Malware Analysis Report

2025-08-10 23:43

Sample ID 231012-sqya6aac92
Target 5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386
SHA256 5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386
Tags
amadey dcrat healer redline sectoprat smokeloader @ytlogsbot breha kukish pixelscloud backdoor microsoft discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386

Threat Level: Known bad

The file 5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386 was found to be: Known bad.

Malicious Activity Summary

amadey dcrat healer redline sectoprat smokeloader @ytlogsbot breha kukish pixelscloud backdoor microsoft discovery dropper evasion infostealer persistence phishing rat spyware stealer trojan

RedLine

SectopRAT payload

RedLine payload

Healer

Detects Healer an antivirus disabler dropper

SmokeLoader

Modifies Windows Defender Real-time Protection settings

Amadey

DcRat

SectopRAT

Downloads MZ/PE file

Checks computer location settings

Loads dropped DLL

Uses the VBS compiler for execution

Reads user/profile data of web browsers

Windows security modification

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Detected potential entity reuse from brand microsoft.

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Program crash

Creates scheduled task(s)

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Uses Task Scheduler COM API

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-12 15:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-12 15:20

Reported

2023-10-12 15:23

Platform

win10v2004-20230915-en

Max time kernel

176s

Max time network

191s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe"

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9BF2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9DB8.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\83F0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9BF2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A0E6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A309.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\A731.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BFAC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C5F6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D98F.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IA999ZI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Uses the VBS compiler for execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\83F0.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe N/A

Checks installed software on the system

discovery

Detected potential entity reuse from brand microsoft.

phishing microsoft

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\99AF.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2780 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2780 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2780 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2780 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2780 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2780 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3172 wrote to memory of 1256 N/A N/A C:\Users\Admin\AppData\Local\Temp\83F0.exe
PID 3172 wrote to memory of 1256 N/A N/A C:\Users\Admin\AppData\Local\Temp\83F0.exe
PID 3172 wrote to memory of 1256 N/A N/A C:\Users\Admin\AppData\Local\Temp\83F0.exe
PID 3172 wrote to memory of 5024 N/A N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe
PID 3172 wrote to memory of 5024 N/A N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe
PID 3172 wrote to memory of 5024 N/A N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe
PID 1256 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\83F0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe
PID 1256 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\83F0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe
PID 1256 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\83F0.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe
PID 3172 wrote to memory of 4520 N/A N/A C:\Windows\system32\cmd.exe
PID 3172 wrote to memory of 4520 N/A N/A C:\Windows\system32\cmd.exe
PID 5084 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe
PID 5084 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe
PID 5084 wrote to memory of 3776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe
PID 3776 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe
PID 3776 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe
PID 3776 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe
PID 1612 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe
PID 1612 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe
PID 1612 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe
PID 3172 wrote to memory of 4384 N/A N/A C:\Users\Admin\AppData\Local\Temp\9912.exe
PID 3172 wrote to memory of 4384 N/A N/A C:\Users\Admin\AppData\Local\Temp\9912.exe
PID 3172 wrote to memory of 4384 N/A N/A C:\Users\Admin\AppData\Local\Temp\9912.exe
PID 3756 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe
PID 3756 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe
PID 3756 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe
PID 3172 wrote to memory of 4332 N/A N/A C:\Users\Admin\AppData\Local\Temp\99AF.exe
PID 3172 wrote to memory of 4332 N/A N/A C:\Users\Admin\AppData\Local\Temp\99AF.exe
PID 3172 wrote to memory of 4880 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BF2.exe
PID 3172 wrote to memory of 4880 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BF2.exe
PID 3172 wrote to memory of 4880 N/A N/A C:\Users\Admin\AppData\Local\Temp\9BF2.exe
PID 3172 wrote to memory of 348 N/A N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe
PID 3172 wrote to memory of 348 N/A N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe
PID 3172 wrote to memory of 348 N/A N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe
PID 4880 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\9BF2.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4880 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\9BF2.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 4880 wrote to memory of 928 N/A C:\Users\Admin\AppData\Local\Temp\9BF2.exe C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
PID 3172 wrote to memory of 4792 N/A N/A C:\Users\Admin\AppData\Local\Temp\A0E6.exe
PID 3172 wrote to memory of 4792 N/A N/A C:\Users\Admin\AppData\Local\Temp\A0E6.exe
PID 3172 wrote to memory of 4792 N/A N/A C:\Users\Admin\AppData\Local\Temp\A0E6.exe
PID 4520 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4520 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 348 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
PID 348 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
PID 348 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\9DB8.exe C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
PID 3172 wrote to memory of 4408 N/A N/A C:\Users\Admin\AppData\Local\Temp\A309.exe
PID 3172 wrote to memory of 4408 N/A N/A C:\Users\Admin\AppData\Local\Temp\A309.exe
PID 3172 wrote to memory of 4408 N/A N/A C:\Users\Admin\AppData\Local\Temp\A309.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5024 wrote to memory of 1688 N/A C:\Users\Admin\AppData\Local\Temp\8DA6.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe

