Malware Analysis Report

2025-03-15 04:38

Sample ID 241027-1sqcbstgpr
Target SaDesign download.zip
SHA256 14dd7f0f6ce271254c164be12906aef50846bca872c2b3e42030146953db7116
Tags
defense_evasion discovery execution persistence pyinstaller spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

14dd7f0f6ce271254c164be12906aef50846bca872c2b3e42030146953db7116

Threat Level: Likely malicious

The file SaDesign download.zip was found to be: Likely malicious.

Malicious Activity Summary

defense_evasion discovery execution persistence pyinstaller spyware stealer

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Hide Artifacts: Hidden Window

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Browser Information Discovery

Detects Pyinstaller

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 21:55

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 21:54

Reported

2024-10-27 21:57

Platform

win7-20240903-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SaDesign download.zip"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Wlndows\python.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A
N/A N/A C:\Wlndows\python.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows System Driver = "C:\\Wlndows\\Windows System Driver.lnk" C:\Wlndows\python.exe N/A

Hide Artifacts: Hidden Window

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Wlndows\python.exe N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907d7d04bb28db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000091b3f49f9166adf6946f0d6bfc1c7baab41af4de202e1c6720ee3940b4aeddb6000000000e80000000020000200000009978bb154abb7119a0ab518b0b57002b9ec5e04be763495dbcfe36c18ac2e268200000000b0dfb292f5fd18ee92daa86f1b3d5c07408957b5ce348980c75032410a13b8b4000000088183db57141df3c46b8214dc5203c8843e461377218d9fb581303b32887c9f723bd7f51e2c2b48fd747642de70be5be61a44892aa055dcf1084141ab77a7b4f C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F147181-94AE-11EF-B939-7ED3796B1EC0} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436227998" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000390681a358f88c06ddb617905de7399f18b664b879d67429813bd9e05784f3e0000000000e80000000020000200000002566a20eaabea09d84abc978a6dbd3765be30391f53fb092c4d35552469cdd9b900000008ef7b5353fb759df39e345914eea27078a1eb7ff0a58b30ff213aa19f6a765f56e3523ebacf16eed2aef73afad055603ba779f53def4e77352ae235f0952d5e10ddb5fc22b02c1ff9ff20166079c477e4efc6fb733f057cff67113822044d91810dc704f8870d7ae11635ff7e21fde3c39b0bf87c2970cc3d73358d814aaeba75eda3d1ae989dbe6e65ac5d88fd4eeda400000007d87b682333a2a915dc10eb29eb921321c68157c5ec24ce491d1f441a772ee262f4ec2e7c44ad68c47c32077c72799a851029770dabc291565ce595077242d52 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Wlndows\python.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Wlndows\python.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2572 wrote to memory of 2560 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Users\Admin\Desktop\SADesign Setup.exe
PID 2572 wrote to memory of 2560 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Users\Admin\Desktop\SADesign Setup.exe
PID 2572 wrote to memory of 2560 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Users\Admin\Desktop\SADesign Setup.exe
PID 2560 wrote to memory of 2316 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2560 wrote to memory of 2316 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2560 wrote to memory of 2316 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2316 wrote to memory of 2028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2316 wrote to memory of 2028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2316 wrote to memory of 2028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2316 wrote to memory of 2028 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2560 wrote to memory of 3900 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Windows\system32\cmd.exe
PID 2560 wrote to memory of 3900 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Windows\system32\cmd.exe
PID 2560 wrote to memory of 3900 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Windows\system32\cmd.exe
PID 3900 wrote to memory of 3932 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3900 wrote to memory of 3932 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3900 wrote to memory of 3932 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3932 wrote to memory of 3988 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Wlndows\python.exe
PID 3932 wrote to memory of 3988 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Wlndows\python.exe
PID 3932 wrote to memory of 3988 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Wlndows\python.exe
PID 3988 wrote to memory of 1892 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 1892 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 1892 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 2084 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 2084 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 2084 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 1628 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 1628 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 1628 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 2816 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 2816 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 2816 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 328 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 328 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
PID 3988 wrote to memory of 328 N/A C:\Wlndows\python.exe C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SaDesign download.zip"

C:\Users\Admin\Desktop\SADesign Setup.exe

"C:\Users\Admin\Desktop\SADesign Setup.exe"

C:\Users\Admin\Desktop\SADesign Setup.exe

"C:\Users\Admin\Desktop\SADesign Setup.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://sadesignv2s.blogspot.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c PowerShell.exe -WindowStyle hidden C:\Wlndows\python C:\Wlndows\src.py

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell.exe -WindowStyle hidden C:\Wlndows\python C:\Wlndows\src.py

C:\Wlndows\python.exe

"C:\Wlndows\python.exe" C:\Wlndows\src.py

C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe

PowerShell.exe -WindowStyle hidden -Command "Stop-Process -Name browser -Force"

C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe

PowerShell.exe -WindowStyle hidden -Command "Stop-Process -Name chrome -Force"

C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe

PowerShell.exe -WindowStyle hidden -Command "Stop-Process -Name opera -Force"

C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe

PowerShell.exe -WindowStyle hidden -Command "Stop-Process -Name brave -Force"

C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe

PowerShell.exe -WindowStyle hidden -Command "Stop-Process -Name msedge -Force"

Network

Country Destination Domain Proto
US 8.8.8.8:53 sadesignv2s.blogspot.com udp
US 8.8.8.8:53 kingcambodia.pythonanywhere.com udp
US 35.173.69.207:443 kingcambodia.pythonanywhere.com tcp
GB 172.217.16.225:443 sadesignv2s.blogspot.com tcp
GB 172.217.16.225:443 sadesignv2s.blogspot.com tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
GB 172.217.169.36:443 www.google.com tcp
GB 172.217.169.36:443 www.google.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.200.46:443 apis.google.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 142.250.178.10:443 ogads-pa.googleapis.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.73:80 crl.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 adsmanager.facebook.com udp
GB 163.70.151.23:443 adsmanager.facebook.com tcp
US 8.8.8.8:53 business.facebook.com udp
GB 163.70.151.23:443 business.facebook.com tcp
US 8.8.8.8:53 graph.facebook.com udp
GB 157.240.221.18:443 graph.facebook.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp

Files

\Users\Admin\Desktop\SADesign Setup.exe

MD5 71934bbbf49c5d75477501d19051bb81
SHA1 b5b8240355fbf700f72092c5539c0e22c05bff07
SHA256 41dcd615f760e42fe3f3e041328d845e84b66eadb24bb1acfa8b790892098aa1
SHA512 f06cbb49a2d6a56d06983195a3ddf4d785dbb17882f08a22bb2585f48e9f6f7cf7b902b17a829476d2babe04c20a8a0c23691e3f39fb6bd8ade96017276911a1

C:\Users\Admin\AppData\Local\Temp\_MEI25722\python37.dll

MD5 c4709f84e6cf6e082b80c80b87abe551
SHA1 c0c55b229722f7f2010d34e26857df640182f796
SHA256 ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
SHA512 e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

