A679.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {1008B146-5FD2-4565-99F6-C192B04826E4} S-1-5-21-3513876443-2771975297-1923446376-1000:GPFFWLPI\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Roaming\eetsfwt

C:\Users\Admin\AppData\Roaming\eetsfwt

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

Network

Country Destination Domain Proto
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 www.facebook.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 facebook.com udp
GB 157.240.221.35:443 facebook.com tcp
GB 157.240.221.35:443 facebook.com tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
TR 185.216.70.222:80 185.216.70.222 tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
GB 157.240.221.35:443 fbsbx.com tcp
GB 157.240.221.35:443 fbsbx.com tcp
FI 77.91.68.29:80 77.91.68.29 tcp
BG 171.22.28.213:80 171.22.28.213 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
NL 157.240.201.35:443 www.facebook.com tcp
BG 171.22.28.202:16706 tcp
MD 176.123.9.142:37637 tcp
IT 185.196.9.65:80 tcp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 accounts.youtube.com udp
NL 142.250.179.206:443 accounts.youtube.com tcp
NL 142.250.179.206:443 accounts.youtube.com tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
TR 185.216.70.238:37515 tcp
US 104.26.13.31:443 api.ip.sb tcp
FI 77.91.124.1:80 77.91.124.1 tcp

Files

memory/2748-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2748-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2748-2-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2748-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2748-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2748-6-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1256-5-0x0000000003B10000-0x0000000003B26000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DE6D.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

C:\Users\Admin\AppData\Local\Temp\DE6D.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

\Users\Admin\AppData\Local\Temp\DE6D.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\EEB3.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

C:\Users\Admin\AppData\Local\Temp\EEB3.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\EFFC.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\EFFC.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\EEB3.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

\Users\Admin\AppData\Local\Temp\EEB3.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

\Users\Admin\AppData\Local\Temp\EEB3.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

\Users\Admin\AppData\Local\Temp\EEB3.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\12C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

C:\Users\Admin\AppData\Local\Temp\12C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A5C87651-6912-11EE-9E19-FAEDD45E79E3}.dat

MD5 0a9f87205f3bbf1eb051da8bf15b7862
SHA1 09f35a25c8258ea649bd9d380934afb077716377
SHA256 927f2ab208a5f8a125c2232816cec37dbcdf0097e3f40dc16a0df139a55d74ce
SHA512 46d974c1be7ce350fc8c59ca7280d1330c95efd52725608f82d782d87be1f5e3eedc5ab79e67603262faddfd09574d61b92bb729755745fc9af2da6f0e7f990e

\Users\Admin\AppData\Local\Temp\12C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

\Users\Admin\AppData\Local\Temp\12C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

\Users\Admin\AppData\Local\Temp\12C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

\Users\Admin\AppData\Local\Temp\12C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

C:\Users\Admin\AppData\Local\Temp\2D6B.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\2D6B.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\Cab48C5.tmp

MD5 f3441b8572aae8801c04f3060b550443
SHA1 4ef0a35436125d6821831ef36c28ffaf196cda15
SHA256 6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA512 5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

memory/2880-168-0x0000000001010000-0x000000000101A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar4964.tmp

MD5 9441737383d21192400eca82fda910ec
SHA1 725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256 bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA512 7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

C:\Users\Admin\AppData\Local\Temp\4974.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\4974.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f2c7667b83178d417ef2cbb5e09f4fa
SHA1 5a8481f6912c46753702c08e434f072488fc4853
SHA256 16aa66bd7b667065b6c04c38801d8c612e3dfc532878a5f7526facf1296c54ec
SHA512 cf7c3d4598f4ff737bd3c63559ea207371e5ce88adf60f25044d89ab4f4a1f6abfac90d804937cdc50adf709012af875ea9e8a85174fb2704f8865d03a9d06e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f2c7667b83178d417ef2cbb5e09f4fa
SHA1 5a8481f6912c46753702c08e434f072488fc4853
SHA256 16aa66bd7b667065b6c04c38801d8c612e3dfc532878a5f7526facf1296c54ec
SHA512 cf7c3d4598f4ff737bd3c63559ea207371e5ce88adf60f25044d89ab4f4a1f6abfac90d804937cdc50adf709012af875ea9e8a85174fb2704f8865d03a9d06e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d075fefafe358c0c9d4b73b7c4249c1
SHA1 d1740cb53d6e499384761240355653ce20d49e1a
SHA256 89f39bc937556d627e486b375d79053454df84c8c5363f3a0746b2764c41b2c8
SHA512 0337ff13ed2c2b641be02b75ceaff7f3bd84a20ef51db4731bf93078e09d67d93070a2dc6a09d7d5ab1682cc38685b9a4079615a05cb1b189cb438f266cd5b30

memory/2880-263-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d075fefafe358c0c9d4b73b7c4249c1
SHA1 d1740cb53d6e499384761240355653ce20d49e1a
SHA256 89f39bc937556d627e486b375d79053454df84c8c5363f3a0746b2764c41b2c8
SHA512 0337ff13ed2c2b641be02b75ceaff7f3bd84a20ef51db4731bf93078e09d67d93070a2dc6a09d7d5ab1682cc38685b9a4079615a05cb1b189cb438f266cd5b30