"C:\Users\Admin\AppData\Local\Temp\5e010a105055cb97e0f10295e950dc96f253d23dcfc81b9de3894acfa9679386.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2780 -ip 2780

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 140

C:\Users\Admin\AppData\Local\Temp\83F0.exe

C:\Users\Admin\AppData\Local\Temp\83F0.exe

C:\Users\Admin\AppData\Local\Temp\8DA6.exe

C:\Users\Admin\AppData\Local\Temp\8DA6.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9642.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe

C:\Users\Admin\AppData\Local\Temp\9912.exe

C:\Users\Admin\AppData\Local\Temp\9912.exe

C:\Users\Admin\AppData\Local\Temp\99AF.exe

C:\Users\Admin\AppData\Local\Temp\99AF.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe

C:\Users\Admin\AppData\Local\Temp\9BF2.exe

C:\Users\Admin\AppData\Local\Temp\9BF2.exe

C:\Users\Admin\AppData\Local\Temp\9DB8.exe

C:\Users\Admin\AppData\Local\Temp\9DB8.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\A0E6.exe

C:\Users\Admin\AppData\Local\Temp\A0E6.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"

C:\Users\Admin\AppData\Local\Temp\A309.exe

C:\Users\Admin\AppData\Local\Temp\A309.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4384 -ip 4384

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5024 -ip 5024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff95bd146f8,0x7ff95bd14708,0x7ff95bd14718

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1952 -ip 1952

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Users\Admin\AppData\Local\Temp\A731.exe

C:\Users\Admin\AppData\Local\Temp\A731.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2624 -ip 2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7ff95bd146f8,0x7ff95bd14708,0x7ff95bd14718

C:\Users\Admin\AppData\Local\Temp\BFAC.exe

C:\Users\Admin\AppData\Local\Temp\BFAC.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 540

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\C5F6.exe

C:\Users\Admin\AppData\Local\Temp\C5F6.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3504 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10394838875305733897,786608162678982880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10394838875305733897,786608162678982880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3420 /prefetch:2

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:N"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\D98F.exe

C:\Users\Admin\AppData\Local\Temp\D98F.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\207aa4515d" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "oneetx.exe" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IA999ZI.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IA999ZI.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=BFAC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95bd146f8,0x7ff95bd14708,0x7ff95bd14718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=BFAC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95bd146f8,0x7ff95bd14708,0x7ff95bd14718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12460731585284766575,16526833692529145644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 113.208.253.8.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 54.120.234.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.52:80 77.91.68.52 tcp
US 8.8.8.8:53 52.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
TR 185.216.70.222:80 185.216.70.222 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
US 8.8.8.8:53 222.70.216.185.in-addr.arpa udp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
RU 5.42.65.80:80 5.42.65.80 tcp
RU 5.42.92.211:80 5.42.92.211 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 211.92.42.5.in-addr.arpa udp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 accounts.google.com udp
GB 157.240.221.35:443 www.facebook.com tcp
GB 157.240.221.35:443 www.facebook.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com tcp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.221.240.157.in-addr.arpa udp
NL 142.250.179.141:443 accounts.google.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
IT 185.196.9.65:80 tcp
MD 176.123.9.142:37637 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 65.9.196.185.in-addr.arpa udp
US 8.8.8.8:53 142.9.123.176.in-addr.arpa udp
NL 85.209.176.171:80 85.209.176.171 tcp
TR 185.216.70.238:37515 tcp
FI 77.91.124.55:19071 tcp
US 8.8.8.8:53 171.176.209.85.in-addr.arpa udp
US 8.8.8.8:53 238.70.216.185.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
NL 142.251.36.14:443 play.google.com udp
US 8.8.8.8:53 31.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 98.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 learn.microsoft.com udp
NL 104.85.2.139:443 learn.microsoft.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
GB 157.240.221.16:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 js.monitor.azure.com udp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 13.107.246.67:443 js.monitor.azure.com tcp
US 8.8.8.8:53 16.221.240.157.in-addr.arpa udp
US 8.8.8.8:53 67.246.107.13.in-addr.arpa udp
US 8.8.8.8:53 139.2.85.104.in-addr.arpa udp
US 8.8.8.8:53 mdec.nelreports.net udp
NL 84.53.175.67:443 mdec.nelreports.net tcp
US 8.8.8.8:53 mscom.demdex.net udp
IE 54.229.208.26:443 mscom.demdex.net tcp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
US 8.8.8.8:53 67.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 26.208.229.54.in-addr.arpa udp
US 8.8.8.8:53 facebook.com udp
US 8.8.8.8:53 fbcdn.net udp
GB 157.240.221.35:443 fbcdn.net tcp
US 8.8.8.8:53 microsoftmscompoc.tt.omtrdc.net udp
US 8.8.8.8:53 target.microsoft.com udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 126.23.238.8.in-addr.arpa udp
US 8.8.8.8:53 browser.events.data.microsoft.com udp
IE 20.50.73.11:443 browser.events.data.microsoft.com tcp
IE 20.50.73.11:443 browser.events.data.microsoft.com tcp
IE 20.50.73.11:443 browser.events.data.microsoft.com tcp
US 8.8.8.8:53 fbsbx.com udp
US 8.8.8.8:53 11.73.50.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
NL 142.251.36.14:443 play.google.com udp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp
NL 142.250.179.141:443 accounts.google.com udp
FI 77.91.124.55:19071 tcp
FI 77.91.124.55:19071 tcp

