Malware Analysis Report

2025-03-14 23:12

Sample ID 240406-3y2nnaef71
Target 9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286
SHA256 9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286
Tags
amadey redline risepro discovery evasion infostealer persistence spyware stealer themida trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286

Threat Level: Known bad

The file 9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286 was found to be: Known bad.

Malicious Activity Summary

amadey redline risepro discovery evasion infostealer persistence spyware stealer themida trojan

RedLine

Amadey

RedLine payload

RisePro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Blocklisted process makes network request

Reads user/profile data of web browsers

Checks computer location settings

Themida packer

Reads WinSCP keys stored on the system

Reads local data of messenger clients

Checks BIOS information in registry

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Checks whether UAC is enabled

Checks installed software on the system

Adds Run key to start application

Accesses cryptocurrency files/wallets, possible credential harvesting

AutoIT Executable

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 23:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 23:56

Reported

2024-04-06 23:58

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe"

Signatures

Amadey

trojan amadey

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

RisePro

stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cbf6898508.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042001\\cbf6898508.exe" C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe" C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorha.job C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
File created C:\Windows\Tasks\explorgu.job C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1001109001\crWPCBdbTXjH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1001109001\crWPCBdbTXjH.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1001109001\crWPCBdbTXjH.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1001109001\crWPCBdbTXjH.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 872 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 872 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 872 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 5032 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe
PID 5032 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe
PID 5032 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe
PID 5032 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 5032 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 5032 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 5032 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
PID 5032 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
PID 5032 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
PID 2328 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2328 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 4812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 4812 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2328 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2328 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5020 wrote to memory of 2908 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2328 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2328 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2728 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2728 wrote to memory of 3944 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1836 wrote to memory of 2972 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe

"C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe"

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"

C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe

"C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe"

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"

C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe

"C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa31ce46f8,0x7ffa31ce4708,0x7ffa31ce4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa31ce46f8,0x7ffa31ce4708,0x7ffa31ce4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa31ce46f8,0x7ffa31ce4708,0x7ffa31ce4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9016407519193969762,5378282110066493410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9016407519193969762,5378282110066493410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11215018558086907564,2055550862835583752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe

"C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\999976163400_Desktop.zip' -CompressionLevel Optimal

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

C:\Users\Admin\AppData\Local\Temp\1001109001\crWPCBdbTXjH.exe

"C:\Users\Admin\AppData\Local\Temp\1001109001\crWPCBdbTXjH.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\999976163400_Desktop.zip' -CompressionLevel Optimal

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,541180327333070087,17203221376474084964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
RU 193.233.132.56:80 193.233.132.56 tcp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 167.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 56.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
DE 142.250.185.174:443 www.youtube.com tcp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 consent.youtube.com udp
BE 74.125.206.84:443 accounts.google.com tcp
US 8.8.8.8:53 174.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
DE 142.250.185.78:443 consent.youtube.com tcp
BE 74.125.206.84:443 accounts.google.com udp
US 8.8.8.8:53 78.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 84.206.125.74.in-addr.arpa udp
US 8.8.8.8:53 67.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.185.250.142.in-addr.arpa udp
US 8.8.8.8:53 scontent.xx.fbcdn.net udp
US 8.8.8.8:53 static.xx.fbcdn.net udp
US 8.8.8.8:53 video.xx.fbcdn.net udp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
GB 163.70.151.21:443 static.xx.fbcdn.net tcp
RU 193.233.132.56:80 193.233.132.56 tcp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 202.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
DE 172.217.16.196:443 www.google.com tcp
US 8.8.8.8:53 196.16.217.172.in-addr.arpa udp
DE 172.217.16.196:443 www.google.com udp
US 8.8.8.8:53 scontent-lhr6-2.xx.fbcdn.net udp
US 8.8.8.8:53 scontent-lhr8-1.xx.fbcdn.net udp
GB 157.240.221.16:443 scontent-lhr8-1.xx.fbcdn.net tcp
US 8.8.8.8:53 16.221.240.157.in-addr.arpa udp
RU 193.233.132.56:80 193.233.132.56 tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 play.google.com udp
DE 172.217.23.110:443 play.google.com tcp
DE 172.217.23.110:443 play.google.com udp
US 8.8.8.8:53 110.23.217.172.in-addr.arpa udp
RU 193.233.132.56:80 193.233.132.56 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 8.8.8.8:53 150.1.37.23.in-addr.arpa udp
DE 172.217.23.110:443 play.google.com udp
RU 185.215.113.32:80 185.215.113.32 tcp
US 8.8.8.8:53 files.eintim.me udp
US 104.21.41.45:443 files.eintim.me tcp
US 8.8.8.8:53 45.41.21.104.in-addr.arpa udp
US 8.8.8.8:53 32.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 131.16.217.172.in-addr.arpa udp
DE 45.88.90.46:18768 45.88.90.46 tcp
US 8.8.8.8:53 46.90.88.45.in-addr.arpa udp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.13.31:443 api.ip.sb tcp
US 8.8.8.8:53 31.13.26.104.in-addr.arpa udp
RU 185.215.113.32:80 185.215.113.32 tcp
RU 185.215.113.32:80 185.215.113.32 tcp
DE 142.250.185.78:443 consent.youtube.com udp
BE 74.125.206.84:443 accounts.google.com udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
BE 74.125.206.84:443 accounts.google.com udp
DE 142.250.185.78:443 consent.youtube.com udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