C:\Users\Admin\AppData\Local\Temp\4C43.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\4EF2.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\4EF2.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

memory/364-317-0x0000000000400000-0x000000000046F000-memory.dmp

memory/364-318-0x0000000000230000-0x000000000028A000-memory.dmp

memory/2596-331-0x0000000000340000-0x0000000000341000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5069.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Temp\5069.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/2880-338-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6E94.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

C:\Users\Admin\AppData\Local\Temp\4C43.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\4EF2.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

memory/924-369-0x0000000000400000-0x000000000043E000-memory.dmp

memory/328-368-0x000000006FCD0000-0x00000000703BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/328-363-0x0000000000800000-0x000000000081E000-memory.dmp

memory/924-362-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2900-373-0x0000000001170000-0x00000000012C8000-memory.dmp

memory/924-374-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/364-375-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/924-379-0x0000000000400000-0x000000000043E000-memory.dmp

memory/924-380-0x0000000000400000-0x000000000043E000-memory.dmp

memory/2900-378-0x0000000001170000-0x00000000012C8000-memory.dmp

\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\90B5.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/364-385-0x0000000002120000-0x0000000002160000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\90B5.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/924-387-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/328-393-0x00000000046F0000-0x0000000004730000-memory.dmp

memory/1744-392-0x0000000000230000-0x000000000028A000-memory.dmp

memory/1744-400-0x0000000000400000-0x000000000046F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\92F8.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\90B5.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/2564-408-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/2564-409-0x0000000000160000-0x00000000001BA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\92F8.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

memory/924-390-0x00000000003B0000-0x00000000003F0000-memory.dmp

memory/1744-419-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/2564-433-0x0000000004200000-0x0000000004240000-memory.dmp

memory/1744-432-0x00000000070D0000-0x0000000007110000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XQ8ZHSDO\hLRJ1GG_y0J[1].ico

MD5 8cddca427dae9b925e73432f8733e05a
SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\zo0jyaj\imagestore.dat

MD5 6723922a8d46367209e194e4c8286e06
SHA1 76256cc6a62b28568504bad32859606acba8d499
SHA256 d47cf5bffd2839190c2cc7ea5fe790c2dcb7005d00f2e980ce09ef7b4b43078c
SHA512 b585031790c27f6bf518f46f8a887da33783947939a8a1d1b632a00b5d4cbd5799a462bc614763d40424551bf75316ab537a3e26f88a5bad71620d3c5c876d7c

memory/364-469-0x000000006FCD0000-0x00000000703BE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HCMMLZVL\favicon[1].ico

MD5 f3418a443e7d841097c714d69ec4bcb8
SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

memory/328-595-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/924-603-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/364-606-0x0000000002120000-0x0000000002160000-memory.dmp

memory/924-607-0x00000000003B0000-0x00000000003F0000-memory.dmp

memory/1744-609-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/328-626-0x00000000046F0000-0x0000000004730000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bb427f7f6114862a8bb4b1130950b15
SHA1 6490a24c5ba6b77f6e509c3dd25125576d7db88d
SHA256 46c1659606cfd4c897e0174609f0cd1c676cee25250f53f699e54f3316df2dde
SHA512 fd36ec50b706576eea987ac18aec8d60685d5a21b7a4ed45a097014e3418f53e42e9c6c877f9efe6deb0a9db2331c39a0cf38419f3c0eb2578a751286cf61e59

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f32e451569f255739a28658282061370
SHA1 cfec9d028963cdd42c0ce7b1b588fce9f2eacef8
SHA256 bbe68fcea3708f40a823098ffcc53c99c49a1691c1f4a9d0fadc027b173c9a57
SHA512 51ceb493f6a42b8d711047ce66019f817bd97e3f32fee38cb9db9fdf8104715bcd7f80834a2a578be08bd121489711a6a6d15a8bf2a5172df5d63ba9a206f9a3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7007f89becba41fb760abbfcd530c265
SHA1 7ee674f36cbe4ec187524af2f193695e641bd2fe
SHA256 cfed256d0a02f234a06c3ca73aa7114ca2309f4a5558d5cad5123eb5b05cdb3c
SHA512 ddda3b827b638e717275de8e04c05626846710acf87beb1bbdc517afe1853864dbd16bf45b43653bb31aaac16f4c086be9862a2536e507e53a41dfaa86060cfa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 483cf7a9e8d76efe930ca2561601219d
SHA1 09ed13f1317d425ff80d66b46b0cf5320802e13e
SHA256 2dbaac50084585e8be21c3a99d8a9fb9cb9e2642fab2e986b9a7e3cfdc5a8f44
SHA512 7cfd3d2d6add98e12d007c12b3a5d997fbf63e23f3d04818c67ad7b77c74db51d4a167668b92676b8d89bf076c80207617dadac6f26af7aeb9d5aa1554a08af6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 561775a9c76f06c6434ada67ad3a027b
SHA1 d7d41d54b04878cd98b78784bba402484fff14ec
SHA256 7be5da5d359072b0022e2823d8f553d8aed8dde5a705030e86716ac455552580
SHA512 e330862ccc9d833b53fc60a06dac08fec5b4319d56ef474e6e6f420330e70cf5211913c4ebf0d190a1e65f8e4be8a3f4f4339a0b73ca89338bcb7c168cc4f3eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9d68f26111f59cbd33e14a1fa45679d
SHA1 2a8bb025619bf5380d1a8f3d5f5c944f78876c7d
SHA256 869f8de805ad1d31d6accf0fa946cef262f57a2ed5938119846ec3f3cc38994d
SHA512 ac400b30bbc66bf1928d827845ac39746e495e8919f638e3a6dbf53f3cf87ad5db9b7ae3e840b7b383f5499cbb485cf3f5597c2a51133227eab2e02ff524726c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71488055bffb5d06d89c96cff68b2560
SHA1 d9b51c13f6809cbe118286e933092a7df355f804
SHA256 c7a90c2245e5e5b07656a02c2f00d4582c3263b73faa821593a0967c54dcb174
SHA512 b7da7f24b010171a5133fa12ebba0aa849d548978aa1b3ffda4be84932f143d9f9de26d2f80283b739498e9f8027e9d7eb97aa6dcd5174ce08a040bd52f65112