Files

memory/3964-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3964-1-0x0000000000400000-0x0000000000409000-memory.dmp

memory/3172-2-0x0000000002B00000-0x0000000002B16000-memory.dmp

memory/3964-3-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\83F0.exe

MD5 e52a30d0a60c29f5ab163dfe521df185
SHA1 bb3747167aa0ca5c75fd989d913aedd7d74a05ff
SHA256 0001093d18c7660b7d8e557b93eeeeb1bbcceb7069a369a1eac49cc01737ab06
SHA512 d462130abb6eb8eaf8bd2f7d9f96fe9a45240cba904ba2767000c52dd7f6b966a6d3eb51625350a95f92e1030e421e890081c0842b1c5364fc7452bf5423cd34

C:\Users\Admin\AppData\Local\Temp\83F0.exe

MD5 e52a30d0a60c29f5ab163dfe521df185
SHA1 bb3747167aa0ca5c75fd989d913aedd7d74a05ff
SHA256 0001093d18c7660b7d8e557b93eeeeb1bbcceb7069a369a1eac49cc01737ab06
SHA512 d462130abb6eb8eaf8bd2f7d9f96fe9a45240cba904ba2767000c52dd7f6b966a6d3eb51625350a95f92e1030e421e890081c0842b1c5364fc7452bf5423cd34

C:\Users\Admin\AppData\Local\Temp\8DA6.exe

MD5 7a06af08168ee22dec9e1ce956586356
SHA1 435dadb3e98b39cba5473a8d2d7d53f7eca46e6c
SHA256 a5cf1265a3e0a01df83ff1ee86c974340695457d444013efa35e13b4b2ac7420
SHA512 5f0e6e5dbf7900cccfb39fef1df796fe1729849f46c226dac8829ac4131495725da7f5d2aededf467f2e9b09a7f053efd39ce5ad4766dcdf35c603dfbc52a98e

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe

MD5 e61fb5f7b04a7f9ada6510aba6145bae
SHA1 3736014513e65fb606c3e91d3cff2fb3b587cfc4
SHA256 4b68f0baa4ca10e82e77ecb76d9d61dd6f9c459642f1d14863baf47d641fb86a
SHA512 e50c8a08604838204e1cd399d2e65a16783246098e4a58a2394503e8b583f8de103d407f4f87a4a40375bd9a026ab87f68372406f39929ef9183e1eb49c595e4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PS1kf7tj.exe

MD5 e61fb5f7b04a7f9ada6510aba6145bae
SHA1 3736014513e65fb606c3e91d3cff2fb3b587cfc4
SHA256 4b68f0baa4ca10e82e77ecb76d9d61dd6f9c459642f1d14863baf47d641fb86a
SHA512 e50c8a08604838204e1cd399d2e65a16783246098e4a58a2394503e8b583f8de103d407f4f87a4a40375bd9a026ab87f68372406f39929ef9183e1eb49c595e4

C:\Users\Admin\AppData\Local\Temp\8DA6.exe

MD5 7a06af08168ee22dec9e1ce956586356
SHA1 435dadb3e98b39cba5473a8d2d7d53f7eca46e6c
SHA256 a5cf1265a3e0a01df83ff1ee86c974340695457d444013efa35e13b4b2ac7420
SHA512 5f0e6e5dbf7900cccfb39fef1df796fe1729849f46c226dac8829ac4131495725da7f5d2aededf467f2e9b09a7f053efd39ce5ad4766dcdf35c603dfbc52a98e

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe

MD5 78ddd84827e193d9f272bf07143d1b41
SHA1 1294fe8aae0deefef077ec7442525486c8c0be2d
SHA256 1e074fb3717ca129762d51c012440807cc0858b3c9ad2d777409f525930350b5
SHA512 2fa44d7a466727c01303a924f58681d468a4d9e832e5ecfddc769e4334d3c054da423778264ff07627287edd6c6caf0b4c35487300263b85098f4fc41464181c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yu0uM2DP.exe