\Users\Admin\AppData\Local\Temp\_MEI25722\VCRUNTIME140.dll

MD5 89a24c66e7a522f1e0016b1d0b4316dc
SHA1 5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42
SHA256 3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
SHA512 e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

C:\Users\Admin\AppData\Local\Temp\_MEI25722\base_library.zip

MD5 36a7e91278001d8c1e081f4fa6e1ac3a
SHA1 c67b2d279bc42822aed811ecdc68085afbe6aa62
SHA256 661e69ec7537840cdc5bf827f613c1eea7cdf2636add1d1cc94cc5b02d90c19e
SHA512 819788ca470308137ab4c98534f26dcdf16db2d7947b074b239e06743b04bc106d888280019c60a5f4842306e735126f73471464abf6876caf2edbdad18d0535

C:\Users\Admin\AppData\Local\Temp\_MEI25722\_ctypes.pyd

MD5 5e869eebb6169ce66225eb6725d5be4a
SHA1 747887da0d7ab152e1d54608c430e78192d5a788
SHA256 430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173
SHA512 feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

\Users\Admin\AppData\Local\Temp\_MEI25722\_socket.pyd

MD5 8ea18d0eeae9044c278d2ea7a1dbae36
SHA1 de210842da8cb1cb14318789575d65117d14e728
SHA256 9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2
SHA512 d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0

C:\Users\Admin\AppData\Local\Temp\_MEI25722\_pytransform.dll

MD5 352364081ca2bc10f3df4469f85c2867
SHA1 57afb0cd49df30d9cd88ae3df5b900e063f2d84a
SHA256 8d8f34f18648f880ee2e1d679197ef1421f6e809ad860943bd1ba37b5f683437
SHA512 55d19ac0daab1e7109e848d33e8613b771d7ca68219fc3aa043ae63360b546db3c60f4aac22b2ac0d718e8ba77effd3d2b5770b1986416a40470c941d47c4138

C:\Users\Admin\AppData\Local\Temp\_MEI25722\select.pyd

MD5 fb4a0d7abaeaa76676846ad0f08fefa5
SHA1 755fd998215511506edd2c5c52807b46ca9393b2
SHA256 65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429
SHA512 f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f

memory/2560-104-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-102-0x0000000002C20000-0x0000000002C21000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI25722\_hashlib.pyd

MD5 b32cb9615a9bada55e8f20dcea2fbf48
SHA1 a9c6e2d44b07b31c898a6d83b7093bf90915062d
SHA256 ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5
SHA512 5c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe

C:\Users\Admin\AppData\Local\Temp\_MEI25722\libcrypto-1_1.dll

MD5 cc4cbf715966cdcad95a1e6c95592b3d
SHA1 d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA512 3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

\Users\Admin\AppData\Local\Temp\_MEI25722\_ssl.pyd

MD5 5a393bb4f3ae499541356e57a766eb6a
SHA1 908f68f4ea1a754fd31edb662332cf0df238cf9a
SHA256 b6593b3af0e993fd5043a7eab327409f4bf8cdcd8336aca97dbe6325aefdb047
SHA512 958584fd4efaa5dd301cbcecbfc8927f9d2caec9e2826b2af9257c5eefb4b0b81dbbadbd3c1d867f56705c854284666f98d428dc2377ccc49f8e1f9bbbed158f

C:\Users\Admin\AppData\Local\Temp\_MEI25722\libssl-1_1.dll

MD5 bc778f33480148efa5d62b2ec85aaa7d
SHA1 b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA512 80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

C:\Users\Admin\AppData\Local\Temp\_MEI25722\_bz2.pyd

MD5 cf77513525fc652bad6c7f85e192e94b
SHA1 23ec3bb9cdc356500ec192cac16906864d5e9a81
SHA256 8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41
SHA512 dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9

C:\Users\Admin\Desktop\version.txt

MD5 a874ad7d3bc6e09b19194f366dc1d420
SHA1 80167c78cda93053b57c77ac886e525b3e04e522
SHA256 96802892f3eef1ecf144d0f49d1e945dd639eb112de34412af446b4940cb7066
SHA512 200591307baa709428ad9cef2b7c6f35f3cb1fd3e205a583f06194b4e7e2602c5abf8928a7235fc3e257edbcfdfbf7ef53b0e467b7bdab81e1ebec6ee84dacfe

C:\Users\Admin\Desktop\index.txt

MD5 e064507c8f610eb05e45d32778e50dfb
SHA1 ce2d36a18488f1c30ea95286c0ee35b10ddc9f4b
SHA256 93075b905f5377d77714f3887366243f0808ff36f67a072ffbb1bbead8a87555
SHA512 d329fed737116f5e928436afc9dd213238ddb43f1d9b387603d8c3f79522a018d1f7c05c54f48ea24e62bc1fb71d867e87fc8c86f55a0457ba055f42656d6f65

C:\Users\Admin\AppData\Local\Temp\_MEI25722\unicodedata.pyd

MD5 4d3d8e16e98558ff9dac8fc7061e2759
SHA1 c918ab67b580f955b6361f9900930da38cec7c91
SHA256 016d962782beae0ea8417a17e67956b27610f4565cff71dd35a6e52ab187c095
SHA512 0dfabfad969da806bc9c6c664cdf31647d89951832ff7e4e5eeed81f1de9263ed71bddeff76ebb8e47d6248ad4f832cb8ad456f11e401c3481674bd60283991a

\Users\Admin\AppData\Local\Temp\_MEI25722\_lzma.pyd

MD5 5fbb728a3b3abbdd830033586183a206
SHA1 066fde2fa80485c4f22e0552a4d433584d672a54
SHA256 f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b
SHA512 31e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb

memory/2560-100-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-98-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-96-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-94-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-92-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-90-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-88-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-86-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-84-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-82-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-80-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-78-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-76-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-74-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-72-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-70-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-68-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-66-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-64-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-62-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-60-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-58-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-56-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-54-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-52-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-50-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-48-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-46-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-44-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-42-0x0000000002C20000-0x0000000002C21000-memory.dmp

memory/2560-41-0x0000000002C10000-0x0000000002C11000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 13a1ea8556daa3eefb6963b125182958
SHA1 fe62660b374ed20f08ab86068c1a75f1e4e56e39
SHA256 52561ff07f30bbf5e2acda9bef43f8c72852cc11e2c041f32467148a5cf01508
SHA512 0c657718e68b3306f424a6c88f84d8e70a7cf8c7d8291827b9223bcd496df0f52ffb02ed098651f80c4586f0b9b46bfa13ef85b5b944f9a75f4b334095fc6452