memory/872-0-0x0000000000F10000-0x00000000013DA000-memory.dmp

memory/872-1-0x00000000779D4000-0x00000000779D6000-memory.dmp

memory/872-2-0x0000000000F10000-0x00000000013DA000-memory.dmp

memory/872-3-0x00000000058A0000-0x00000000058A1000-memory.dmp

memory/872-4-0x00000000058B0000-0x00000000058B1000-memory.dmp

memory/872-5-0x0000000005890000-0x0000000005891000-memory.dmp

memory/872-6-0x00000000058E0000-0x00000000058E1000-memory.dmp

memory/872-7-0x0000000005870000-0x0000000005871000-memory.dmp

memory/872-8-0x0000000005880000-0x0000000005881000-memory.dmp

memory/872-9-0x00000000058D0000-0x00000000058D1000-memory.dmp

memory/872-10-0x0000000005900000-0x0000000005901000-memory.dmp

memory/872-11-0x00000000058F0000-0x00000000058F1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

MD5 78fded861ee10154e352255f122fb24b
SHA1 20a1d121c19335780a4e17ba08149952a1c33a2b
SHA256 9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286
SHA512 ce227dfbf96897d249d8114cebd53ff47e74032d7221901aeda88ca45a144017ed6fd8852df1f289d48fc79ccfe3a37b7d7cf45a80511d5441090c26a22125e5

memory/872-23-0x0000000000F10000-0x00000000013DA000-memory.dmp

memory/5032-24-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5032-26-0x00000000053B0000-0x00000000053B1000-memory.dmp

memory/5032-25-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5032-28-0x00000000053A0000-0x00000000053A1000-memory.dmp

memory/5032-27-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/5032-30-0x0000000005380000-0x0000000005381000-memory.dmp

memory/5032-29-0x00000000053F0000-0x00000000053F1000-memory.dmp

memory/5032-31-0x0000000005390000-0x0000000005391000-memory.dmp

memory/5032-32-0x00000000053E0000-0x00000000053E1000-memory.dmp

memory/5032-33-0x0000000005410000-0x0000000005411000-memory.dmp

memory/5032-34-0x0000000005400000-0x0000000005401000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000042001\cbf6898508.exe

MD5 f0d7cc17933d1ccfa08194664a6f7b13
SHA1 364e3de7f8caa0510cc34e2a7a8f493fd05bd321
SHA256 53e92401f3c192df25443b42c15b4a3921510d16f9600af4b48cdc4050523fed
SHA512 7b054c3e15b6478e437323fed655a07279d32b55ab568333f5fc42a377689c4e1c1e035f541bf8e48d97f7e3c53693c332e57ee82ff4f527c4ce810d55d1625c

memory/3340-53-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-54-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-55-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-56-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-57-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-58-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-59-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-60-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/3340-61-0x0000000000AE0000-0x00000000012E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe

