Malware Analysis Report

2024-11-13 16:50

Sample ID 241109-gc8des1qdp
Target 35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6
SHA256 35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6
Tags
fabookie privateloader redline socelars faker pablicher discovery evasion execution infostealer loader persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6

Threat Level: Known bad

The file 35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6 was found to be: Known bad.

Malicious Activity Summary

fabookie privateloader redline socelars faker pablicher discovery evasion execution infostealer loader persistence spyware stealer trojan

UAC bypass

Privateloader family

RedLine payload

Redline family

Fabookie

Socelars

Windows security bypass

RedLine

Socelars family

Detect Fabookie payload

Fabookie family

Socelars payload

PrivateLoader

NirSoft WebBrowserPassView

Detected Nirsoft tools

Command and Scripting Interpreter: PowerShell

Loads dropped DLL

Checks computer location settings

Reads user/profile data of web browsers

Executes dropped EXE

Windows security modification

Looks up geolocation information via web service

Checks whether UAC is enabled

Adds Run key to start application

Checks installed software on the system

Drops Chrome extension

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Suspicious use of SetThreadContext

Drops file in Windows directory

Program crash

Browser Information Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Modifies data under HKEY_USERS

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of SendNotifyMessage

System policy modification

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 05:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 05:40

Reported

2024-11-09 05:43

Platform

win7-20240903-en

Max time kernel

60s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe"

Signatures

Detect Fabookie payload

Description Indicator Process Target
N/A N/A N/A N/A

Fabookie

spyware stealer fabookie

Fabookie family

fabookie

PrivateLoader

loader privateloader

Privateloader family

privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zaikais = "C:\\Windows\\Microsoft.NET\\Framework\\mirzas\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Files.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Process.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A pastebin.com N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A pastebin.com N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5592 set thread context of 5028 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\File.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28EC9091-9E5D-11EF-81BB-F2BBDB1F0DCB} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000ccb888af7689714dceeb322290aa6817b8c935cfdbfc6ba9b9239b5b66a5a52d000000000e80000000020000200000004a673e4815e2429fea0caca0399b9bc34a0ca7859ced19cb4afe3374fc0080fb200000006b9b1d94897f3edbacb21b9015398da7c8ecfb8563983af0dd1adf91558cdfec400000008dd87483ca0802a0c29daa7b805e16c6c0bab12f3915955e121192d1cba5473c2dcdfbbc923d7030dfe0e136e0f11aff3a030209cc68e58eb8263d012ac50d41 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000abf0d38f51d57aae597fb745b39a0c88cce21ebcfd0479e71793cd581b28f146000000000e80000000020000200000000683b0d4d07e94980bed4c67bfdd4d5aa2da80c79ac16690402ad8e2d50bf49a90000000a2e8e06f83695a28249878cae87c604a3102d18b2e584c160286f1e41a9d833fdc9dade1480e7418b2a876dcb3d850b05a3c22c930281810b8a4d338ed661948c3c00483326f29ec146db9ccae5ee9665efc8e6ad4dc70b036e618927797429784ffd5305a11a1e1555dcaa5b0ae160df044de46bfd0cf775f55d7f61f237014f40ab56e52128d46a50972f83881e164400000006eb8ceb82aa25477cef7fb32ad5a778a7722e77c1e39d97e3ccfbf6dc0772aec8392ac613d5443a20aaba1b81ae082742dfbb9e889a5d2f3109e6a587aa6107d C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dd53ee6932db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\wwwE506.tmp\:favicon:$DATA C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\RarSFX0\ltt.url:favicon C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\wwwF626.tmp\:favicon:$DATA C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\RarSFX1\aprt.url:favicon C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\www1FB3.tmp\:favicon:$DATA C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\lzst.url:favicon C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2072 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 2072 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 2072 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 2072 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 2760 wrote to memory of 2776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2760 wrote to memory of 2776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2760 wrote to memory of 2776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2760 wrote to memory of 2776 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2072 wrote to memory of 5440 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 2072 wrote to memory of 5440 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 2072 wrote to memory of 5440 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 2072 wrote to memory of 5440 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 2760 wrote to memory of 5520 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2760 wrote to memory of 5520 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2760 wrote to memory of 5520 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2760 wrote to memory of 5520 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 5440 wrote to memory of 5592 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 5440 wrote to memory of 5592 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 5440 wrote to memory of 5592 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 5440 wrote to memory of 5592 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 2072 wrote to memory of 5708 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2072 wrote to memory of 5708 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2072 wrote to memory of 5708 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2072 wrote to memory of 5708 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2072 wrote to memory of 5780 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 2072 wrote to memory of 5780 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 2072 wrote to memory of 5780 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 2072 wrote to memory of 5780 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 2072 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2072 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2072 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2072 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2072 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2072 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2072 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 5708 wrote to memory of 5992 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 5708 wrote to memory of 5992 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 5708 wrote to memory of 5992 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 5708 wrote to memory of 5992 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2072 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2072 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2072 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2072 wrote to memory of 6020 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2072 wrote to memory of 6116 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 2072 wrote to memory of 6116 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 2072 wrote to memory of 6116 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 2072 wrote to memory of 6116 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 6116 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\Files.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe
PID 6116 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\Files.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe
PID 6116 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\Files.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe
PID 6116 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\Files.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe
PID 5592 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3900 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5592 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe

"C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe"

C:\Users\Admin\AppData\Local\Temp\Proxypub.exe

"C:\Users\Admin\AppData\Local\Temp\Proxypub.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Process.exe

"C:\Users\Admin\AppData\Local\Temp\Process.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:4011013 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe"

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe"

C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

"C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe"

C:\Users\Admin\AppData\Local\Temp\askinstall492.exe

"C:\Users\Admin\AppData\Local\Temp\askinstall492.exe"

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -u

C:\Users\Admin\AppData\Local\Temp\File.exe

"C:\Users\Admin\AppData\Local\Temp\File.exe"

C:\Users\Admin\AppData\Local\Temp\Files.exe

"C:\Users\Admin\AppData\Local\Temp\Files.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"

C:\Users\Admin\AppData\Local\Temp\11111.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 948

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:2962441 /prefetch:2

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2280 -s 380

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:3814429 /prefetch:2

Network

Country Destination Domain Proto
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 iplogger.org udp
US 104.26.2.46:443 iplogger.org tcp
US 104.26.2.46:443 iplogger.org tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 104.26.2.46:443 iplogger.org tcp
US 104.26.2.46:443 iplogger.org tcp
GB 142.250.187.227:80 c.pki.goog tcp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
GB 142.250.187.227:80 c.pki.goog tcp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 www.listincode.com udp
US 208.95.112.1:80 ip-api.com tcp
US 3.225.234.52:443 www.listincode.com tcp
US 8.8.8.8:53 datingmart.me udp
FR 212.193.30.45:80 tcp
US 54.209.42.5:443 www.listincode.com tcp
SG 51.79.188.112:7110 tcp
US 104.26.2.46:443 iplogger.org tcp
US 104.26.2.46:443 iplogger.org tcp
US 104.26.2.46:443 iplogger.org tcp
US 8.8.8.8:53 www.hhiuew33.com udp
US 104.26.2.46:443 iplogger.org tcp
US 104.26.2.46:443 iplogger.org tcp
US 45.144.225.57:80 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 wfsdragon.ru udp
US 172.67.133.215:80 wfsdragon.ru tcp
SG 2.56.59.42:80 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp

Files

\Users\Admin\AppData\Local\Temp\Proxypub.exe

MD5 a6ff722fe5cb9ea9444a79e38343241f
SHA1 c297a99afd248fa076654e42ae84b7ca9e1ca59a
SHA256 791999c706f021b4d8eadd56a130dec270b4b366a96b6164abf7a72125d27209
SHA512 8fa87affee6086fa6888a2159dd0a14f122a79c5bb7fb04471dc91c50338feac085e6506e7948270e4c6a1e2610efedc3d56b647ddc7109e9adffb869c335b7a

memory/2060-36-0x0000000000400000-0x000000000043C000-memory.dmp

memory/2060-35-0x0000000000220000-0x0000000000259000-memory.dmp

memory/2060-34-0x0000000000620000-0x0000000000720000-memory.dmp

memory/2072-37-0x0000000003430000-0x0000000003432000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\prxza.url