C:\Users\Admin\AppData\Local\Temp\Tar410A.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\Cab4108.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6f5309931466cd137936aae5f62ddcfc
SHA1 41874eb1016801d4679861bff1b4c1d54698402b
SHA256 67d34b3f0f10678f4e1a70199b9b4f66fec1fab3643a59808ff0197331323754
SHA512 b5e495b42479b1109ae0bfd0c6e889c4fe1621381bc8ed31006eedd7222adf2362b01bc20efa01e9826dafe54db2f49eb513cffa1b00b3a7543d686cbf365b94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1193fd5738db079ff54d40ff15ec203d
SHA1 07d392e11a72d781b3ca24ead1f4dfbce9e48698
SHA256 0d492ba66a95f36095a0151c6d7eea4c175a9171167c827a3444867ccc356b6e
SHA512 5ec3879678bcb38627597fbab99a131f3b10aa401df9a21f46c060a6e17c166fd9fb9bfc5e87b52e487c95d6d447b186a3b00ca663af15a5af1799de4b750f7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 af58f799fb294bab0bf4ff658a65e028
SHA1 13da44fa7cd72682c0b7aad3e5f4b8900125fa6f
SHA256 12f55dbb5456258a2d92116a240b15d91769a4d32838aad2c77b7b996c187dfc
SHA512 651a19e82ad36fdcd4f0206f895002c3ae980e9b7a63b4db6e717aa07828825ab3f465e3719e1f34db1ff416a7b99f6a815226c89cbe82b8cb850dbde7ac5d05

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ae7101a837ac52b03586ed1f955573f6
SHA1 bebf4584f036d88f9f3e3940fa2b9c9dbfa336f9
SHA256 9b02420940848b26a5cf9b5e0a2669b4f8a83f41acbbad26eae410508faf794d
SHA512 ad98fcb0a57357e1be246edc21606248e2176c66764ed07b52d2768ebe95810be7b10184e760f86ab08175e409b20e4a2f44d6a6084ac2cf41a36fa5f7bc85a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c44aa303d8daa5b331d597063b37af50
SHA1 949fa7ed9d848b27ec2f62c6ae0753700dda7297
SHA256 7b908b5e76f2817458fa6b8cdd1d8300d3ed916d786d12c6e33f64ab9a19968d
SHA512 ec6888aae508e96efffd4dcfa14deb158ecc821e0ddcb80cd8818e77605fc5dd39e0afb90387b599438bc54a30e02e257b8c3771372dd26349069a25c227a922

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8dd38f67ef67dc1cbcc3cbf7a719d859
SHA1 3e6df8e9dc0f8e252be852d1984a35f4f3516b8e
SHA256 cf05ad703baa365d5663bb6e36989d191e5e87f3063d8bbd9bafd29f8143c057
SHA512 f247e8546cd431b797d5fe70126d99d1fd03892be9433ae26cb9845c079b8618de201dbd4a46010520e4d023a94d56e355225de8d00f86b3afa2996a3d9c0813

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 192ad74223a4b9d497ef1d09d099f61b
SHA1 a6dc865755e611fd075e199f6511af9d814c9211
SHA256 fbfd5dc39cc8c8b2ec38771162a4a585ee77b3584fd9f786d2a0d46679326afd
SHA512 579caa428ca93c1ecfffc62866c8b8cd74c5c2ec5111ef1689b77cdec14c564c62cd335ae2e14f4d65e1345411b39d44d7cae8212f20926737cf5e1822ba14dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d985e037c9f1c62c51f351c6a0430d8
SHA1 8f07993be7d314fc807370f8000f87c2e1d0dc82
SHA256 4456488467f1b675c9d4b885ecf716f7aac3348d284acff3f63fdd83f05b36a5
SHA512 9d9f6dc1bc907d3fbe6e13c2254cf1139d09c0af30354c1f209539f551d0ea5a82765bfa5890f5f803ea776655230d294cd01a5cacd92cc1fb775ffb2006fe43

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d62ed119913c8bc3a3b224979a80d1c
SHA1 cb38dd38e82bbb766a0b4e62bcd31fc23fe8175a
SHA256 816962afc6a1c907c9b6995e1bd5991544073bd0a028c6463d7237c1e37fb03b
SHA512 387150149652129fe47b165249b73bb3659ba827e8e472b08a8e6be48fa1bdd24ea6f2764b26898bd5bffa6695858e0dcb05e3d7147d99b84efcfccb5a5744c5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a144b62cadcad213d9f69fb94188138
SHA1 5116e1b6bc610c3a309f46a75470f62016a0cd33
SHA256 440fd2338d2cfb584efd6dc22709832d8a338ee6a581ed81aaf7c99bfdf9412e
SHA512 6fc50136b61e8a02adaab78ab56baef14c4dea76e6a49eb5bd8e3ab6a7d3b0c16933088b72677b9e15741de908f398c9c5b2057cde207d7168376be999d15865

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 80e7951a02b9cc2ba53d34ff954073d1
SHA1 774c33fe9019b34da036db94f0c8ad926b315b2e
SHA256 8e35cd531cf8a6bc3c4a51fe14f623884bf3d508002762cae5990ef1342ab49c
SHA512 f80b10c74cbe0dd59f70d199715b57fc476bf263339baf3d2f6177ce74108c125e75128bbdac07c98c0736654e1ee3185a266472c0a14649f32037ffc55170e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 754e4d3ad01fa73a31ad46f2221fc5cb
SHA1 110d69d6afec502d11fd9f3d3b6107dad57add7e
SHA256 d047ddceb17826b3f672f435fc5e5a823df07f4df883ad5b19f0e30f7f6e5b16
SHA512 1b377cc1c700d82730823837849c14a8f90108faba97da38a992cd9a79a602d12b5e6a52bd97135f6d5e038cd79f9acf0b92cba02537e1b9b792b5b5f2936c85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9899abaa01b2e496c4fcf3c6644af32e
SHA1 93c5f32f7861fab40c3691d3fc9edc70f3433f52
SHA256 0ac8a97c41da5d2ad1908795e0c689ffa74a8b6c6e48c7961ff2690af0a32458
SHA512 e1be3c9de87249a34909377d373a5b69a8232136350699555834b1e9b160f164b623e21775247b01fab2e83bb151986905a7880b01d4691bbdaa9be2f7e8db95

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ffabe139a049ab29bb1a6f6dc60421e3
SHA1 6bbfa4a37d0cb7d64f475a765e9cd8c9b8e582d4
SHA256 ea76c8c07f14027a6e1a67977af8f900ad5bc08b189cff5b60b1a650a4db42b7
SHA512 a11d670ad38cf2bc130faa54fb150f35bdf639094b8bd3f6af025ff4f2b78bc5f77f5197f7123fac070688b7c93615dcda37a277fb69158f09f71baa245f8643