MD5 e07def78215d8b31691e95749ae64444
SHA1 719b39241b8a2545e95efc2e933397f54415a925
SHA256 fde82aadfd48bd57bcf3acaac337ff6a5eb638e666214f629201c82bacf1409b
SHA512 17fdda98433c425472d3e2f7a094cb9deb1ad53a97bca032b749f06088e14ef103f72247d7776c7ad1532e49d8cd532b6b5cecfec657a2fc48abadbfc379f8af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

memory/5032-85-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

\??\pipe\LOCAL\crashpad_1836_CCSDIVNYBXOKNQLK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 86ff4b96195ea7e0700577b3138d343a
SHA1 87f796f2c748b6899bcc3764f24a1175e38b981c
SHA256 abbc92a4a7fcb4333844dd4af38ebc9d45f77b8b8cf63a09d7fe63dc54d722df
SHA512 8b7b51affed16926d3e01235115d283f4806aa122e61caad8ff74d74c42ca685336fafd0e74941f7587c2e2a505e5041434ad117aa155ab2e32f19f9e79f6009

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e309f3c9576df42a3b074af788bc01b0
SHA1 2cd64123a3a5ca1d949f2f61cb51d6f0d17e5fe3
SHA256 9f3ca541ae33dc9fb50016aa83e0a96cb6e7ea1eba0e1542ccaedab57541b023
SHA512 a9931500361bd03e57418ebccfa034daa4a7e48d6cec24ad49e2f222da428dcd58e25c3b30b6beb7f3720f7ed21d474132275e7f9e3b81acfb7a4cb5f2830c8e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2a7e81a724db5ec1d966b9286543d7fa
SHA1 25636662a4b109ee5ff4be909cd1c7ede5337efd
SHA256 16088d0372590b85c8777d86a6ea1fd864785d7361ae5bb2e6e8ba70d519ef1c
SHA512 90e81ba0c854b84e2c6f7de944c4093bd54cd43a8dfbd6ca099f9425c923dd28dbfb188cfc797a700fe29d69e3a0d42ee304d4fbd1d5699755c088204ea0eab3

C:\Users\Admin\AppData\Local\Temp\1000049001\amert.exe

MD5 311f8063437fdc0cff58de77c70219b8
SHA1 13847bcafb2ba6572c0fedf2e85c5ec58ae200b5
SHA256 9df4c59f3f4008a605f22bc2de04a8972c1a50ba45585a5a060d6fac8daa36d8
SHA512 cd7ce522304056deaf039d7c89d7720283e41c2520bf28026dcb5c6e6c1883c4e7ffc565592b48e698a7f0b1f3ad176d99b0ceb7244951f71bc1162c85e8123f

memory/6124-195-0x0000000000F70000-0x0000000001431000-memory.dmp

memory/6124-200-0x0000000005230000-0x0000000005231000-memory.dmp

memory/6124-203-0x0000000005240000-0x0000000005241000-memory.dmp

memory/6124-210-0x0000000005270000-0x0000000005271000-memory.dmp

memory/6124-208-0x0000000005220000-0x0000000005221000-memory.dmp

memory/6124-212-0x0000000005210000-0x0000000005211000-memory.dmp

memory/6124-213-0x0000000005260000-0x0000000005261000-memory.dmp

memory/6124-211-0x0000000005200000-0x0000000005201000-memory.dmp

memory/6124-214-0x0000000000F70000-0x0000000001431000-memory.dmp

memory/5032-250-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/6124-251-0x0000000005290000-0x0000000005291000-memory.dmp

memory/6124-252-0x0000000005280000-0x0000000005281000-memory.dmp

memory/6124-258-0x0000000000F70000-0x0000000001431000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/3340-341-0x0000000000AE0000-0x00000000012E1000-memory.dmp

memory/5032-342-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5804-349-0x00007FFA2E690000-0x00007FFA2F151000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wico3sfa.25y.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5804-348-0x00000253CF730000-0x00000253CF752000-memory.dmp