MD5 3e507ecaac6710d93c101c67ae45fdab
SHA1 0f7509702c29f205da48a1d8fc3ef346fcbf5197
SHA256 083f728d22bc6f1ed6bfa9ecaeb68528a9eb433c0e8e67a52426047ec3e41488
SHA512 865d48b26a5cd771cb0407e106da3c4a7b5cbb43a6002f5b70fb4dcdfd55498392bc42b31c054420f295b75807134c6c26574669e435087260a68ef497277531

memory/2060-39-0x00000000003D0000-0x0000000000404000-memory.dmp

memory/2060-40-0x0000000002170000-0x00000000021A2000-memory.dmp

memory/2060-60-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-80-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-94-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-92-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-90-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-88-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-86-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-84-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-82-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-78-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-76-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-74-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-72-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-70-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-68-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-66-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-64-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-62-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-58-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-56-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-54-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-52-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-50-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-48-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-46-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-44-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-42-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-41-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-100-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-102-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-98-0x0000000002170000-0x000000000219D000-memory.dmp

memory/2060-96-0x0000000002170000-0x000000000219D000-memory.dmp

\Users\Admin\AppData\Local\Temp\Process.exe

MD5 532603329a655dc6812c790fdaccf378
SHA1 464b251e62f67f346b262df8eaae7d0bbf0f4b52
SHA256 ab681e11dd1ba868c78016fe08c507b130304a1a1ac4d84a9fa0f00a15a00dca
SHA512 5067268797fa6752bafd9069447d3fa0cb6116ce594d4419f9d8e0891706cac684ad6af425569ec83f404d461b07661f74502918d92e3735d79c427e353000ca

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ltt.url

MD5 44264182fbb802b9671f6abb7faa6a53
SHA1 ccc380eaca3c618f54fdb3d907f50a5f039469da
SHA256 62aad2b0d832421b890138182a25ed331fa39765d0700b84fd6c1c580ea3f0fc
SHA512 43d24f86dd04c479e534fad83efefa2f70bb298ab9e9ea2f737a9adcb79bc330f235d3ff6ae8d413a973968e4951a93a07718a908510f4a0a48017c2b03b824f

\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

MD5 9a20c492f91287895ae49de71f479376
SHA1 376afa85c761170a89cdfa2241498ddc8f9bea1a
SHA256 9504d1a7c7ed4d2ea4b88b1ffc80f19c0efddc4c5964e6f906e70e6089764cdf
SHA512 d502900170e65f22c8e031c8186998428f6a95213c19425d7bb2d0f96a0484522b596e811d0aae791ae1b7e739e85a3687cde83a3c61adba55f3e83f09a6bd4d

memory/5592-1027-0x0000000000F90000-0x000000000100C000-memory.dmp

\Users\Admin\AppData\Local\Temp\Folder.exe

MD5 4538da85464e576893aec470fc71229a
SHA1 c47826fd48cc1ea12a1ef57818f820ef1da084b5
SHA256 8aff0e13328a2129ca13284d80bed1f72100a78a2c4fa696b2aa95a6152f2983
SHA512 9f62882a237a3619253aa9283303c91d0cb0f18117dc5b86b4a58cfdd7eabc4a389d4c43f93e84315d97fae49345013fbb43eccce29bc381d780a37a9d98f431