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fd1fcf81892b2fbba489e7fb4f6728aa
SHA1 b5efe9d4fe845e9633d9643cddeda36af5fd89e3
SHA256 341b73f4101c6515970295dc075ddd5c758d0e831e76b7260c32a60f973a4a6c
SHA512 0113ebd6bb4baafca903dfc1eee08ed2dbf7de1fedf3829d1d9a9c04594dc8f3acc15cf2f7db6c7d04a4672da23c27ce2b6db9119477055835c0b70947cf7ce7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d92d4f13013df848a7feb7c2633d348
SHA1 1c48b79fa18a6f705e08dcaedf9efbfcab418798
SHA256 3c325964c81d19fa7aa01f41151b43c4c100547b87ece9f6cc85f51587ab6942
SHA512 206ed3276e99727b4b6b3890cf50215d4a2b081cffb356a0eed830cd72fdd3accdfbacb64ec89b570e340d3f91f6d997718b9a63ba28ec1e2ef8836397726bac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 86dbf7147cc9625d6adf4d278cc11730
SHA1 86d9c73230e8fb14efab08e704ec736014592469
SHA256 2abaa049ae9f28d4c1cf1d46b287a99abc603520ec8e3183721e5ef9d04b8ba1
SHA512 b44de16c218cfc72c68c73da91d5159e2c52377c1edcf1d016a755d358f06d36d4376cc9aff6aa5df108b594adae92ca23948a8ce0b43d601bed7dac152262c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 304c3ed02ed11c4a5b8d6bc8b5bef6ec
SHA1 7e3df77e404c5f28c566c1ecbb01bcc62b01a1eb
SHA256 695e216356286d10e5d484c3bfe91aae5c357091c4c80361d2c7fcf62b8fd2d6
SHA512 0e7dfdde2b318d50f4628ef43df0e010486b031839d4da0c2a74c11c5a3df230347a54734d2cdce74e1fffa4c1ccbd696dabc61ac843995daa970762bd1a7559

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f97d9a6634710a235c8cd40f8c8a7507
SHA1 4cc7819e1e2080b96cab03011b137bafa11e07c0
SHA256 85df40d9e0229b57a962a7d5818d9cba5e949690ff5034c763bdda7b832eef41
SHA512 3b545b046470d3bc1518b37a39c77dd3b6f4e29998dc4cdf2906519813227fbef6b31020e761c5245b20dea2251bb486cb9505a946533406dc1e77be2063575c

memory/2564-1014-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/2564-1033-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/364-1064-0x000000006FCD0000-0x00000000703BE000-memory.dmp

memory/320-1080-0x00000000001D0000-0x0000000000203000-memory.dmp

memory/320-1082-0x00000000001D0000-0x0000000000203000-memory.dmp

memory/1884-1084-0x000000013F580000-0x000000013F87F000-memory.dmp

memory/320-1083-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/320-1098-0x00000000001D0000-0x0000000000203000-memory.dmp

memory/320-1099-0x00000000001D0000-0x0000000000203000-memory.dmp

memory/320-1100-0x00000000001D0000-0x0000000000203000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpFD8C.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmpFDA2.tmp

MD5 5f358a4b656915069dae00d3580004a1
SHA1 c81e8b6f220818370d47464210c07f0148e36049
SHA256 8917aa7c60dc0d81231fb4be80a0d7b0e934ea298fb486c4bad66ef77bebcf5a
SHA512 d63ebd45d31f596a5c8f4fcc816359a24cbf2d060cb6e6a7648abaf14dc7cf76dda3721c9d19cb7e84eaeb113a3ee1f7be44b743f929de05c66da49c7ba7e97d

memory/2880-1161-0x000007FEF5150000-0x000007FEF5B3C000-memory.dmp

memory/328-1162-0x000000006FCD0000-0x00000000703BE000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-11 20:29

Reported

2023-10-12 15:19

Platform

win10v2004-20230915-en

Max time kernel

169s

Max time network

177s

Command Line

"C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\3037.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\3037.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\3037.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\3037.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\3037.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\3037.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3326.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3A2C.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1A59.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\275C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3037.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3326.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3A2C.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3E34.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\471E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4ED0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\573D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5EA1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6B15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\ugsirtd N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\573D.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\573D.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\3037.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\1A59.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe N/A