memory/5804-350-0x00000253CF7D0000-0x00000253CF7E0000-memory.dmp

memory/5804-351-0x00000253CF7D0000-0x00000253CF7E0000-memory.dmp

memory/5804-358-0x00000253CF7D0000-0x00000253CF7E0000-memory.dmp

memory/5804-359-0x00000253CFC30000-0x00000253CFC42000-memory.dmp

memory/5804-360-0x00000253B75E0000-0x00000253B75EA000-memory.dmp

memory/5804-366-0x00007FFA2E690000-0x00007FFA2F151000-memory.dmp

memory/5032-371-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d3a55e707a9a2660985215c19376d95c
SHA1 807094d3009573eb478715a6b0eab4895198f0b7
SHA256 9f6bb23c0d4e2fcfff384829b759ec568d92f4bacc57481bab7f08cd43e2d42c
SHA512 3b5062199072f8b7833b46dbbaf8114095a4bebf7454e1e90e73461323846f4155883fbddd18fbfd4880f3cb1b630e14893df03d0398fd2b2de6f0051c8bd6f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 df383ba9d8cf7ccfc2d456aef99d7fce
SHA1 d988ae0b7628dfc7a3f6824c3a8b523681d2fae7
SHA256 bbf32f712e2b7e7d2bc2cc3e4e69659ac0bef71ec36ee4886b04eba4e94fe86e
SHA512 0b98a10b7a3bfcbc2cc071995ced36a998d01c54e0a24ebd8493e14add320172d0696586957d57c93c855ae1deadcdb38f360234fb2b8adbcd70018a2f3db04b

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

memory/5032-399-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c4f6.TMP

MD5 27f889498f2d472064e9a916f1ec6d90
SHA1 c6e794dc0215e5c5e17ccf57a6fe6a669bfe12dc
SHA256 4297e8e01cac0a197de738c5966aa413c5c3359861663849797b1b10aff1c229
SHA512 a6f5bdcf1977bedbb3d930aac14ca666209a9bb3274722445a3939efcea6f4cafb42f7e7e3c2be631043e1e7c4dd5292417a56c6fd2304bcf7d27fa7c9eaccd5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f9b626d4578140481fa71d2148e550ef
SHA1 a93a6a033c2b378161bdf1b40b3f5a97601f8191
SHA256 79ea1e011a7ab9137ed3c754d5bb6ef1088163495fc45171e836478321a37fd2
SHA512 6d68d08d0cfaa8e6f64534349ab8fe9469a2631a36ab2e2e438dbb56381fb9d2217586c8642cfd6031506a3ac9cfb0cec883661fd0a53bc3768a625feb3b8134

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f21dd56fc1853a6c01b0f463a3613366
SHA1 e9a7913d46544b85c3e2bb4f058fe52743172c9d
SHA256 fae1afba4e7bd7f2a77759e4b4b85ac233177e6d8a501637416ee0cb41955113
SHA512 ff1e7b6a7c438a04fca67a5f32cd29785b4784a9925c41526b8eb8724fa4a83f111be50708845560e30628114b2b1176326a640d32f270b75b7fae3f616bf05e

memory/5032-424-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/6108-429-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-430-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/6108-431-0x00000000053B0000-0x00000000053B1000-memory.dmp

memory/6108-432-0x00000000053C0000-0x00000000053C1000-memory.dmp

memory/6108-434-0x00000000053F0000-0x00000000053F1000-memory.dmp

memory/6108-436-0x0000000005390000-0x0000000005391000-memory.dmp

memory/6108-435-0x0000000005380000-0x0000000005381000-memory.dmp

memory/6108-433-0x00000000053A0000-0x00000000053A1000-memory.dmp

memory/6108-437-0x00000000053E0000-0x00000000053E1000-memory.dmp

memory/5956-438-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/5956-440-0x0000000004B30000-0x0000000004B31000-memory.dmp

memory/5956-439-0x0000000004B20000-0x0000000004B21000-memory.dmp

memory/5956-441-0x0000000004B10000-0x0000000004B11000-memory.dmp

memory/5956-442-0x0000000004B60000-0x0000000004B61000-memory.dmp

memory/5956-443-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

memory/5956-444-0x0000000004B00000-0x0000000004B01000-memory.dmp

memory/5956-445-0x0000000004B50000-0x0000000004B51000-memory.dmp

memory/6108-446-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-448-0x0000000004B80000-0x0000000004B81000-memory.dmp

memory/6108-447-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1001109001\crWPCBdbTXjH.exe