\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

MD5 2f02d5af8f2ad1917f8fc5fe17127da1
SHA1 1bb680702a52dc9046984b87f1e3387530009222
SHA256 bccb32358a54efc1e9f62859c3c6aeb1da93b4e4159a76972f38f8737b0dd69d
SHA512 8aa125a1db54314047066058d051259f56efbf3a20998f12fdafc20418ff12e249d5c1aab4b01e8cc859e3166377d05c217dbd47ae0817c5836333b1b82def67

memory/5780-1059-0x0000000001390000-0x00000000013AA000-memory.dmp

\Users\Admin\AppData\Local\Temp\askinstall492.exe

MD5 5a9ed91a1c2467ae921d52f6df3cd4c6
SHA1 0c0c7cbae68b09c2da22c68dbbf3bf2f27f60545
SHA256 b4a5844e6ed96e04782b9f64f5393509119f2c984d20b74edbcf8b03269f1479
SHA512 f07980049deacffded94a697878649394a95e321e527c88baa608ffd05830ad35c86d5d3ac976a813c0fa2c75304633ec2738b765cda5c128348709ca4260956

\Users\Admin\AppData\Local\Temp\File.exe

MD5 90c7efe55fff3704de712084227e84a6
SHA1 b60983bec0346c6fdc0569f641e9091b7f201a5b
SHA256 6bb5f93524d19c19ad102c9577107b7761e1ce94ea2229594fab55fdb98a7e34
SHA512 64556f35c8a13cbe7ff7087bc88e19faaac64091bd1f2ad6251651ab0caabc70c2e388420528893193811a387039e1bfb906c4d2e5f2f8e5deb3d8931b78e65f

C:\Users\Admin\AppData\Local\Temp\Files.exe

MD5 cab647efcbaa4d2a81e3bfd8122a2a67
SHA1 8783a13798a427cef74baee553c2dec8f123e52a
SHA256 8b682d2e77e42f985975b4d77fd8e94136a45850b5b5f5633c2b6b51f2cd4c99
SHA512 5d3549a7eb1ee7f56478cb810ce867b48cfa624e8ea9726406b87e692e24dbb09be61edb5081a7ed80196c78199b254173ea08144ad21046a220c960c56d95c2

C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe

MD5 57d626d8e6951c2b6d1a883a73b998bb
SHA1 59ccbfce02af3628ef9e34f6d41c1ef9e34e0808
SHA256 c93e60e1b3a6ceb63ce7cbf2e7757763f3fe79fb094e5725759f9b8ecafef1ca
SHA512 2745485dc7fd2da9ac1b81eb4058b32e2fc5c3f990bfab6321a3ef876a14d8a70d66bbe8c392bf18579a80eea3c9272e8cdde63f40ad44a050d5a0db66e71663

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\TarE218.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\CabE1E6.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HJ3D9OBI.txt

MD5 a7095326766478d132cab1d8f040b4df
SHA1 810e88a6adb74906c07225c88702478a82c22101
SHA256 1759acb27505e710270b70d121e9e0e5cf5998bddd991cadf65bf38a2b83e9c0
SHA512 96c7909dbe442183e79d40b4e381e3ff53dd7fcdaa73c02e65cfb4e2e5a637532f7379aa8607a34c9a98e0b88e7afe73bbd59b040ca0e81f827301a7da2786fa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 085da1d19a71cc38fb61231c3ccf4322
SHA1 d11a7a4f3a6b560b33ffd1c9c7e5477490fb0ca9
SHA256 fb2271fefd6f2e2db6da39de8cb2512e43866561dec09213a33ee40cc112e0ec
SHA512 a5234b9da2e0d75b5c51ec3ec6adcf78ab2ee8209130e287e9c3c3be7dd211011e763f38e842d3534bbfa67a74c5772b01bc76ba97889f951ae14faf45291c13

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 67e486b2f148a3fca863728242b6273e
SHA1 452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256 facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512 d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 fcc28487939a12bdbc5c524a4c3beca7
SHA1 7d9fb496e7be31dc9f977a9bc9bcfa72dd33b054
SHA256 a99bb6f1a62138941594b31d19a00078a2c172ec0668e0b80ed6aaecbf201c00
SHA512 bb0224d715d721291bc67c4936eeb8d176863b3f67f690e160d6bcc98992ba12d8a43ffb080b4aca6fe41883922cfd2a8bef3a08b74722e925962027e7aa0824

memory/5780-1078-0x00000000002F0000-0x00000000002F6000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CXRG2YQS\favicon[1].png