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 72815a4957437e0ce4a341fd2ec6f117
SHA1 f8eee95490e05a1593677c60b7055774ad0e9dca
SHA256 9cb479d49cce21949c9555520e443dfd249a604be9a11d12d473215dffd22a04
SHA512 7c3b4e7845190b7857731d1e7554734619ddb6bb213a7731bdc2009f145593b3ff5750176075b0b7cc33af731ecce005bfd084a6aa66b84b7d09cdbfb3e084dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9afba2c07d2b39131c36f26df031468a
SHA1 382416838a3a4ceff3c789dc3f8864b3624a1e10
SHA256 704a0167ee06870e1cfee4bab2e8e11f66dc962ae346ccb7e2d0dc294932b0a5
SHA512 9d2d3cbec7d900bb6cde1b153d08d5286cb6919c6fd79a18949060906759b324a3b059d7439edd3296c22b93aa5bd077648bd3dea2dc4971f4a4bfdbb37eae85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6d6f88ea9f0f64bdefbd57b356160d3
SHA1 a50a47106c2c3797aa160b62adccfd300dd46c81
SHA256 715dca7307070562f66818dd101faa4b10fa3305765f053d6869954c413a1c8c
SHA512 6cfe11f65b9b80d7414e1c923e5521574234339864a6a0e9cdf37a3f4caf5d288d363b2c6a9c1061fcb7264c168e74c786f13c8612d737cc8c1907f118af9aec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 b03479bdf1f22a29495b497987442bff
SHA1 f3c5a63b3c90bd1f589200a386402e5c08a63b73
SHA256 9f624e2a76829b9e1c93a2f8cbc23088f316fa06fafb96f025c2dd8c93857598
SHA512 8b7ee3f324fd05f3851d01e43c5abb588ded0364a25c0bf4bf63369f687da453e3b8f252630b38246c174d57d5545159bd1fee84be81d5030702b3dc105de5aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7b9abd22b82ceeb542f80a2eaac6ffa6
SHA1 11dd4d0a406c4093080cb184de3bde06666ec3d5
SHA256 4950509112fa90459af1f5e67574ceaf11c41647112013e444e6d0bfdfdb0ee4
SHA512 6e359e9291759acc19eab8b77aa0ae7f77a45591f50987548373a414dbae12c66f268d8d9466ee0358b5194a9606d8f349aca9373d83ce429895e5beba27b486

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 09dc711073c6e5e9e83b49ea21023ec5
SHA1 7606dc3ff58d87ea961cd4c362cf691a47866d40
SHA256 a790f9f94876192ab203bf221939fd04823c89cbfc2857e5f4767ef5b60a5cc7
SHA512 611265dcf739faf838d34149fc4aa8e0c249446c39d10d099e8412bbb506b09f3bc7554656c89efec6faaf11ee319ea9594f1bba52d1b200849d07727715afa0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 477aa01eba6b22e5192de433b5571dbc
SHA1 56fb5b25a168401af620380fe3e7c4765e76d20e
SHA256 f38c77ae31310b15283c036697e3ee9a8df8b46dce4aaec3a3d36ff4e6d460f0
SHA512 31bd7aa4d6b4cbd04904a807d113a7723cc3c2203ca802af64dd68d3d2c72ede20b1f5573362c6e16f1f66d3ff84c7b0c06cd7b8c7822f6738dd8f77946bd400

C:\Wlndows\Lib\site-packages\pip-20.1.1.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Wlndows\Lib\site-packages\pypiwin32-223.dist-info\top_level.txt

MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

C:\Wlndows\Lib\site-packages\win32comext\internet\__init__.py

MD5 f45c606ffc55fd2f41f42012d917bce9
SHA1 ca93419cc53fb4efef251483abe766da4b8e2dfd
SHA256 f0bb50af1caea5b284bd463e5938229e7d22cc610b2d767ee1778e92a85849b4
SHA512 ba7bebe62a6c2216e68e2d484c098662ba3d5217b39a3156b30e776d2bb3cf5d4f31dcdc48a2eb99bc5d80fffe388b212ec707b7d10b48df601430a07608fd46

C:\Wlndows\Lib\test\test_importlib\frozen\__main__.py

MD5 47878c074f37661118db4f3525b2b6cb
SHA1 9671e2ef6e3d9fa96e7450bcee03300f8d395533
SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
SHA512 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

C:\Wlndows\Lib\test\test_importlib\source\__init__.py

MD5 c3239b95575b0ad63408b8e633f9334d
SHA1 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc
SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
SHA512 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

C:\Wlndows\Scripts\pip.exe

MD5 0f9744d1966d4533d699bc032988861c
SHA1 4bed13577edc66fe3b233d337e63311ea340f2e5
SHA256 13336ee5367921de58e62953feae96069cf90c1343f6957b3b402c4380de6e0a
SHA512 138c09474591637927e0d8b561cf1b86a89460335c7b30eabc4572f8deb706072f98f6cfe9cfa9afcd5c2d8b38869ad964c7df71de07078bf7e8f2680275c930

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3932-9280-0x000000001B5A0000-0x000000001B882000-memory.dmp

memory/3932-9281-0x0000000002240000-0x0000000002248000-memory.dmp

C:\Wlndows\python.exe

MD5 210c0cb186955620494f9df28f403a07
SHA1 2f5959d130bbf597d77d7d5ae53846bc353dafd2
SHA256 0c170406f111b3d882c885b31b9de075ccca7e2cb25b4851ebc75646d92c8b18
SHA512 20e2157a25f28f49a4ff167f5e514b71855a221840412e2b926220e2f2f11cdcd74a1b97eb9a0ec55bca3a77ee1614731f2cc86ea6b25b86e306c3572e0c60fb

C:\Wlndows\lib\encodings\__pycache__\latin_1.cpython-37.pyc

MD5 bee4fa45ac8f0abc28c6f8fed791ddf0
SHA1 5d33909e1c09362626d697d072e47eb7866328a7
SHA256 6f510dc84e89a556be5175a93d08ef32ad038bddff5a6d325bd17782e5b76d46
SHA512 a85a6ec4f5591d1dcc1ab9c59b7732e262373288036c92c8c320e00ace116cb894fda0f23461854d8ef10dddb2819b2a05843992b254393fc571846cd49cfc5f

C:\Wlndows\lib\os.py

MD5 8861f25fa83ea97bd4b7f1ea8f2a42f4
SHA1 dda4e989d098012be9d1ac9058d7a4f584602550
SHA256 0d2e9b0c308d8120d3a459abcdfcee65d8c25d8197ecf84fe9107fa225a35580
SHA512 cdefde1ca5de75297f7dac01c6a61bb3d309be707934f97a4014571c4c29a57b3c47369bbdec338fb88cf46d843bc222a62317806a979e4e2e595135ec9d9786

C:\Wlndows\lib\__pycache__\site.cpython-37.pyc

MD5 257a7e30bec7c657f3a8a59fc29d4e81
SHA1 47581a38546b050795c89d7a6da830731b2c3b59
SHA256 16cad55c67214f4ba8db6f334e970f54087e5376fa2f06166e1bbf971819c256
SHA512 87faccde170f260125bf5409f4900ea0368fdb741858ba582ea544f1e01425b1a37edb3b459cbdebd06f0f5a08fda444998dcefddf954b661b4edbba33953448