MD5 5206b467507c1c3f64f5f9f49dceb0d6
SHA1 0ba6b5458fa207a10f801ebcf8f372c8208d216f
SHA256 e98c88f873eb09dd6b996e00d84f927110d188e7124d88efdd5067ebaa552e01
SHA512 783607b68c9eb3ff51a1a0d473585f2f780fae44cdd2fcb9344b4755940a3f2311ab081f771f0a1496244e63b920742231e4b12b27123ad523358c9bf76742db

memory/5032-483-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-490-0x0000000000B40000-0x0000000001001000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp1AB8.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 9323671875689522fa2f3e3430cc5b93
SHA1 1bc9dae1ea731355150f3680d3944cee6d6252fe
SHA256 2a6717bbc7fa0b3d81b6df45f919f9be1d9cfa547cb6b9ef17aab5b3d2f8e59f
SHA512 6a557449a4e0810b46d2d0f5c9c08b0f2b23761aa6aabffea412a1d19bebdb2a6d2a8eee27186a3e371330d625f8bcc0f646559b5c77be4e1fb4fbb8ecba4216

C:\Users\Admin\AppData\Local\Temp\tmp1AEC.tmp

MD5 c2515561b9dd345db98ed9d4fc658338
SHA1 f403e9444049165bd5f3e3176d76a39eeaebf211
SHA256 38f56b30db83047d4568ca521650ee4bcfc8a19ef972735f9dd53ebfa17881cf
SHA512 3cfd530e47ef80e73d8b92501e54ef66b961eaafbc379d013b20a71701abe5bea0caab9bd932a8769fdb2e15ac70320df9025f75ad4adc83bec8790ee96ffaa4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 160c3bd8c116dad5cd97bcbc22b37447
SHA1 6fed2f760a52d36680f5f38ed2e7c4ed53eaeda4
SHA256 2a14ab704de4dfe071a50e7f702e41cade4bb52522593d93d170788360fb4a40
SHA512 11bf5b761bc38e66b2f347f8fa9651a49b6ce5b3e8e5ec0ebfe236b3e3cbad906de7955e2acbe3fcb5e64d64b41056ecb1c00b7a6c085dbf9e7c1d925a271e16

C:\Users\Admin\AppData\Local\Temp\tmp1B28.tmp

MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

MD5 9e100a4452396a000923073088f88893
SHA1 1ec34296d56a37041e06b4a0def974b951861b1a
SHA256 f214dd3ac1015a66f93ad8b26b02613b5ad1135b06551026b166ab76166dc660
SHA512 92845c4a2cbcbcb27b58f49d6c98fd3a37a1ea4771448adca5b2fdaf6fcf7a596b8842c20c85eef8a7698b2a6378861cefe031ae4c42dd0e0c3697f634200012

C:\Users\Admin\AppData\Local\Temp\tmp1B4E.tmp

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

C:\Users\Admin\AppData\Local\Temp\tmp1B8A.tmp

MD5 d367ddfda80fdcf578726bc3b0bc3e3c
SHA1 23fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA512 40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

MD5 92fbdfccf6a63acef2743631d16652a7
SHA1 971968b1378dd89d59d7f84bf92f16fc68664506
SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
SHA512 b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

memory/5032-675-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7f5130f8643f9c281b6384704d27b900
SHA1 c384737918a1e492e8742800a251d31de1842de2
SHA256 e5a21b6e080bd51ab39ae0aa91aa0573951a52aafd2f021263141d0755e1cf8f
SHA512 ff471d00db8f4ec88cd0d52894e4f1a91ad32473cb173b7a5d431def9717cbe106c2ae431869651a3a9fc1801f9997a9d35d22a85cdb605ed98731e6dc129161

memory/5956-703-0x0000000000B40000-0x0000000001001000-memory.dmp

C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

MD5 2afdbe3b99a4736083066a13e4b5d11a
SHA1 4d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
SHA512 d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