Checks installed software on the system

discovery

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3037.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3A2C.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5004 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5004 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3136 wrote to memory of 1684 N/A N/A C:\Users\Admin\AppData\Local\Temp\1A59.exe
PID 3136 wrote to memory of 1684 N/A N/A C:\Users\Admin\AppData\Local\Temp\1A59.exe
PID 3136 wrote to memory of 1684 N/A N/A C:\Users\Admin\AppData\Local\Temp\1A59.exe
PID 3136 wrote to memory of 3152 N/A N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe
PID 3136 wrote to memory of 3152 N/A N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe
PID 3136 wrote to memory of 3152 N/A N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe
PID 3136 wrote to memory of 1732 N/A N/A C:\Windows\system32\cmd.exe
PID 3136 wrote to memory of 1732 N/A N/A C:\Windows\system32\cmd.exe
PID 3136 wrote to memory of 4992 N/A N/A C:\Users\Admin\AppData\Local\Temp\275C.exe
PID 3136 wrote to memory of 4992 N/A N/A C:\Users\Admin\AppData\Local\Temp\275C.exe
PID 3136 wrote to memory of 4992 N/A N/A C:\Users\Admin\AppData\Local\Temp\275C.exe
PID 1684 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1A59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 1684 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1A59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 1684 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\1A59.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe
PID 1732 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1732 wrote to memory of 2584 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3136 wrote to memory of 4584 N/A N/A C:\Users\Admin\AppData\Local\Temp\3037.exe
PID 3136 wrote to memory of 4584 N/A N/A C:\Users\Admin\AppData\Local\Temp\3037.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\1D96.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3136 wrote to memory of 2416 N/A N/A C:\Users\Admin\AppData\Local\Temp\3326.exe
PID 3136 wrote to memory of 2416 N/A N/A C:\Users\Admin\AppData\Local\Temp\3326.exe
PID 3136 wrote to memory of 2416 N/A N/A C:\Users\Admin\AppData\Local\Temp\3326.exe
PID 2616 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 2616 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe
PID 3136 wrote to memory of 464 N/A N/A C:\Users\Admin\AppData\Local\Temp\3A2C.exe
PID 3136 wrote to memory of 464 N/A N/A C:\Users\Admin\AppData\Local\Temp\3A2C.exe
PID 3136 wrote to memory of 464 N/A N/A C:\Users\Admin\AppData\Local\Temp\3A2C.exe
PID 3348 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 3348 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 3348 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe
PID 3136 wrote to memory of 3080 N/A N/A C:\Users\Admin\AppData\Local\Temp\3E34.exe
PID 3136 wrote to memory of 3080 N/A N/A C:\Users\Admin\AppData\Local\Temp\3E34.exe
PID 3136 wrote to memory of 3080 N/A N/A C:\Users\Admin\AppData\Local\Temp\3E34.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4992 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\275C.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1732 wrote to memory of 4100 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1732 wrote to memory of 4100 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3136 wrote to memory of 3872 N/A N/A C:\Users\Admin\AppData\Local\Temp\471E.exe
PID 3136 wrote to memory of 3872 N/A N/A C:\Users\Admin\AppData\Local\Temp\471E.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe

"C:\Users\Admin\AppData\Local\Temp\abc90cf9de4d2f4b45134b36e3a54185979cde738d79c5f0419c010d9adc7cb5.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5004 -ip 5004

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 268

C:\Users\Admin\AppData\Local\Temp\1A59.exe

C:\Users\Admin\AppData\Local\Temp\1A59.exe

C:\Users\Admin\AppData\Local\Temp\1D96.exe

C:\Users\Admin\AppData\Local\Temp\1D96.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2509.bat" "

C:\Users\Admin\AppData\Local\Temp\275C.exe

C:\Users\Admin\AppData\Local\Temp\275C.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\3037.exe

C:\Users\Admin\AppData\Local\Temp\3037.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3152 -ip 3152

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

C:\Users\Admin\AppData\Local\Temp\3326.exe

C:\Users\Admin\AppData\Local\Temp\3326.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3152 -s 260

C:\Users\Admin\AppData\Local\Temp\3A2C.exe

C:\Users\Admin\AppData\Local\Temp\3A2C.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

C:\Users\Admin\AppData\Local\Temp\3E34.exe

C:\Users\Admin\AppData\Local\Temp\3E34.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4992 -ip 4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc1fe646f8,0x7ffc1fe64708,0x7ffc1fe64718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1fe646f8,0x7ffc1fe64708,0x7ffc1fe64718

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

C:\Users\Admin\AppData\Local\Temp\471E.exe

C:\Users\Admin\AppData\Local\Temp\471E.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 148

C:\Users\Admin\AppData\Local\Temp\4ED0.exe

C:\Users\Admin\AppData\Local\Temp\4ED0.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\573D.exe

C:\Users\Admin\AppData\Local\Temp\573D.exe

C:\Users\Admin\AppData\Local\Temp\5EA1.exe

C:\Users\Admin\AppData\Local\Temp\5EA1.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3376 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3184 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3464 -ip 3464

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5104 -ip 5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 556

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\6B15.exe

C:\Users\Admin\AppData\Local\Temp\6B15.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,2791772332095964513,17004848901086015822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2268 -ip 2268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 792

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3E34.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1fe646f8,0x7ffc1fe64708,0x7ffc1fe64718

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3E34.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x74,0x108,0x7ffc1fe646f8,0x7ffc1fe64708,0x7ffc1fe64718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,5662176581231311622,17898848403522612062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1944 /prefetch:1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Windows\system32\rundll32.exe