MD5 78ddd84827e193d9f272bf07143d1b41
SHA1 1294fe8aae0deefef077ec7442525486c8c0be2d
SHA256 1e074fb3717ca129762d51c012440807cc0858b3c9ad2d777409f525930350b5
SHA512 2fa44d7a466727c01303a924f58681d468a4d9e832e5ecfddc769e4334d3c054da423778264ff07627287edd6c6caf0b4c35487300263b85098f4fc41464181c

C:\Users\Admin\AppData\Local\Temp\9642.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe

MD5 b33d7edfc5c814c4da9dfb21490f0420
SHA1 c9fecae7c3d9e75b11057ffa662502aa31a754f7
SHA256 844f6b4ab7e14540553d8f08462b9e7456cbf2924da00211894887df3c0599c3
SHA512 06397cb3e52ec0df5488447045ef568f3fb495e8f6f4293d45236199d753c35298570856cb1c195e122ea018e1b3b30466e304ec4e13d1b1f7786d620f21bfd2

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\fb5Kg2lG.exe

MD5 b33d7edfc5c814c4da9dfb21490f0420
SHA1 c9fecae7c3d9e75b11057ffa662502aa31a754f7
SHA256 844f6b4ab7e14540553d8f08462b9e7456cbf2924da00211894887df3c0599c3
SHA512 06397cb3e52ec0df5488447045ef568f3fb495e8f6f4293d45236199d753c35298570856cb1c195e122ea018e1b3b30466e304ec4e13d1b1f7786d620f21bfd2

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe

MD5 2212241576464b07d2641012ecb68beb
SHA1 2cc35f4be8a835459ef3e508671353426e598f5f
SHA256 95cc015a7e97b18fd81deff03e9b31e537700c6c90e0ebc947f79e99dd92f9a9
SHA512 99b6cc62c930473ad7aec58c0ff8141c1f68f9005597811b6101fe2fa4844df7ec48295e689ad73a60fb7df8d2fae187e17443df1bdc6efa5fdab6c6d1df4c45

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

C:\Users\Admin\AppData\Local\Temp\9912.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj7RA8DZ.exe

MD5 2212241576464b07d2641012ecb68beb
SHA1 2cc35f4be8a835459ef3e508671353426e598f5f
SHA256 95cc015a7e97b18fd81deff03e9b31e537700c6c90e0ebc947f79e99dd92f9a9
SHA512 99b6cc62c930473ad7aec58c0ff8141c1f68f9005597811b6101fe2fa4844df7ec48295e689ad73a60fb7df8d2fae187e17443df1bdc6efa5fdab6c6d1df4c45

C:\Users\Admin\AppData\Local\Temp\99AF.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

C:\Users\Admin\AppData\Local\Temp\99AF.exe

MD5 57543bf9a439bf01773d3d508a221fda
SHA1 5728a0b9f1856aa5183d15ba00774428be720c35
SHA256 70d2e4df54793d08b8e76f1bb1db26721e0398da94dca629ab77bd41cc27fd4e
SHA512 28f2eb1fef817df513568831ca550564d490f7bd6c46ada8e06b2cd81bbc59bc2d7b9f955dbfc31c6a41237d0d0f8aa40aaac7ae2fabf9902228f6b669b7fe20

memory/4332-62-0x0000000000CF0000-0x0000000000CFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9912.exe

MD5 e37479ec728fbc1e48caa448ab9c8b75
SHA1 7ac8f4c52b7fe7a2b43d55ad532ded9e30b0fffe
SHA256 f44ea387dd58b2bc4ba640a73a8ad835bec6387682b0049ab35b25241f48f311
SHA512 5c0d1cbc4672c52ac5108215dd5fe037efab112e11cde051ca80acfa3758671389578048c69fbd7096284d22eb925afeee55c4fabc9ea0da176cab096a90901b

memory/4332-64-0x00007FF95E1C0000-0x00007FF95EC81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Kr63Fs9.exe

MD5 5ccaee1dcedc87915eee516995101794
SHA1 05fde259eb069f0bd6152b692c2fa47dcce176b7
SHA256 af307ebc2f3925c396f95a4ef2711e4420ac192c75908fc4390bbbeac64c3c1e
SHA512 754b9545c40bdb6fe509b8d1aa9aa5eea74e9e23638c2d9af7a1ba2316b9d0d67701d009d6852c9173a3024c0f33691fbeab795e47eac1aed66efb560b55b186

C:\Users\Admin\AppData\Local\Temp\9BF2.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\9BF2.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\9DB8.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\9DB8.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\A0E6.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Temp\A309.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