C:\Wlndows\lib\site.py

MD5 e5b9b2dc3e0031de36b0a88e3fa6d09d
SHA1 11046a702cf5ad24c543abdf7c52e1f425c5f6fa
SHA256 a14becf95970e6cef177c4d644de0ded34888bdb0a0f1b7ed1d39c98a15d2b82
SHA512 bca02c93da3635f658b6e858674d932fe0de3db0beb7b5ef8822416c9fdc670561d7af199d91e127206f281cb7751239bb481e00aebf95dec90fcb1d7165bd2f

C:\Wlndows\lib\__pycache__\abc.cpython-37.pyc

MD5 372baa52e5bb7a10f93dadeef747df73
SHA1 cc50e997b2dacaabe262f3695e87e99db70be223
SHA256 0c3b9c2ba6806704b41f1aa7e9bfe0d14627dae45e7e9d694221c2a4029e8ed0
SHA512 feb46ab06a8df0b9ed062fd762a4af6b8781179b046f7d417578ae3b2d9242027fb6a0406028b22734e4e3d5ca57b84e7a6a4f300b58a78d99903001a4c9d79e

C:\Wlndows\lib\abc.py

MD5 17e3407344267dde764ecaa542cccd4d
SHA1 ec774abd2a9aa2729a8af6a9cd67dfb22fd0acae
SHA256 f3bbcdb6406b9f9a3467ecd5a8ba74f1accb36adc95aa50d805c2927f09a2304
SHA512 850b5f7293ac61d41eb5e13791aac643858daac0950ed1271ac1f3534184f8f379c248e94e63a9abbb699ae4436e4324a96daf5465abc6a50cbe99887024e1f6

C:\Wlndows\lib\__pycache__\io.cpython-37.pyc

MD5 1cdb15b45b323d734e0d7711e89ad270
SHA1 965e9a2659994b6c809e28c56c43a1ea6810c127
SHA256 650cab1ca9285e02e77f711a37a2f72532442677a0b9b76e295feb38950c0709
SHA512 9e35aba2003427a7309dfe0f0bf153be4b4f894dead9cda74f5362bf91a448a7a7251e660c6db7133d7798e402e40fda1c44ea42fa9b6dd82967e71f5c5d00ea

C:\Wlndows\lib\io.py

MD5 2c098fb1d1a4c0a183da506daa34a786
SHA1 55fb1833342ad13c35c6d3cb5fda819327773b21
SHA256 f89251a16945f7c125554cc91c7e7ed1560b366396c3153a4cadfb7a7133cd03
SHA512 375903e7bf79cf6c8e7c4decff482f4b59594aaaef62e01f1f45d0f9e26f9e864690d79cdfbdcf46cd83562cc465ef419cac32739d35bcb9fe6124682a997918

C:\Wlndows\lib\encodings\latin_1.py

MD5 92c4d5e13fe5abece119aa4d0c4be6c5
SHA1 79e464e63e3f1728efe318688fe2052811801e23
SHA256 6d5a6c46fe6675543ea3d04d9b27ccce8e04d6dfeb376691381b62d806a5d016
SHA512 c95f5344128993e9e6c2bf590ce7f2cffa9f3c384400a44c0bc3aca71d666ed182c040ec495ea3af83abbd9053c705334e5f4c3f7c07f65e7031e95fdfb7a561

C:\Wlndows\lib\encodings\__pycache__\utf_8.cpython-37.pyc

MD5 917f905205ba7fe1184b019e189695cc
SHA1 68172d1b20fb8a9b2f7793b524e7840028be7e38
SHA256 a645bdd574d89c526efa1d79cad58abab882536717b4449956f1fab4021c765a
SHA512 f952077915af5edd793b13cfbb603dc9461e2801b9aef0ed8ce04e9b8957c3be911a23592a8ee674e13d9b4f7b4e9840580d1570f236caee6bd639e1932d11cc

C:\Wlndows\lib\encodings\utf_8.py

MD5 f932d95afcaea5fdc12e72d25565f948
SHA1 2685d94ba1536b7870b7172c06fe72cf749b4d29
SHA256 9c54c7db8ce0722ca4ddb5f45d4e170357e37991afb3fcdc091721bf6c09257e
SHA512 a10035ae10b963d2183d31c72ff681a21ed9e255dda22624cbaf8dbed5afbde7be05bb719b07573de9275d8b4793d2f4aef0c0c8346203eea606bb818a02cab6

C:\Wlndows\lib\encodings\__pycache__\aliases.cpython-37.pyc

MD5 f737e3edf50fde6ff01c96f693b6c54c
SHA1 b10bf91edfb25cd46bb8f5977164ee77ccb14304
SHA256 4321aa24020047eaf49e23ade0ecda51d979593ba93aa370c817033ac6052626
SHA512 535a1f8fc07d87183bf144b1c4ffc0dea7c6b88f285554bbb1311bb0e1b7e5097998e04bdec021c1eebcebdc612b104f36ea1c91bdebf180088a10dc65306e16

C:\Wlndows\lib\encodings\aliases.py

MD5 794677da57c541836ef8c0be93415219
SHA1 67956cb212acc2b5dc578cff48d1fe189e5274e4
SHA256 9ed4517a5778b2efbd76704f841738c12441ff649eed83b2ea033b3843c9b3d5
SHA512 33c3fa687ea494029ff6f250557eaaa24647f847255628b9198a8a33859db0a716d5a3c54743d58b796a46102f2a57da3445935ca0fef1245164523ff4294088

C:\Wlndows\lib\__pycache__\codecs.cpython-37.pyc

MD5 b66abe73818e7d5117c8cca353d26d2e
SHA1 4ea54e8da95abe590b49306e8e2bafd419e96b38
SHA256 76422afbfdd9eb471239ca033ba9847a958ce495677560ec0c4801265a56bc0d
SHA512 ad72c3961ca1288b2c062c7fc5be2f8d664e05437d4e79402dd7830201ba93937135e11c90acb6a4ff6c4d51256b9aac18ab5d94a799fa4fd2a05d89c29fb435

C:\Wlndows\lib\codecs.py

MD5 411d74f08e2b80fc334ca606ca58d8a7
SHA1 380f5492b7913726cb533e78bb7f3bfe574647d4
SHA256 6bf9afb28ea22130ff4e134853976a06964cddb565205e667d9b8657852000c4
SHA512 3460f9b470c76c2792559f3eae39f1784e5fa58d70f448f84da461c66b19d86469f40056693e415e56cf46ee475d8c80c7d97690fb25ea0328f80ca011f560c9

C:\Wlndows\lib\encodings\__pycache__\__init__.cpython-37.pyc

MD5 60394653c0c18c652e4d386e1e50ad68
SHA1 d23dc28f3eef6cb272efbb21fdcb739daf2649e6
SHA256 5ccb434248dd5b8d3b53d2f38349abdd141b0830c7f0de27da7684c134c46629
SHA512 afa6d9f368cd77717b71d468a878edf9edffdb86b94cafea928a6e36698beaf01a7f8728b2ae1d732d4fd2af17400deef574b4b58c041d8fab0d4fa00e81f03d