C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask

C:\Users\Admin\AppData\Roaming\ugsirtd

C:\Users\Admin\AppData\Roaming\ugsirtd

Network

Country Destination Domain Proto
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 254.105.26.67.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
RU 5.42.92.211:80 5.42.92.211 tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
N/A 224.0.0.251:5353 udp
IT 185.196.9.65:80 tcp
US 8.8.8.8:53 65.9.196.185.in-addr.arpa udp
NL 85.209.176.171:80 85.209.176.171 tcp
TR 185.216.70.238:37515 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 238.70.216.185.in-addr.arpa udp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 98.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 mscom.demdex.net udp
US 8.8.8.8:53 target.microsoft.com udp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
IE 52.210.175.198:443 mscom.demdex.net tcp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 198.175.210.52.in-addr.arpa udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 16.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 mdec.nelreports.net udp
NL 84.53.175.67:443 mdec.nelreports.net tcp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 13.107.246.67:443 js.monitor.azure.com tcp
IE 52.210.175.198:443 mscom.demdex.net tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 facebook.com udp
GB 157.240.221.35:443 facebook.com tcp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 fbsbx.com udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp
NL 85.209.176.171:80 85.209.176.171 tcp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp

Files

memory/1988-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1988-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1988-4-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3136-2-0x0000000000740000-0x0000000000756000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1A59.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

C:\Users\Admin\AppData\Local\Temp\1A59.exe

MD5 4daecf597a2dd31dfb503f03d8066da5
SHA1 dfe9e91e51bd8772494fd47ff1f49efff7a5f2fe
SHA256 78e2c4ad5bd7d9203cf3b62532d0200d1d2d8cea1eb364c780eb0b502920ace1
SHA512 031ba5853cb526a8ff25817038c91389a69e49bf9690d90071ed3f6b31be1e16daaf4f4beac5a838a94b0c7b9ac6f4fd23345a8fdb6593331c00b2b7c61a2836

C:\Users\Admin\AppData\Local\Temp\1D96.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

C:\Users\Admin\AppData\Local\Temp\1D96.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

C:\Users\Admin\AppData\Local\Temp\2509.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\275C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jQ1Mr4Mt.exe

MD5 93eca4fbb38e680273d719c5461eb9dd
SHA1 e9efcc3eba4a0e7ada5b9384b31afd4f9078fafa
SHA256 5e9120ad469565e0614de446c6ee641fd860afd734a37d7ab60f29e6398c3514
SHA512 17753661bb12893c20851b5715aab8f36eda21abbbf8995f1faf3288c50f114c66502dc61774f605f5f698de4235cce7c58fd3faf267027f3228b637487284d9

C:\Users\Admin\AppData\Local\Temp\275C.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

C:\Users\Admin\AppData\Local\Temp\3037.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\3037.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/3288-40-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4584-43-0x0000000000500000-0x000000000050A000-memory.dmp

memory/3288-42-0x0000000000400000-0x0000000000433000-memory.dmp

memory/3288-45-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3326.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xx2Ha8Yf.exe

MD5 ecdc17897ca326301560784d0c964317
SHA1 4be4d648d480b29e0a92a1760aabad538f47766e
SHA256 3e067a08ce9d8da313102955d1d5133e7add6753ae8cdd3274fc471ae6743b48
SHA512 3a11ae20866b3e5b0408216868b4468a14e68670d586c519796cdf2d5aed8d907171ed8bcd93a7e7fd0906d7473c20e9f3ea31f41ef19f50dbc4eca8fe191b6d

C:\Users\Admin\AppData\Local\Temp\3326.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\3A2C.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nD5Mc7XS.exe

MD5 e87b59ab8ed79bad6f01e2ede94fd7ab
SHA1 f04548e4f693ac87e5f82a09592f6161278e4b82
SHA256 b041155dfecd86a847e9bf49cafc8cf2bce0a21e414c1a443f70f33ff86abbef
SHA512 760a6dfe218d21b35ae1fab0ab68093a7886a24af85f6dc629773856330b0482f07233bccd6cdb76c2722d832dabb28598fab7fdd5dc78ae9c59288a5f5390ac

C:\Users\Admin\AppData\Local\Temp\3A2C.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/3136-64-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-65-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-67-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-66-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-69-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-68-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-70-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-72-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-71-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-73-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-74-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-75-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-77-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-76-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-78-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-79-0x0000000008580000-0x0000000008590000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3E34.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

memory/4584-87-0x00007FFC1EC50000-0x00007FFC1F711000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3E34.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

memory/1352-90-0x0000000000400000-0x000000000043E000-memory.dmp

memory/3136-92-0x0000000008580000-0x0000000008590000-memory.dmp

memory/3136-98-0x0000000003E70000-0x0000000003E80000-memory.dmp

memory/3136-105-0x0000000003E70000-0x0000000003E80000-memory.dmp

memory/3136-106-0x0000000003E70000-0x0000000003E80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\471E.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/3080-108-0x0000000000400000-0x000000000046F000-memory.dmp

memory/3080-94-0x00000000020D0000-0x000000000212A000-memory.dmp

memory/3288-109-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TW2av6xe.exe