C:\Users\Admin\AppData\Local\Temp\A0E6.exe

MD5 37e45af2d4bf5e9166d4db98dcc4a2be
SHA1 9e08985f441deb096303d11e26f8d80a23de0751
SHA256 194475450c4a476569c4e00d985454eff049435fa95da39b44308a244e7b8bca
SHA512 720bfc951f8661b8a9124b70e3d02815b91058c30fd712d7733f214b9383c7f8a344c2d2bf5ff88bec68cc751753d48bab37cc3908c790980bd01aa142904a9c

memory/4792-100-0x0000000000400000-0x000000000046F000-memory.dmp

memory/1688-101-0x0000000000400000-0x0000000000433000-memory.dmp

memory/4752-102-0x0000000000400000-0x000000000043E000-memory.dmp

memory/1688-105-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1688-104-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1688-106-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1952-110-0x0000000000400000-0x0000000000433000-memory.dmp

memory/1952-112-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A731.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

memory/1952-118-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A309.exe

MD5 1199c88022b133b321ed8e9c5f4e6739
SHA1 8e5668edc9b4e1f15c936e68b59c84e165c9cb07
SHA256 e6bd7a442e04eba451aa1f63819533b086c5a60fd9fa7506fa838515184e1836
SHA512 7aa8c3ed3a2985bb8a62557fd347d1c90790cd3f5e3b0b70c221b28cb17a0c163b8b1bac45bc014148e08105232e9abef33408a4d648ddc5362795e5669e3697

memory/4792-108-0x00000000005D0000-0x000000000062A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\A731.exe

MD5 4f1e10667a027972d9546e333b867160
SHA1 7cb4d6b066736bb8af37ed769d41c0d4d1d5d035
SHA256 b0fa49565e226cabfd938256f49fac8b3372f73d6f275513d3a4cad5a911be9c
SHA512 c7d6bf074c7f4b57c766a979ad688e50a007f2d89cc149da96549f51ba0f9dc70d37555d501140c14124f1dec07d9e86a9dfff1d045fcce3e2312b741a08dd6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0987267c265b2de204ac19d29250d6cd
SHA1 247b7b1e917d9ad2aa903a497758ae75ae145692
SHA256 474887e5292c0cf7d5ed52e3bcd255eedd5347f6f811200080c4b5d813886264
SHA512 3b272b8c8d4772e1a4dc68d17a850439ffdd72a6f6b1306eafa18b810b103f3198af2c58d6ed92a1f3c498430c1b351e9f5c114ea5776b65629b1360f7ad13f5

memory/4408-126-0x0000000000290000-0x00000000002AE000-memory.dmp

memory/4752-127-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/3612-128-0x00000000004D0000-0x0000000000628000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFAC.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/4792-129-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/4332-130-0x00007FF95E1C0000-0x00007FF95EC81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BFAC.exe

MD5 08b8fd5a5008b2db36629b9b88603964
SHA1 c5d0ea951b4c2db9bfd07187343beeefa7eab6ab
SHA256 e60438254142b8180dd0c4bc9506235540b8f994b5d8ecae2528dc69f45bc3a3
SHA512 033a651fabcfbc50d5b189bfe6be048469eae6fef3d8903ac1a1e7f6c744b5643d92954ae1250b3383a91e6a8b19dfe0391d89f4f57766c6bd61be666f8f6653

memory/1924-144-0x00000000006D0000-0x000000000072A000-memory.dmp

memory/3012-148-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4408-147-0x0000000072460000-0x0000000072C10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\C5F6.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Temp\C5F6.exe

MD5 20e21e63bb7a95492aec18de6aa85ab9
SHA1 6cbf2079a42d86bf155c06c7ad5360c539c02b15
SHA256 96a9eeeaa9aace1dd6eb0ba2789bb155b64f7c45dc9bcd34b8cd34a1f33e7d17
SHA512 73eb9426827ba05a432d66d750b5988e4bb9c58b34de779163a61727c3df8d272ef455d5f27684f0054bb3af725106f1fadbae3afa3f1f6de655b8d947a82b33

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

memory/3612-153-0x00000000004D0000-0x0000000000628000-memory.dmp

memory/1924-151-0x0000000000400000-0x000000000046F000-memory.dmp

memory/3612-163-0x00000000004D0000-0x0000000000628000-memory.dmp

memory/4752-166-0x0000000007760000-0x0000000007D04000-memory.dmp

memory/4408-171-0x0000000004B10000-0x0000000004B22000-memory.dmp

memory/1688-177-0x0000000000400000-0x0000000000433000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