MD5 18c023bc439b446f91bf942270882422
SHA1 768d59e3085976dba252232a65a4af562675f782
SHA256 e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482
SHA512 a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9fajjbh\imagestore.dat

MD5 db70dea2c7233e25de2d41a03b44f414
SHA1 1830318ac464c4b4960557fc249ca66b69071f1c
SHA256 f2b9d7c8c779013eb51752d3e32bc50569b4a7edf7b3b775b52e3c7603d1f606
SHA512 5f834209d96a63f4b31801420f3944635a05cc272b166aa28e1accb631521510b6c1aa4e0db4be24eeac7ddc0ccb024ac8839784cb6645d60c43ff221349c728

memory/5592-1209-0x00000000002F0000-0x00000000002F8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\wwwE4F6.tmp

MD5 e2dcc0fddb76276849e5ebcc43485744
SHA1 111142b03e1fe9e9d3b13adcde91d312925fd272
SHA256 304952d6cb3fc235528f4331173f85450df4eedefe8df4e055fc0d15b7b5d8ce
SHA512 59dda6f39f26b761b774ce3daeb3b7e43b4bdd6dabfedd4827d213677c4308fbdc8fbd5c410e295307c0ae4edb5e5297cbdf751fd5cba4deb2c9f3ad3bfb0840

memory/5592-1210-0x0000000000A60000-0x0000000000AC4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 a39180095a024698de4ae14db2b6c029
SHA1 50c884a46d0ea1290d235c11de0ac60793916e3d
SHA256 d9a6b1b29be073c4d3b15cb4ef0958aca3fa89dc33b3dc95f4882b174047eec4
SHA512 eac0722c5f87818a90367e5752c70e711d29dfffeffe8c98cd8cff319aaded2621bca7bade92862d1f2af46ccfb72349f3ee925cb93aa6032dda7b61d0ebfbb4

memory/5592-1226-0x0000000000B10000-0x0000000000B30000-memory.dmp

memory/5592-1227-0x0000000000840000-0x000000000084C000-memory.dmp

memory/5592-1228-0x0000000005040000-0x0000000005254000-memory.dmp

memory/5592-1229-0x0000000000E20000-0x0000000000E39000-memory.dmp

memory/5592-1230-0x0000000004430000-0x000000000444A000-memory.dmp

memory/5592-1231-0x0000000004B90000-0x0000000004BAA000-memory.dmp

memory/5592-1232-0x0000000004E90000-0x0000000004EC8000-memory.dmp

memory/5592-1233-0x0000000004E90000-0x0000000004E9E000-memory.dmp

memory/5592-1234-0x00000000051D0000-0x000000000528A000-memory.dmp

memory/5028-1247-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11111.exe

MD5 7165e9d7456520d1f1644aa26da7c423
SHA1 177f9116229a021e24f80c4059999c4c52f9e830
SHA256 40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
SHA512 fe80996a7f5c64815c19db1fa582581aa1934ea8d1050e686b4f65bcdd000df1decdf711e0e4b1de8a2aa4fcb1ac95cebb0316017c42e80d8386bd3400fcaecb