MD5 c7af0ffee19f59e58e20cde9d8d2f6a7
SHA1 49005a245c761ed95df372c3a3ac4e39015f8ef4
SHA256 060d05dfb9fc43b79d6b76208a55f3d734f1f8eaf5c0f25b199ad3059e0a84ce
SHA512 b29c062bf71a1b6da5cf1552d4bb4a7dd319f512eec8f282f59a20d1fafc703f21a901cce48c85ecfef40cfcd70c1e1fbd305d41afa14289a6460ab6812df2e9

C:\Users\Admin\AppData\Local\Temp\471E.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vt02Wg7.exe

MD5 262dff4e232e0d653c52e19191c15a48
SHA1 28957a144eafa406a307615028ef3d9199aff0ab
SHA256 6e56893984cfbf21701acea05d9a3b8c6238ddc4644fc9e8397e691004e09d0f
SHA512 8cb7b38832afe3b0a35a25ac08439b98aad8eed91e98cc7502e8c05bfa82c9934b91a400ab15fe3446ef93be96e5c6a5f6f47533d032e58109cabe82d725cdd4

C:\Users\Admin\AppData\Local\Temp\4ED0.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6351be8b63227413881e5dfb033459cc
SHA1 f24489be1e693dc22d6aac7edd692833c623d502
SHA256 e24cda01850900bdb3a4ae5f590a76565664d7689026c146eb96bcd197dac88b
SHA512 66e249488a2f9aa020834f3deca7e4662574dcab0cbb684f21f295f46d71b11f9494b075288189d9df29e4f3414d4b86c27bf8823005d400a5946d7b477f0aef

C:\Users\Admin\AppData\Local\Temp\4ED0.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/3872-123-0x0000000000170000-0x000000000018E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\573D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/1352-125-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Temp\573D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/1140-138-0x0000000001000000-0x000000000103E000-memory.dmp

memory/3804-147-0x0000000000170000-0x00000000002C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Temp\5EA1.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

\??\pipe\LOCAL\crashpad_4100_NDLYWVJFVRVSOBCT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\5EA1.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

memory/3804-159-0x0000000000170000-0x00000000002C8000-memory.dmp

memory/2268-160-0x00000000006D0000-0x000000000072A000-memory.dmp

memory/3872-164-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\573D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

C:\Users\Admin\AppData\Local\Temp\573D.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/4068-167-0x0000000000670000-0x00000000006CA000-memory.dmp

memory/3288-168-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4068-169-0x0000000072F80000-0x0000000073730000-memory.dmp

memory/1140-170-0x0000000072F80000-0x0000000073730000-memory.dmp

memory/2268-171-0x0000000000400000-0x000000000046F000-memory.dmp

memory/2268-172-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1d1b8e3822de3ab38dab031b20425ecf
SHA1 54d4aedeb970da5f70368d65eed2f3cd4608c45e
SHA256 0fac385c2330cb49bc416feebed11ba4323e2255951f12e5498e4c3e3a72e6f6
SHA512 951dfc1993aac59794b31d55964d6ad6af0ee79cb7a329d814e165259c3756147c01a6cc22c616dc8e8df966abb1513186f4c5c3d13707e1bd6b8a151eda4ecc

memory/5104-180-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5104-182-0x0000000000400000-0x0000000000433000-memory.dmp

memory/5104-179-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

memory/4584-199-0x00007FFC1EC50000-0x00007FFC1F711000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d7bdc56250a2aab851c98004268a679b
SHA1 294d6dd49282c8fdc3ea73df42ef8f8ffc4dc089
SHA256 922cc6fb13c02fbf2ecf0587e53952da5f174ce151a75bd66f53f5fe7ea4a27f
SHA512 8bce683c27de12bc948335abff03c53d437c94ebc5bb244a872909051657aaf4c9f4a2fd9f5fae9a6fbb11743874a1568f8e9bf78de96f02e4438d0955934bc8

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/1352-213-0x00000000080F0000-0x0000000008694000-memory.dmp

memory/3872-224-0x0000000005070000-0x0000000005688000-memory.dmp

memory/3872-225-0x00000000049F0000-0x0000000004A02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/1352-230-0x0000000005690000-0x00000000056A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/3872-242-0x0000000004A40000-0x0000000004A50000-memory.dmp

memory/3872-241-0x0000000004AD0000-0x0000000004B1C000-memory.dmp

memory/1140-240-0x0000000007B80000-0x0000000007B8A000-memory.dmp

memory/1140-236-0x0000000007990000-0x00000000079A0000-memory.dmp

memory/4068-231-0x0000000007450000-0x0000000007460000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/3872-227-0x0000000004A90000-0x0000000004ACC000-memory.dmp

memory/4068-223-0x00000000074A0000-0x0000000007532000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/4068-246-0x0000000007800000-0x000000000790A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6B15.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

MD5 0e3b0fb5f1507fb187e678cc24ed088f
SHA1 b34a2460545e5fee0e256d157c8a89150e7f8fc4
SHA256 c22cb222976ee0b1f8bd96b1f10154e1285e354b4481961036c2392c456f94b2
SHA512 ee9f6aa0a5e9f9637d9f0ed9d493bc52d9cd711ab32ed84ef29c919744afeb191b83b94990b673d20f83111365f789cb2f5233dfc60281714ebe950231f2cd51