memory/5032-715-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-721-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/5032-722-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 d4f110ac40079273946184e722bdf366
SHA1 41f8350271f15177833777f84ba7be3eac11631a
SHA256 47040de6c49a12bf7d8c64b748c57d6aa63f008a1944d02c0a3f903f43a7e0f9
SHA512 48f3facd3f3e3f0c7b36ba7326fdf7eec0a28330b202ce2d66d7151e8bf331db27b2574daca90376981af581a02a5834e12d8f0bdd09444c2abeaa1fc160dd1e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d32ae2ce1e8398524265a0d89a8177eb
SHA1 1a3022d1dca0f286299170ad8ee918a7e4ac5043
SHA256 100101baa472997761cab1d7fd2c2dfe5695eb319495e4c81f8538edc990c619
SHA512 f9e45c59eb11e9822361e005a5777fa13d8c63410fa58ff81d384ff263bf837f9b13c98ff01c3ca97daa5ae799dcbcf96a332fef8ba9b421b7d24aea210b27dd

memory/5956-756-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/5032-757-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-759-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/5032-760-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-763-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/6072-773-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5032-774-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-776-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/5032-777-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 196d0597939f8536bcc88f15ae4a7361
SHA1 cf3b03065837409bae77b17be4daa5163becd19d
SHA256 ccda980633d7aaa9e28a1ff8a29fed94930e9134f2803f50c7e41d687186dd18
SHA512 114ace0fc6bd641ecf6f8301acd23eec0531d74e9181c8370fe8b3d86e9d1e7069dc3c9803ed01d240845811ad014bdadafc319d26bf187f3ca28a044326bd44

memory/5956-788-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/5032-789-0x0000000000A30000-0x0000000000EFA000-memory.dmp

memory/5956-793-0x0000000000B40000-0x0000000001001000-memory.dmp

memory/5032-794-0x0000000000A30000-0x0000000000EFA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 876e757f997a8a81c1b296004fe73f1c
SHA1 4439d56354477b4ca3f5be68bda20116181bc44f
SHA256 aedb1cf52b714f474e8de8c8e579b7cbc712f479ad932bc217be482310678e93
SHA512 d7a71375c89a7ff27851bf37073c4712bf76fdb22b29f21a78970c48bc579bc100046e2f4b930d4a58f5a25949cb044f21515bf77293a05633c0a83a2ef91083

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e60506c6a5ed94af71de110a2252cf89
SHA1 4bbdb01d167377d64309108b3884324d07bd714d
SHA256 6e6835ea3f3a38a9b253e33ea28cbcb66ff8fcd146192155a6e67bc1695295af
SHA512 fab37cf7c903727b37376dfef46a408474e8b08141f3f8c7f26a75287285da11161660953cf75f39cf11fcd553a3aba67d9ebf561e191f00554a93e1d16879d5

memory/5956-816-0x0000000000B40000-0x0000000001001000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 23:56

Reported

2024-04-06 23:58

Platform

win11-20240221-en

Max time kernel

144s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\system32\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads local data of messenger clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\explorha.job C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2160 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 2160 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 2160 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
PID 2772 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Windows\SysWOW64\rundll32.exe
PID 4348 wrote to memory of 2512 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 4348 wrote to memory of 2512 N/A C:\Windows\SysWOW64\rundll32.exe C:\Windows\system32\rundll32.exe
PID 2512 wrote to memory of 1924 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\netsh.exe
PID 2512 wrote to memory of 1924 N/A C:\Windows\system32\rundll32.exe C:\Windows\system32\netsh.exe
PID 2512 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 1632 N/A C:\Windows\system32\rundll32.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Windows\SysWOW64\rundll32.exe
PID 2772 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe

"C:\Users\Admin\AppData\Local\Temp\9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286.exe"

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\181651180316_Desktop.zip' -CompressionLevel Optimal

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

Network

Country Destination Domain Proto
RU 193.233.132.56:80 193.233.132.56 tcp
US 8.8.8.8:53 56.132.233.193.in-addr.arpa udp
RU 193.233.132.56:80 193.233.132.56 tcp
RU 193.233.132.56:80 193.233.132.56 tcp