memory/2060-1294-0x0000000000620000-0x0000000000720000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da74cb0ff0add743c3f539ec4b87793d
SHA1 6e609e2c5bf65845db9e7b421fe2b6e32668d14c
SHA256 019306bea3082d96ccd295f40bf4a58af0f073da40f9583352d855b848b90bfd
SHA512 ab8bc770d0173d0afa5e35bef96a61f4d78339bf27aed88ec0e655095d68f6689a695282fa367e9824b2fc38dc9d6d3abe88f1f2dd638cf1582b7ebd1d59cbe3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 56bdfd661467fb3a7a4b860821d895fd
SHA1 6fe36f1ccff5d406b19fcb84dec7e0935b8d9b82
SHA256 ffb02bfab196ae0f6e3301484fb8fd82660ada3e455b98ee77b2716f8a7dbd32
SHA512 434f892a5bae3e805038522864a907bcbe6c4ec1d7b532422525ae5c102693a10d242d1406b67ed037afed441904817a64731dcc0ea2e89ba950cf24781f2ba4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 776bd9632c82bcc0030c36183fefb2d0
SHA1 9d0be402358ccf4e04b0694848f8eed696ae7e5c
SHA256 c88f1fb12a15af81008464e9cfdecd33b8452b60e99e279ca25a7a3c6c993a4a
SHA512 28f556d9bf2e812aa963b5a21e2b0cad6d7fbc30dc19b4d61677fd4d0979cdb5bb175be5a6f7343b7fb7df6850a3ebee49010d4c42c47fe0095025526022d5c3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 79737bd54487fceace865e49393224f2
SHA1 5114ea54708aaefb01d7bd1fa91f1f55cd768956
SHA256 1b29df65e9947229970f2bce19093b828d74ce7bfd35cdb1246b35b24833117d
SHA512 10a42a59b950ef1a1854243f218f946f47f872aa502da21a11b8c00eeed175ecc4b54c1b3a24378a89c63b0d30199d44775e413d3c31d66690c916ba2bc966ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f382f960cdc83fc2db61199b7d120e3e
SHA1 65fc87abdbc4324fb1ca0a4249e983126d0e3926
SHA256 800d626ab1e2a70d19a79c72b81cc688788abf091d21affc7c0f76954fd967f9
SHA512 6d6a15559dc8704bcaf709a6b147f7451c1b5eae62f3b25fffcb2a86727f2185d296abf724b1ab35a47ae6408c07844e7e57ba9aef5466b36296528c83039f79

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 109fa5530c99d27a44bfeca0c371bb35
SHA1 1a132ba410b52b0583ee16650a8a4068dcf134d0
SHA256 2536b31d49b77dfa2735db3ef6101544dd180c23a0f1a9c06bbd560d14121f68
SHA512 cc4a33cc5ae13ea9b854e3ecb879ce7c6f89f5a4036ecc44364aac47816b16eeeaa98109330509c8f8254c13300c6f6a16852679c12f9c0ce30c39b9824ff33f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1ededcb21566a283e3cb29187c79f0b
SHA1 51d20d18f7a8d3fd9617d019c8f05ed78ed6452a
SHA256 68dd3cfa54806bb2ea0547fd8e773243858eadebbbfd4848ab9d8118059dc97a
SHA512 cdb8d8355bbc09a50bf337a590eccdd45d375ac17450ddb9aa96a72962a9d018441a407b1d6893346b788e0ec42c862e83061979e411eb4bd60fc07db6a1b7a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5f293a2368f31ea1bbfbb7d58b45d0d0
SHA1 d44c07933d1353c79a04150dfba3f80df42dc0bb
SHA256 cb1e8363cfe4033ba1a0063d78b212a15f72cea3df5a08ecf914b2da61b2967e
SHA512 87079ca0f99a4779301819b6178b0108b25b5316de431e0401e5f8d72a1cc3ea49001c8e8e7845f17de4fbdd4ad2531cb3f14a929578ca80e4b01aef960d1f99

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 df000fefc420ffb9f6734cf805275ab5
SHA1 00cf3c4db19991fd3612183b8f93f5d118445a47
SHA256 f398dee2fcae57219a8f718da249a901144e564f6a75d96863205b483458103f
SHA512 fd66fa9bf1bc5f92cf635eae6d9ce996301463dc166a932012607a55457e0b3bab67929ae7980944c9cf0e2bcffe2177a99e72a3d3132f4be6ca1f92f29c4a13