C:\Wlndows\lib\encodings\__init__.py

MD5 82afd9dcb28c19afdc42097fcbdbe662
SHA1 329e052afe981c8ba32ff78df2deb9d041c05f8b
SHA256 921635dcb46ba5192db20e6c7ed0429c647f7d55ead2f6feaadc00b8410a646e
SHA512 4ae0a9de57f0df6119b99be7168e35917da63e24487b67a4afe96d3996cc42ad22716ac411791998642498bd5f64ab14d9571f4ebf2ee5abc6eb2761270cc897

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DLMVUQG3I87O7X2TA1A5.temp

MD5 ae35303f65dc486de7cff27b5316b56d
SHA1 c4ca04a0b8ae5d0fb188f9c09eb84b9339283766
SHA256 82f599b94c1865f7221833895b8f3b01e673989873a13e97eef78034fd4e6b94
SHA512 d5d71b26ff7c8d5c77730cc5a98c3e6caaa677c014b120c0f33463baa2e06423367e3106620aac22e7364bcfad83e04c655f2426a944981cf763e6f2f6c7255d

C:\Users\Admin\AppData\Local\Temp\Data_130850\C0D3RMMCCCIX\Files\Web Data

MD5 5a11d4c52a76804780cbb414b2595bdb
SHA1 14c89a2283c41b10ce8f1576404e1541c04a8125
SHA256 e1b3260b2607c6a5fcf91575d1de278deceaf4e5f9f0530a3782c6d9567749d8
SHA512 0bffe811cbba5278d39e20b66a5c4770e3855d1f5cbd45161e8ad304b78da73f555a3c42a198378efab3dfc81f384fdaefc6cbb893a708c7e2649a89fdd11762

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 21:54

Reported

2024-10-27 21:57

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SaDesign download.zip"

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
N/A N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A

Browser Information Discovery

discovery

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zFM.exe N/A
Token: 35 N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A
Token: 35 N/A C:\Users\Admin\Desktop\SADesign Setup.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files\7-Zip\7zFM.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2900 wrote to memory of 1020 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Users\Admin\Desktop\SADesign Setup.exe
PID 2900 wrote to memory of 1020 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Users\Admin\Desktop\SADesign Setup.exe
PID 1020 wrote to memory of 5384 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1020 wrote to memory of 5384 N/A C:\Users\Admin\Desktop\SADesign Setup.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5352 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5352 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5668 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 5384 wrote to memory of 5760 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files\7-Zip\7zFM.exe

"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\SaDesign download.zip"

C:\Users\Admin\Desktop\SADesign Setup.exe

"C:\Users\Admin\Desktop\SADesign Setup.exe"

C:\Users\Admin\Desktop\SADesign Setup.exe

"C:\Users\Admin\Desktop\SADesign Setup.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sadesignv2s.blogspot.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd8e2e46f8,0x7ffd8e2e4708,0x7ffd8e2e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,14863435270266814072,4017626905874357897,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,14863435270266814072,4017626905874357897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,14863435270266814072,4017626905874357897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14863435270266814072,4017626905874357897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,14863435270266814072,4017626905874357897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14863435270266814072,4017626905874357897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,14863435270266814072,4017626905874357897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8

C:\Users\Admin\Desktop\SADesign Setup.exe

"C:\Users\Admin\Desktop\SADesign Setup.exe"

C:\Users\Admin\Desktop\SADesign Setup.exe

"C:\Users\Admin\Desktop\SADesign Setup.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sadesignv2s.blogspot.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd8e2e46f8,0x7ffd8e2e4708,0x7ffd8e2e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1981570912206811814,15569814374391775326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 kingcambodia.pythonanywhere.com udp
US 35.173.69.207:443 kingcambodia.pythonanywhere.com tcp
US 8.8.8.8:53 sadesignv2s.blogspot.com udp
GB 172.217.16.225:443 sadesignv2s.blogspot.com tcp
GB 172.217.16.225:443 sadesignv2s.blogspot.com udp
US 8.8.8.8:53 www.blogger.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.178.9:443 www.blogger.com tcp
GB 142.250.178.9:443 www.blogger.com tcp
GB 172.217.169.36:443 www.google.com tcp
US 8.8.8.8:53 207.69.173.35.in-addr.arpa udp
US 8.8.8.8:53 225.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 9.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 36.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 42.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 216.58.201.106:443 ogads-pa.googleapis.com tcp
GB 142.250.200.46:443 apis.google.com tcp
GB 216.58.201.106:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 14.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 46.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 206.187.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
GB 142.250.187.206:443 play.google.com udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 35.173.69.207:443 kingcambodia.pythonanywhere.com tcp
GB 172.217.16.225:443 sadesignv2s.blogspot.com tcp
GB 172.217.16.225:443 sadesignv2s.blogspot.com udp
GB 172.217.169.36:443 www.google.com udp
GB 216.58.201.106:443 ogads-pa.googleapis.com udp
GB 216.58.201.106:443 ogads-pa.googleapis.com tcp
GB 142.250.187.206:443 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
GB 142.250.187.206:443 play.google.com udp
GB 142.250.187.206:443 play.google.com tcp
US 8.8.8.8:53 89.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\Desktop\SADesign Setup.exe

MD5 71934bbbf49c5d75477501d19051bb81
SHA1 b5b8240355fbf700f72092c5539c0e22c05bff07
SHA256 41dcd615f760e42fe3f3e041328d845e84b66eadb24bb1acfa8b790892098aa1
SHA512 f06cbb49a2d6a56d06983195a3ddf4d785dbb17882f08a22bb2585f48e9f6f7cf7b902b17a829476d2babe04c20a8a0c23691e3f39fb6bd8ade96017276911a1

C:\Users\Admin\AppData\Local\Temp\_MEI29002\python37.dll

MD5 c4709f84e6cf6e082b80c80b87abe551
SHA1 c0c55b229722f7f2010d34e26857df640182f796
SHA256 ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
SHA512 e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

C:\Users\Admin\AppData\Local\Temp\_MEI29002\VCRUNTIME140.dll

MD5 89a24c66e7a522f1e0016b1d0b4316dc
SHA1 5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42
SHA256 3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
SHA512 e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

C:\Users\Admin\AppData\Local\Temp\_MEI29002\base_library.zip

MD5 36a7e91278001d8c1e081f4fa6e1ac3a
SHA1 c67b2d279bc42822aed811ecdc68085afbe6aa62
SHA256 661e69ec7537840cdc5bf827f613c1eea7cdf2636add1d1cc94cc5b02d90c19e
SHA512 819788ca470308137ab4c98534f26dcdf16db2d7947b074b239e06743b04bc106d888280019c60a5f4842306e735126f73471464abf6876caf2edbdad18d0535

C:\Users\Admin\AppData\Local\Temp\_MEI29002\_ctypes.pyd

MD5 5e869eebb6169ce66225eb6725d5be4a
SHA1 747887da0d7ab152e1d54608c430e78192d5a788
SHA256 430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173
SHA512 feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