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2yG544kv.exe

MD5 0e3b0fb5f1507fb187e678cc24ed088f
SHA1 b34a2460545e5fee0e256d157c8a89150e7f8fc4
SHA256 c22cb222976ee0b1f8bd96b1f10154e1285e354b4481961036c2392c456f94b2
SHA512 ee9f6aa0a5e9f9637d9f0ed9d493bc52d9cd711ab32ed84ef29c919744afeb191b83b94990b673d20f83111365f789cb2f5233dfc60281714ebe950231f2cd51

memory/6092-251-0x0000000000420000-0x000000000045E000-memory.dmp

memory/6092-250-0x0000000072F80000-0x0000000073730000-memory.dmp

memory/4068-256-0x0000000008000000-0x0000000008066000-memory.dmp

memory/3136-258-0x0000000003E70000-0x0000000003E80000-memory.dmp

memory/3136-259-0x0000000003E70000-0x0000000003E80000-memory.dmp

memory/3136-257-0x0000000003E70000-0x0000000003E80000-memory.dmp

memory/1352-260-0x0000000072F80000-0x0000000073730000-memory.dmp

memory/6092-261-0x0000000007400000-0x0000000007410000-memory.dmp

memory/4068-262-0x0000000072F80000-0x0000000073730000-memory.dmp

memory/3872-263-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d7bdc56250a2aab851c98004268a679b
SHA1 294d6dd49282c8fdc3ea73df42ef8f8ffc4dc089
SHA256 922cc6fb13c02fbf2ecf0587e53952da5f174ce151a75bd66f53f5fe7ea4a27f
SHA512 8bce683c27de12bc948335abff03c53d437c94ebc5bb244a872909051657aaf4c9f4a2fd9f5fae9a6fbb11743874a1568f8e9bf78de96f02e4438d0955934bc8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/1140-286-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 de31a9540d53642548c758f2a11de0f0
SHA1 789ff79ddbda8d16c59baac2b44ba5096375bd13
SHA256 a3b2ff7ca1effd608532742b198d6ac7b6fc7f4614918bf69bb023f9efad6673
SHA512 54f3291ff11e99a14789fc9a6daeb098c1e1e215257a6957f557d16ed5caa52187c9d94225636859d25fa47121fe023b6073c3fbf9bf6210e66b21a4c92e3b92

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9ec052c74ce3d2bccf3b41ff5410e280
SHA1 b86f241b78f7e73e89305f40e23d0a19a3d44b59
SHA256 735f9fe800f560a9df6b03a45bf92aac1cd7960463a9d30ce7d3f59f92d47c87
SHA512 347268329928e204bb985ad36a670d13a44471fb27211c787aac9ea62c3a92c80b87d4f5fc7eb6515d2121d55dca91825f9ee1b77db4477030a9008dbbf5c722

memory/2268-289-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 699e3636ed7444d9b47772e4446ccfc1
SHA1 db0459ca6ceeea2e87e0023a6b7ee06aeed6fded
SHA256 9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a
SHA512 d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

memory/5304-319-0x00007FF743940000-0x00007FF743C3F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/3872-331-0x0000000005FE0000-0x00000000061A2000-memory.dmp

memory/3872-333-0x00000000066E0000-0x0000000006C0C000-memory.dmp

memory/4068-332-0x0000000007450000-0x0000000007460000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

memory/1352-347-0x0000000005690000-0x00000000056A0000-memory.dmp

memory/1140-348-0x0000000007990000-0x00000000079A0000-memory.dmp

memory/3872-349-0x0000000004A40000-0x0000000004A50000-memory.dmp

memory/5176-350-0x0000000000B80000-0x0000000000BB3000-memory.dmp

memory/5176-352-0x0000000000B80000-0x0000000000BB3000-memory.dmp

memory/5176-353-0x0000000000B80000-0x0000000000BB3000-memory.dmp

memory/5304-351-0x00007FF743940000-0x00007FF743C3F000-memory.dmp

memory/5176-354-0x0000000000B80000-0x0000000000BB3000-memory.dmp

memory/6092-355-0x0000000072F80000-0x0000000073730000-memory.dmp

memory/6092-356-0x0000000007400000-0x0000000007410000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 16c2a9f4b2e1386aab0e353614a63f0d
SHA1 6edd3be593b653857e579cbd3db7aa7e1df3e30f
SHA256 0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81
SHA512 aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8536cb81fae6f94f003981d3d667ee1e
SHA1 1a4e3e3d494c87916bc08315252463a0e5050b1c
SHA256 3581def71db85f6bcf0ed997445525ef73fe6f3424df782e31c48f14e64cc1c5
SHA512 8770a565686dfb415268ae63a6b46327a08381feebf4b5926380554a840664fcdf29646b77f5b672f7522ba5d185d1cf34db5af66856515c5c76a28059afcc72

memory/5176-373-0x0000000000B80000-0x0000000000BB3000-memory.dmp

memory/3872-374-0x00000000065C0000-0x0000000006636000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b84e336c287f22618bf888cae37f6bae
SHA1 0420a8c678b2502d1c747988cf344d6e2a3ad05b
SHA256 40faca0b9c3f783a44f629a89861c235fbaa9ee30eca03fdf62f0947d10daca4
SHA512 f3115d0d8532fb2efa96a445456a11e0e9d595a4fa6482eecdb2adc465d1dd01cf0a452a97187370ec2ff91584b9e3e97b03906560df8678ce66b02068bf26c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58fa3a.TMP