\??\pipe\LOCAL\crashpad_4764_ZWKMTFSICPVKSGZH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4752-188-0x0000000007410000-0x0000000007420000-memory.dmp

memory/3012-181-0x0000000007350000-0x0000000007360000-memory.dmp

memory/4792-180-0x0000000007730000-0x0000000007740000-memory.dmp

memory/4408-179-0x0000000004BB0000-0x0000000004BEC000-memory.dmp

memory/4332-178-0x00007FF95E1C0000-0x00007FF95EC81000-memory.dmp

\??\pipe\LOCAL\crashpad_232_RVAMLJIDSUUMWJQZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1356-176-0x0000000000270000-0x00000000002CA000-memory.dmp

memory/1356-173-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/4792-172-0x0000000007540000-0x00000000075D2000-memory.dmp

memory/3012-165-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/4408-164-0x0000000005190000-0x00000000057A8000-memory.dmp

memory/3012-192-0x0000000007090000-0x000000000709A000-memory.dmp

memory/1356-194-0x00000000071E0000-0x00000000071F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\D98F.exe

MD5 56cd504aff215b0c1c1805c5a85d6488
SHA1 e5d36b48e9d37578bd5e51f369f6fcc11c6544df
SHA256 f7e0f309d04b40a8c2e914c981315d5988e0994912f5d8f973e82ef2b1f5cc93
SHA512 dfd0cafd3a81021e5c8c1a74de009351927adab5204c38610f3515c58578ebbd40298b5bc2348c87bc9cb962a03a59cf74bf386f9daad75a76991e221bb24732

memory/4408-195-0x0000000004B60000-0x0000000004B70000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9b390a3d20f4488b0fa6273df3e5e06f
SHA1 4ace10fc1a7c93997edacef15fa40b82b126a74f
SHA256 7d0e6e9a200037f9939ba9f4f85e671fee1faa3269117e44e05a8d654e503432
SHA512 b6f05339ea6bf19f8cae7c8489b7ac97d4bdcb6d2c750aa006fda9554c445b0b814fa2f93dd493160732daf3699822ed3ccee856eebb0a6864372817a1ec8743

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IA999ZI.exe

MD5 9ccdae3be00be1a888c9695799839b7a
SHA1 14a49b29dfeae99c0793ed90c3379b25833b19eb
SHA256 bedefe96e193fa08f0b55213b98434a620c3ae0fd745326feb00d3741c0624bd
SHA512 296025c442880d4f0502b8735619548ff8969cdffa10b2dabcb26b30c69f2f2a7fb1ccb1f006e8acd98f041e9bf9578b03d077921da5fc46795f6409938f1dd5

memory/4752-208-0x0000000072460000-0x0000000072C10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IA999ZI.exe

MD5 9ccdae3be00be1a888c9695799839b7a
SHA1 14a49b29dfeae99c0793ed90c3379b25833b19eb
SHA256 bedefe96e193fa08f0b55213b98434a620c3ae0fd745326feb00d3741c0624bd
SHA512 296025c442880d4f0502b8735619548ff8969cdffa10b2dabcb26b30c69f2f2a7fb1ccb1f006e8acd98f041e9bf9578b03d077921da5fc46795f6409938f1dd5

memory/4792-209-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/5420-210-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/5420-211-0x0000000000440000-0x000000000047E000-memory.dmp

memory/4408-212-0x0000000072460000-0x0000000072C10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7ed62e9958341ae03958018e74549ba2
SHA1 670cc72a14bff34f4fa4c9f2277191172990f09f
SHA256 aa8f8ad3328fd2bf4989bea36853cbaccecad5857b7ac51cedcd510227de55ef
SHA512 1bd62b17a8a90f33d45d6b2423f706ac1624de9cb34c78b4153baf13c16f669d53726eef471e641726983924eba4a16419f7783e6115b12315ee05cceebd5cd2

memory/4792-239-0x00000000077C0000-0x00000000078CA000-memory.dmp

memory/4408-238-0x0000000004BF0000-0x0000000004C3C000-memory.dmp

memory/5420-240-0x00000000074A0000-0x00000000074B0000-memory.dmp

memory/3012-241-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/1356-242-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/1356-251-0x0000000007C00000-0x0000000007C66000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 669e99d6e3fa2cefea9241e94a16598f
SHA1 e8a4c23633016742add478c75ae64e69695239be
SHA256 f92b86a439b96d97cc1f60fd4657adb54230e3e2751ef1ee8b863ac63c201c84
SHA512 cef2bfddf2c1c8c80d2f69908459056ff881f595ce091b84e40f5ba6529fdd6e683e88858c6e45c42433b54ea6b929724b8265c43f395f89f774d2b44b2ec6ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9b390a3d20f4488b0fa6273df3e5e06f
SHA1 4ace10fc1a7c93997edacef15fa40b82b126a74f
SHA256 7d0e6e9a200037f9939ba9f4f85e671fee1faa3269117e44e05a8d654e503432
SHA512 b6f05339ea6bf19f8cae7c8489b7ac97d4bdcb6d2c750aa006fda9554c445b0b814fa2f93dd493160732daf3699822ed3ccee856eebb0a6864372817a1ec8743

memory/3012-271-0x0000000007350000-0x0000000007360000-memory.dmp

memory/4752-272-0x0000000007410000-0x0000000007420000-memory.dmp

memory/4792-270-0x0000000007730000-0x0000000007740000-memory.dmp

memory/4792-274-0x00000000089E0000-0x0000000008A56000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