C:\Users\Admin\AppData\Local\Temp\_MEI29002\_socket.pyd

MD5 8ea18d0eeae9044c278d2ea7a1dbae36
SHA1 de210842da8cb1cb14318789575d65117d14e728
SHA256 9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2
SHA512 d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0

C:\Users\Admin\AppData\Local\Temp\_MEI29002\select.pyd

MD5 fb4a0d7abaeaa76676846ad0f08fefa5
SHA1 755fd998215511506edd2c5c52807b46ca9393b2
SHA256 65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429
SHA512 f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f

C:\Users\Admin\AppData\Local\Temp\_MEI29002\_pytransform.dll

MD5 352364081ca2bc10f3df4469f85c2867
SHA1 57afb0cd49df30d9cd88ae3df5b900e063f2d84a
SHA256 8d8f34f18648f880ee2e1d679197ef1421f6e809ad860943bd1ba37b5f683437
SHA512 55d19ac0daab1e7109e848d33e8613b771d7ca68219fc3aa043ae63360b546db3c60f4aac22b2ac0d718e8ba77effd3d2b5770b1986416a40470c941d47c4138

memory/1020-40-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-42-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-38-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-37-0x00000163B63D0000-0x00000163B63D1000-memory.dmp

memory/1020-88-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-100-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-98-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-96-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-94-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-92-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-90-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-86-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-84-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-82-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-80-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-78-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-76-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-74-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-72-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-70-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-68-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-66-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-64-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-62-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-60-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-58-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-56-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-54-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-52-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-50-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-48-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-46-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

memory/1020-44-0x00000163B63E0000-0x00000163B63E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI29002\_hashlib.pyd

MD5 b32cb9615a9bada55e8f20dcea2fbf48
SHA1 a9c6e2d44b07b31c898a6d83b7093bf90915062d
SHA256 ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5
SHA512 5c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe

C:\Users\Admin\AppData\Local\Temp\_MEI29002\libcrypto-1_1.dll

MD5 cc4cbf715966cdcad95a1e6c95592b3d
SHA1 d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA512 3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

C:\Users\Admin\AppData\Local\Temp\_MEI29002\_ssl.pyd

MD5 5a393bb4f3ae499541356e57a766eb6a
SHA1 908f68f4ea1a754fd31edb662332cf0df238cf9a
SHA256 b6593b3af0e993fd5043a7eab327409f4bf8cdcd8336aca97dbe6325aefdb047
SHA512 958584fd4efaa5dd301cbcecbfc8927f9d2caec9e2826b2af9257c5eefb4b0b81dbbadbd3c1d867f56705c854284666f98d428dc2377ccc49f8e1f9bbbed158f

C:\Users\Admin\AppData\Local\Temp\_MEI29002\libssl-1_1.dll

MD5 bc778f33480148efa5d62b2ec85aaa7d
SHA1 b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA512 80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

C:\Users\Admin\AppData\Local\Temp\_MEI29002\_bz2.pyd

MD5 cf77513525fc652bad6c7f85e192e94b
SHA1 23ec3bb9cdc356500ec192cac16906864d5e9a81
SHA256 8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41
SHA512 dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9

C:\Users\Admin\AppData\Local\Temp\_MEI29002\_lzma.pyd

MD5 5fbb728a3b3abbdd830033586183a206
SHA1 066fde2fa80485c4f22e0552a4d433584d672a54
SHA256 f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b
SHA512 31e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb

C:\Users\Admin\Desktop\version.txt

MD5 a874ad7d3bc6e09b19194f366dc1d420
SHA1 80167c78cda93053b57c77ac886e525b3e04e522
SHA256 96802892f3eef1ecf144d0f49d1e945dd639eb112de34412af446b4940cb7066
SHA512 200591307baa709428ad9cef2b7c6f35f3cb1fd3e205a583f06194b4e7e2602c5abf8928a7235fc3e257edbcfdfbf7ef53b0e467b7bdab81e1ebec6ee84dacfe

C:\Users\Admin\Desktop\index.txt

MD5 e064507c8f610eb05e45d32778e50dfb
SHA1 ce2d36a18488f1c30ea95286c0ee35b10ddc9f4b
SHA256 93075b905f5377d77714f3887366243f0808ff36f67a072ffbb1bbead8a87555
SHA512 d329fed737116f5e928436afc9dd213238ddb43f1d9b387603d8c3f79522a018d1f7c05c54f48ea24e62bc1fb71d867e87fc8c86f55a0457ba055f42656d6f65

C:\Users\Admin\AppData\Local\Temp\_MEI29002\unicodedata.pyd

MD5 4d3d8e16e98558ff9dac8fc7061e2759
SHA1 c918ab67b580f955b6361f9900930da38cec7c91
SHA256 016d962782beae0ea8417a17e67956b27610f4565cff71dd35a6e52ab187c095
SHA512 0dfabfad969da806bc9c6c664cdf31647d89951832ff7e4e5eeed81f1de9263ed71bddeff76ebb8e47d6248ad4f832cb8ad456f11e401c3481674bd60283991a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

\??\pipe\LOCAL\crashpad_5384_LVUPHOSWAWDMDFAO

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b41a8b13c29c16ead39dab5387c8d7a7
SHA1 cbdf6ee64caf486af421c9f8a0fdfd2c0a7feaf4
SHA256 3e12d8390e377fd98a84767ecafbede9a2281d192a9b2ddbd57d3ba5b1dce381
SHA512 d05dcf65e3ee94e7ef761c9ba5cc96b8c7d4a5f95222faad881525ca5459b069fba68f6c26e1dc1b44c9603a494e1c1313da13a2c2be92f84f6f9d083523461f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 048250c145e3fb6a1cf3009868146f3f
SHA1 089672b122c79bcca47315e5240b48823d25fb31
SHA256 254d5135f735b677ddb94f13115fb1115afb2e40ed5c0950b40ca48ffd68bdf8
SHA512 ea1d131a445796b90724ede5aa3d7df889617c89b00ec1ac9a8a0b78b6c925a77455f87a03d627c3b4874bbfcf5e72eae4b105c5c9db9b26f4a049e42ad12e2c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b864ad80400def35ad3873464421a41d
SHA1 1506765bdc5dbe3a46c109e92734cbaf7f60bf97
SHA256 d49ac58088cd7f4980a3787531b798e6ebcc8635140e6c798db3eb58591065e5
SHA512 ba833d62e6304a814d703ab088eaac030638c9de74d1aa5c3b4988cf99314661798f2c9cb9e8b75520b856b7020bfa1f62f5639222f309b74465c1eafaf9f660