MD5 bd71fc88eccb587220922967af15d361
SHA1 8e8ec2c6291cc8c6b36d9dda299d8700261c813f
SHA256 8871e0f1aea50c9275ec3157cd1cce729cc8e0873c045937eb9aad407bf8fd65
SHA512 2261685bfd9f1c0ff54defeddeb05c11f0d39f4e2a1e81a7ec3b4ecba53c6ab6e2b8901eadc59070681416bdc605d811eb9699fb69e0ccaf7e553b53d6c2a2a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 784a38a8bfab15d728fcadc949434087
SHA1 86e14a9bb414a27eea6bbc47ef0810fdcf149cf8
SHA256 c82cd34e06b40c7aefa5ba4f62f369d3d5dfb7ec505e1bfa2f5b73a657f42d68
SHA512 107024149b7ee6df0341fe986b6cd279b573a57aa3e2577206391a7a10e2fd99aec1f01016ad5a96918f062a2ea8c08de3084e0ba373168ad0e88610e37b6009

memory/1140-417-0x0000000005450000-0x00000000054A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 557f69ba7b84fe8c1ed861406592c8c0
SHA1 d1faf06c2a0097e77c1f13797e9ce12fb27f32cc
SHA256 04a317496e2ce0f3bf3884e71faa4facbce7920f8a803aabdf41b12a71b940fa
SHA512 54164a68ff14f41eb66cb8f80f4528181bf17aad345a0f445e35b62ec268f0b30f0510bdd6e07da84d19911fe75a52dc4d3394f685d8ee7b23e57375e1328a7a

memory/3872-474-0x0000000000640000-0x000000000065E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 eae16221aa4886c838f476cd0765582f
SHA1 ff855c012428415c1d00f397f51b7b28a8036d39
SHA256 2e19d4738c5fe3e400c7c5f34ae6f3346fc832b968e4bf64238b83516730bedf
SHA512 e5d6b7f884fda84bfcaf4e6c65c8dd4deb4d8824a26bd8ccb7d4236d4eea7c4dac1a9c5c4619a7175971af769218e7ced6540d2122f1d31c6b2c3e273cb02e26

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e23d541191cb1be87f0d71e8bf162eb1
SHA1 4e6448c5feb493b77600f3a645f9cdb973df7d8a
SHA256 059b7d7f7e1a8d72431521775eebc89368b08d638da0b2962c8b6cd6a5ad3547
SHA512 ad2cff280db7d16d6efd126ff20868fddc406d45cf78949f563947687d8221199f1c837f49d1c6a3862b9b8bd1e5fb794f0b198721fd1a02307c719c08b04234

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b32c6d5e9a6bcaf18b0216e6eb9fe655
SHA1 ac591c6c66fce1ac7ccbb1242c048b78f9681670
SHA256 88846f519d7e0eacdca95806f7795abc651789bf7fdce2539fcad5fe996a5dea
SHA512 538405aa3a4480b5ad894c1074c64dd00b9f95dbf49dcba164eca8806636d8a6527c9e0b40159155b5a14f707017330e17de5e9ab75ab1e1802ea8f6a4eea6ff

C:\Users\Admin\AppData\Local\Temp\tmp818B.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp81B0.tmp

MD5 6e98ae51f6cacb49a7830bede7ab9920
SHA1 1b7e9e375bd48cae50343e67ecc376cf5016d4ee
SHA256 192cd04b9a4d80701bb672cc3678912d1df8f6b987c2b4991d9b6bfbe8f011fd
SHA512 3e7cdda870cbde0655cc30c2f7bd3afee96fdfbe420987ae6ea2709089c0a8cbc8bb9187ef3b4ec3f6a019a9a8b465588b61029869f5934e0820b2461c4a9b2b

C:\Users\Admin\AppData\Local\Temp\tmp822A.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp822F.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmp8274.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp82A0.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/1140-734-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a712d9d2d45d085bcd30d928b7271f69
SHA1 99e421e8fcd24f1b49a5e0ba991901b619bd5f7f
SHA256 567e935cdfa742a9c7db705a9fff1198272778cc72c383c2978c17d8e56d0937
SHA512 2fcb5880cc833bf893c6f21db32070d69ed66a92cafb294ce1f1af47f5bae3d45eee2b5515086d595525e06b0ba9d33eb1e783ec28d980461c51e417473e0f02

memory/4068-745-0x0000000072F80000-0x0000000073730000-memory.dmp

memory/3872-747-0x0000000072F80000-0x0000000073730000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 64356435a0c85682c7391144dd78f293
SHA1 37f6623c03b0e3febdcf082674ca604f38c70a28
SHA256 7276abade951430fbe51d21aee0f1586a1d358d1651b1575b59805af4427bd4c
SHA512 724083acc67c5c68c71ed963b0deb1d9354e0c098ce3f6e13ffe3afcbac96f94505478797c9ab44234567175c8902acf4d11e374dadf5850accc2f34476835e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dfa7132023a0b147f5b156c1a40d6730
SHA1 825e38dbbc132f79d20dd7f6e4ef8b28e1059ecf
SHA256 1886b92344494c4cba08793784c6de29fd65d7294206d40a8b1741e34c73444e
SHA512 339b34d10d0b80e433f29ccbeaeeb9a867e0fde991fc454d0a74d24d9a0994d16d7a2bb32b363df333d84a211a044855c42ab595d8115e976eb92f483d23ffd1