MD5 a64a886a695ed5fb9273e73241fec2f7
SHA1 363244ca05027c5beb938562df5b525a2428b405
SHA256 563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512 122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

memory/4792-280-0x0000000008AA0000-0x0000000008ABE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 78e5bc5b95cf1717fc889f1871f5daf6
SHA1 65169a87dd4a0121cd84c9094d58686be468a74a
SHA256 7d2e2e4f369bcdbbe4a1d9acd299e230adc522d46e54f59e321622d80da02966
SHA512 d97bc87809e5f52cd015ced62488f738ea24a16c31d1fb836091b72112b200e304f0d8fab3ef762411b662ed60df0ca5fc24d4e98adb22b79e5e74a9292c1500

memory/5188-299-0x00007FF6C6290000-0x00007FF6C658F000-memory.dmp

memory/4408-301-0x0000000004B60000-0x0000000004B70000-memory.dmp

memory/1356-300-0x00000000071E0000-0x00000000071F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f7240b7bea4dec55858278c517d29fcd
SHA1 889368f11071f07834bd5a73f288d288a67808e0
SHA256 684caeb2d0f9b909a671b611f24c68267302758afb9e803bc70b4b6fd82bb8d4
SHA512 085364a6574df4cb9dc213ea4d26168cc47c7c9c333b0d39f615753dcaad39bf192523662eeca015a51753e6ce810f9935f3ce27e90089e718b3bb20c7e86071

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/4792-319-0x0000000004520000-0x0000000004570000-memory.dmp

memory/4792-330-0x0000000008C70000-0x0000000008E32000-memory.dmp

memory/4792-333-0x0000000008E40000-0x000000000936C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 669e99d6e3fa2cefea9241e94a16598f
SHA1 e8a4c23633016742add478c75ae64e69695239be
SHA256 f92b86a439b96d97cc1f60fd4657adb54230e3e2751ef1ee8b863ac63c201c84
SHA512 cef2bfddf2c1c8c80d2f69908459056ff881f595ce091b84e40f5ba6529fdd6e683e88858c6e45c42433b54ea6b929724b8265c43f395f89f774d2b44b2ec6ef

memory/5420-377-0x0000000072460000-0x0000000072C10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 4a078fb8a7c67594a6c2aa724e2ac684
SHA1 92bc5b49985c8588c60f6f85c50a516fae0332f4
SHA256 c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee
SHA512 188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6

memory/5696-389-0x0000000000E10000-0x0000000000E43000-memory.dmp

memory/5188-390-0x00007FF6C6290000-0x00007FF6C658F000-memory.dmp

memory/5696-392-0x0000000000E10000-0x0000000000E43000-memory.dmp

memory/5696-394-0x0000000000E10000-0x0000000000E43000-memory.dmp

memory/5696-395-0x0000000000E10000-0x0000000000E43000-memory.dmp

memory/5696-398-0x0000000000E10000-0x0000000000E43000-memory.dmp

memory/5420-401-0x00000000074A0000-0x00000000074B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1B01.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp1B36.tmp

MD5 9bea288e5e9ccef093ddee3a5ab588f3
SHA1 02a72684263b4bcd2858f48b0a1aec5d636782e3
SHA256 a77cae820a99813a04bbcf7b80b7a56a03b8d53813b441ef7542e81dcdad3257
SHA512 68f9a928cabfc886131f047b0fe74ba67af5b1082083ae5543ba8b1b3189bdd02f15929736e6cc0c561a02915f29bf58bbc4022e6f823549344d9f14a3c2be07

C:\Users\Admin\AppData\Local\Temp\tmp1BAF.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Temp\tmp1BDB.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp1BD5.tmp

MD5 49693267e0adbcd119f9f5e02adf3a80
SHA1 3ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512 b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

C:\Users\Admin\AppData\Local\Temp\tmp1C16.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

memory/1356-579-0x0000000072460000-0x0000000072C10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2743a4bbfed62843e262ee731bd52b5c
SHA1 fba339540feb07b89136de614892ae6a5ba48a46
SHA256 c871f1cea9f95d249f415a16f62a250a2e71cd0047b8800f63a5466a05b81d24
SHA512 833675ba0cf43472c98d1c23bbef823292d1a01497eb2e2fcc34cf4f1f95aed23ec3a40399edbcb11ca59f9ea1843ba88518ab4fe5f76288e8718b498924aef2

memory/4408-596-0x0000000072460000-0x0000000072C10000-memory.dmp

memory/4792-604-0x0000000072460000-0x0000000072C10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 90c1c6e33cfcc33c08e75c4cded6263f
SHA1 5f4f21c842fb2b04ec05198bc81ecdf18e03bd02
SHA256 a9d0d4b8595e34091cc83f07b950f246300b4213abc2b7e31e098d961589b3ce
SHA512 d0c5f3613a20995ceaff4fefbd146e4c920659e84016d5e120910e6b1b8f49be92c66f77f558cba4406a97d2922d9a6c13dbb450bb38f22fc900503f6a733e13