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7c04ac840b136c532da528a9b969aef6
SHA1 b7e99ca8621e2f4562f86d47b25d164ce7cb7d8b
SHA256 4642026224714cdbb40db465525750565c54d61a89c742ad09acc6ed5dad0850
SHA512 a3f6fab19e640197a39b1dc56e9b71f2911f4296773a8226b997913b74074364cac22bcf018a136de806b0e0217ac5434026d49bfc550cd81d456e654895470f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 69f66caca1d4325cbd2e4dbdd8488196
SHA1 2c75040aa0dd15f2c7c7870fd793a2a2c4f3de83
SHA256 ffc71d3c375a00b95d9eaba8fefa353e5edd7cdeb6a0584cf2ade56814532122
SHA512 bda65ddeef9dca64c0cad4df0e28e608f1733c544cbbcafe74ce558cb4316c87ce2d311797637c26ed213d3c428fd6e1b66fd87feff870f54fa9faf6d2f9c99b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 33c736647b3355b11b34afecd49f910c
SHA1 058f992b47e7c5f3fbd25a836383ad87e18dec16
SHA256 e848f313b7a712d2c6143ed59f93ca03f753c5dc7252feb7b63de991dc75029e
SHA512 40dfd354ecb2165f22655cb7230e58f0c0f0c8343368c1af8d91690d6e68e01b9c1fe255a493ed2291b41831117777914370ad4ad40c983b5fb1e5f8a88e1594

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f7efc6992499d246d2a5aeec7fd72d0d
SHA1 7f5cfb0fdf9a6842002fd99c180fd89037f6909c
SHA256 49878b6da135f7e56923f9df275b0caa9b90dc8af6118137db403f416103bcca
SHA512 aeb70df17783d3a5bdbae1cc479f36b9059534cf5ede571fea614bcea832a984b417af065e60e3d886dcf16a2c593acc148d259a08dd5750df2a8046b6d1c2ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bb935cdd986d848a420bab7671e4ae2e
SHA1 2bd68296e0e9dfad557fad7ff94e8b2711b369f6
SHA256 2ce86b50b0018164293b108bdbd2e7d37fa7e326d4bab20785b338a62c80d65a
SHA512 65576bffb3087cc91fffbb8bcb4e01188219c55958fe22a5257f09f4625e36241202fded6a54bd5d71afdd03ba98186eafed85a293d8f12becd5e61bf9345d5e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

MD5 f3e4f3a0b4cf5b7246170a31707b25e2
SHA1 8d581b878a8189f40e4960f380f3f6d1bcad0e73
SHA256 7d991ea342b9e3b46a04c2309fbbb3af5fda88a4b2bb7a26ef6c26d2369a1519
SHA512 4e7ae7962a0c6ef29c157bf64c070a3e27fc1fab21a1cf84c40745417a5078d8aa420edd726892e26d2b509daaf1e4727399238fbcb488476ba42270d3113c93

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5a4bc9ee01721c3225a13f0ccaea7244
SHA1 6b43cc1489841eb1d9fa452aa5e971895cb87af2
SHA256 02776eb83b7bd85d894961b2bf1f33fd068e191cc473f07006f68b3bd4e8b744
SHA512 41ff23f64c070628a5eaccdea18ad1be280afb0558626d6d74168132be08553b0b4c88d9310585be0ca7ff76ded67a128855c83070788ba46f1dfd9b95b22663

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c800b715eb863b715fc855d3db68f006
SHA1 64738220e7980b5644e9d84e1ea8cef05966d73b
SHA256 7ab290d13e2e0af8a4866b327ff09d07e9f7cf0a5e2a222af9cfb8addabd0ca4
SHA512 3480fdcb9a6d7f39219c03388b833d6225f27550bb037f6a940317a5a823b92417d2ed73bf379349b04ea81a9bf1e3c6e8b01469b0f1e082721cf90d82f49d86

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 4fbc26b6eb4e3e11bb2d38f7fbcfc566
SHA1 f10e5ae5c73a778f6e30ccf0432c89b2bc133467
SHA256 1346974b50fc9b50f8a57c8684ee06d56fcc682ccd34d2443b93b18b29823b29
SHA512 e49049d9d558f8e416d1dbe1d95d874d2d8890f78270979ff3d5a112b6b76fe76712b851a6da82227d48c0bae9b7124d57dc2104a4d749de0d5dbf0b05f25daa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 dc24ed6c31d90e40331c52c6e52acc4f
SHA1 8ca632ab28703e2f06e0ab0afa6d20e8f10cd14e
SHA256 2bf892fa64cddd7f01560f44ab10ea6695d5930cb1f11af4b7f9fd67877ebdfe
SHA512 1e63a6a4a0a3a1785c93c72114938c42234f5e61a5758c1783e3ee2ba494568908b3efbacccdd534a94b055352998b0da5a88f77f44420606deaf90e637fe100

C:\Wlndows\Lib\site-packages\pip-20.1.1.dist-info\INSTALLER

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Wlndows\Lib\site-packages\pypiwin32-223.dist-info\top_level.txt

MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

C:\Wlndows\Lib\site-packages\win32comext\internet\__init__.py

MD5 f45c606ffc55fd2f41f42012d917bce9
SHA1 ca93419cc53fb4efef251483abe766da4b8e2dfd
SHA256 f0bb50af1caea5b284bd463e5938229e7d22cc610b2d767ee1778e92a85849b4
SHA512 ba7bebe62a6c2216e68e2d484c098662ba3d5217b39a3156b30e776d2bb3cf5d4f31dcdc48a2eb99bc5d80fffe388b212ec707b7d10b48df601430a07608fd46

C:\Wlndows\Lib\test\test_importlib\frozen\__main__.py

MD5 47878c074f37661118db4f3525b2b6cb
SHA1 9671e2ef6e3d9fa96e7450bcee03300f8d395533
SHA256 b4dc0b48d375647bcfab52d235abf7968daf57b6bbdf325766f31ce7752d7216
SHA512 13c626ada191848c31321c74eb7f0f1fde5445a82d34282d69e2b086ba6b539d8632c82bba61ff52185f75fec2514dad66139309835e53f5b09a3c5a2ebecff5

C:\Wlndows\Lib\test\test_importlib\source\__init__.py

MD5 c3239b95575b0ad63408b8e633f9334d
SHA1 7dbb42dfa3ca934fb86b8e0e2268b6b793cbccdc
SHA256 6546a8ef1019da695edeca7c68103a1a8e746d88b89faf7d5297a60753fd1225
SHA512 5685131ad55f43ab73afccbef69652d03bb64e6135beb476bc987f316afe0198157507203b9846728bc7ea25bc88f040e7d2cb557c9480bac72f519d6ba90b25

C:\Wlndows\Scripts\pip.exe

MD5 0f9744d1966d4533d699bc032988861c
SHA1 4bed13577edc66fe3b233d337e63311ea340f2e5
SHA256 13336ee5367921de58e62953feae96069cf90c1343f6957b3b402c4380de6e0a
SHA512 138c09474591637927e0d8b561cf1b86a89460335c7b30eabc4572f8deb706072f98f6cfe9cfa9afcd5c2d8b38869ad964c7df71de07078bf7e8f2680275c930