Files

memory/2160-0-0x0000000000740000-0x0000000000C0A000-memory.dmp

memory/2160-1-0x0000000076FB6000-0x0000000076FB8000-memory.dmp

memory/2160-2-0x0000000000740000-0x0000000000C0A000-memory.dmp

memory/2160-3-0x0000000005380000-0x0000000005381000-memory.dmp

memory/2160-5-0x00000000053B0000-0x00000000053B1000-memory.dmp

memory/2160-4-0x0000000005370000-0x0000000005371000-memory.dmp

memory/2160-6-0x0000000005350000-0x0000000005351000-memory.dmp

memory/2160-7-0x0000000005360000-0x0000000005361000-memory.dmp

memory/2160-8-0x0000000005390000-0x0000000005391000-memory.dmp

memory/2160-9-0x00000000053E0000-0x00000000053E1000-memory.dmp

memory/2160-10-0x00000000053D0000-0x00000000053D1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

MD5 78fded861ee10154e352255f122fb24b
SHA1 20a1d121c19335780a4e17ba08149952a1c33a2b
SHA256 9154a18a38f02d6d98cca101ee9353b295d0b78effd038c56e7d195538f6e286
SHA512 ce227dfbf96897d249d8114cebd53ff47e74032d7221901aeda88ca45a144017ed6fd8852df1f289d48fc79ccfe3a37b7d7cf45a80511d5441090c26a22125e5

memory/2160-23-0x0000000000740000-0x0000000000C0A000-memory.dmp

memory/2772-22-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-24-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-26-0x0000000004E60000-0x0000000004E61000-memory.dmp

memory/2772-27-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

memory/2772-25-0x0000000004E70000-0x0000000004E71000-memory.dmp

memory/2772-28-0x0000000004E40000-0x0000000004E41000-memory.dmp

memory/2772-29-0x0000000004E50000-0x0000000004E51000-memory.dmp

memory/2772-30-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

memory/2772-31-0x0000000000E80000-0x000000000134A000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1f2phri.geq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1632-51-0x0000017D49550000-0x0000017D49572000-memory.dmp

memory/1632-52-0x00007FFBC2830000-0x00007FFBC32F2000-memory.dmp

memory/1632-53-0x0000017D49540000-0x0000017D49550000-memory.dmp

memory/1632-54-0x0000017D49540000-0x0000017D49550000-memory.dmp

memory/1632-55-0x0000017D49540000-0x0000017D49550000-memory.dmp

memory/1632-56-0x0000017D496F0000-0x0000017D49702000-memory.dmp

memory/1632-57-0x0000017D496D0000-0x0000017D496DA000-memory.dmp

memory/1632-63-0x00007FFBC2830000-0x00007FFBC32F2000-memory.dmp

memory/2772-64-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-65-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-66-0x0000000000E80000-0x000000000134A000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

memory/2772-77-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-78-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/3080-80-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/3080-81-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/3080-83-0x0000000004B10000-0x0000000004B11000-memory.dmp

memory/3080-84-0x0000000004B50000-0x0000000004B51000-memory.dmp

memory/3080-82-0x0000000004B20000-0x0000000004B21000-memory.dmp

memory/3080-85-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

memory/3080-86-0x0000000004B00000-0x0000000004B01000-memory.dmp

memory/3080-87-0x0000000004B30000-0x0000000004B31000-memory.dmp

memory/3080-88-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-89-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-90-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-91-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-92-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-93-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-94-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/4452-96-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/4452-97-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/4452-98-0x0000000004B20000-0x0000000004B21000-memory.dmp

memory/4452-99-0x0000000004B30000-0x0000000004B31000-memory.dmp

memory/4452-101-0x0000000004B50000-0x0000000004B51000-memory.dmp

memory/4452-100-0x0000000004B10000-0x0000000004B11000-memory.dmp

memory/4452-102-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

memory/4452-103-0x0000000004B00000-0x0000000004B01000-memory.dmp

memory/4452-104-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-105-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-106-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-107-0x0000000000E80000-0x000000000134A000-memory.dmp

memory/2772-108-0x0000000000E80000-0x000000000134A000-memory.dmp