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595db6.TMP

MD5 450cfa74357713f62b510309e683a8f3
SHA1 25544ae117f263fe66470387f0c98d8709223ee6
SHA256 353a6806a63610c0a411206de4889d5f5b83b699eca799b26309593da55edfa1
SHA512 d853bd763b7ed41bc61481e94444f83d5c2fe5f5a53c5d659ef1f3250d394e83c2cee07bd0525f77942f81f84aab11ca61c829e6303979900a23609cda96f135

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cbd4fd0585b9625b5216e23f987e31a5
SHA1 59115156167a07a149b0631692ffbcbcc587c157
SHA256 9980133b9bfd28b89419d1c92d894a023e392f2e03c1ea6ea237afa4b51747db
SHA512 1f2135ac9b37e227ef577ade53d821ad0c0a5ff34e1403c5bacdcbe35ad46916f93d198e7a571d3c2d2c6144759932e43ecd306d2b4a7fa81ad54b2e36050752

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/3012-669-0x0000000072460000-0x0000000072C10000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d11325e086709971d011ac739af3ff9e
SHA1 cdd54bd55d9883c5c378a42c302bd22333d3e3e3
SHA256 23d8795ee2064d9e19dd53db307c1c08daadf0cd09d9c66041a1ce4ec1e1ba2f
SHA512 56ecbb82f18e46e600666b87e4a9dda36d1b42e6a514057a0e394b33899eb7bf0e9385ce3e4e191fd8b136211c566782f4775c0e6cc88562fbc87a2559cbc729

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 48e0a6efb72c2c68a97867a5dfdd2d1a
SHA1 657f40baa387a084a1edf4b378232bc86a3c356c
SHA256 bdb1a68386a3bfe44b5677bfede478a3118354e4841bf09f73d4c9ec6be2d4ce
SHA512 d0e7fe0f76a9bf564b64666d2c7d12103d17a614613aad9d5f1691675f0ad76b4b87532bcd9fdeb75915b5a479cdfbd972e42f65480b582e12ce40af04d492d7

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d5dd2ee0e30b059b45e969157dff8d3e
SHA1 729edfb5654c5495eafd76623cdc2f8d57e8bf43
SHA256 bfefd00cb14c8fd75c9073f0c8d81c0cf189335eb4bad22a9d1510f35e8cf322
SHA512 7bae3d87f4243352ac301408e29297b39e96729961bf64e06dcee56a67f1eb3ef3853a771bb7caac7bd8c63b34d82a3e897293e184ed27b8de88a0e601962ae4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 637c52274a16dbb0f29920ecf423b366
SHA1 ca2dcbf1773d3d7224616ade07b98a1ac6e978cc
SHA256 baa96e23e61c0d9d7843b2035b2e0cfa45726778a982ca7acff6941423638fba
SHA512 8d51b1015f4c1859e462065fb66cdd4a5441a5b35fc344ee6888b7c6206feb182104ad00a29e5c5859fd043fc5313c974b3334b649b926ca67d7f84c96e92053

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 eb7232a333d053017121e9f32758d21a
SHA1 0b7e54e61036806fa85d36096ff2694123cb3c45
SHA256 cd960674805947abbeede4f1de17bff5f618c072dfff7e2886b486bc69ef198f
SHA512 5f3c63116c8cc7d2f59fae22e66ef4543480ee146b5d9b6b5a0f1491d5fece1197b616a3a8f789d8a0102afa1d6bd3653d5be510de6f8c35b36a19cf0039d0f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 311eed001c305510e6d2db5f0a8fbcab
SHA1 3234cea554196faf3b06d8de5e666a0ce3c1d972
SHA256 6c47894fc387f6dcc3db99cac36555d8aff14c1d6cf0d0484c5559aea40d5914
SHA512 d7766ba831aa32f36bfa50f16789213d6692932bbccf50ae7da70d0ae4285e620e23b97066a43ee7bab0a1002c83c35e6af16d59dd9ff2ec4d359fe34824e681

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e1d7d49fdf078f69d0847ecee309ee0c
SHA1 21db0e19fc373bf518ae9331383d1d302e89f1d2
SHA256 a19279321c7bac466a128a1f6e862918ffc8353bc44e3343d92ade825b42b8dd
SHA512 90488483edc064372765de1170d446b25ea7b7a3e8294b2c92b5b58072f80e31ae78ad4b7017b7658dfe4373160950fb5bf20f6f464d0f004d9001db8ef4f1e6