C:\Users\Admin\AppData\Local\Temp\RarSFX1\aprt.url

MD5 e8d2bf8df88d0ea7314b1a256e37a7a9
SHA1 eaca56a92db16117702fde7bb8d44ff805fe4a9a
SHA256 57fa081cc5827a774e0768c5c1f6e4d98c9b91174ad658640bea59a17546752b
SHA512 a728e6ef3e9a8dc2234fe84de7c0b15d42d72886745a4e97a08cf3dc5e8c7619c5e517f3f23fe1a5c9868360d0e89c8b72d52b7ee6012bd07c1589c6a78402b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fba4665018b74b5e5382a55c656f667
SHA1 de275743599d3bca302c291d64c13c03989df77e
SHA256 866d15382e8f967c8d32e8dbeb4a2c2e07e658eaa3a8d0baf92286bfed6ded5e
SHA512 2ed6f95a0a73561eaeea66dcb6cbdb8e1aa64eb1c95dd78469a116fa998c94f679b5756ca107e04fd628618a65c2843a0c9152eb981f4848654fa2b262b9ac22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 aceefe8ccc62c51d212ae69fb39c0d35
SHA1 5073beb25b720c039ff6c9fe628796e15ebfe6db
SHA256 347f7f69c2fe0881cfecb8da31b65dd2cad0c40f6dde053763b63e4ff28eef5e
SHA512 eead7b7ec01dbe20c3b0325d59fbd8a088c8251fbc31f18cff0934eea184280b506ca3909d2718732bf95fc3d1ce1985086b92f80ff8765ca3ae87c9006abb63

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f77119ee56170ca13b5c6afe334ea57f
SHA1 716975d2766e07368b0b779c9224712d3c8f3e0d
SHA256 a008ca77a0286979f389c2049b2d44b4ba035b03e79d0792f9869a713400117d
SHA512 1076683aa48c87588752c6891bd201618e67b93c56e06ea41dc8b627ccdd7af4c462c8b18d5210b9fc3ddeaf5f72ffe7d8f9907958e497ea5facee6917338706

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1dd981d89ae89233c29bff148d0048d8
SHA1 218cf1a04712ff265bdab553cc6798e13da654b2
SHA256 48d67ba527be792052f878efb22d31c41983cf955910fbbb2f9f19f96dac7110
SHA512 66edf1661ef3d19e8ed2557bd89376c11ac5f00790f5f93fc1b32b9438e01517310237446fe3df5814db2611c1c282306e068791f23d5b9376aac2db00db85fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e13de47bb5b9b3de88333ddbf7944945
SHA1 2b9e36ece02aecdc88678f32f2dc2a7d86756183
SHA256 65febca8f0ed98d07e96ad29bdc9381ab963e9861da9302ae457e8275e18027c
SHA512 7a5890856a7f1d9e5fda5f42493e418a0380b903d718945dc20564fa94289eaf503f38074d073a4b3ae51ca97d262add5762bfce8144503cf1fc259fa0cdd472

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 254ef026b11dfee223860bf352788229
SHA1 9cb65fca4a340c5de7075cf6883e916938b09474
SHA256 600326f8f170314c0cf57077631375ee3a260c60fa87da00ed83f60914631cf1
SHA512 c661638d839ee857d6f3071320d8f164149cd7b9d9532d3b2d449501e9ec702f3d02f02b1c423e0f1690516f4b0b5ccfbfcff1665b0a6ee788951bc5beac5677

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7362179514065e5fdc13145fbcc28da3
SHA1 0f5fdbbff14a85e162368413a58adbe6301ecfa4
SHA256 e9cef36ffd436d416712376ef12f4590405ca8f8ea4db53fd45326f259b74bbe
SHA512 74f5b1170dae533af8883fe74c2698a99b8ae7db3890dec91cbc503215d288636cf7900b832a2569cb4be8810771a4ef40cb8e96ea82ec496b4c624077afa60b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 ddc20d2a5fa0619ad1d5b109d517121e
SHA1 5fc65d9f425737f534fa1549180f85fb7d85b562
SHA256 17a9241c03eb95b4bd4137adf2a28f1d51283f1314c15e94c9c3fa0d481da372
SHA512 7074bfcf29ad2bfd3b97e20addb8f1150016277bbffb177256a74077864fd7979a84759b38cd6832df339f3fbe9151cb9896d587c157602e714bf57ca4724dd1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 782037f620f860ba9f9410c7f716b8e3
SHA1 b3044a2e16e60518730a444c34c0699a664e2c88
SHA256 8cd00c726b67ca04ea7558409bb984cefac65ad6513028a08b2618ff7367c6f0
SHA512 12a6c93ff6345fafda8bd7945f00b20e2bfad1c83ad7bedb332414c432151700830eecaefeadaa6e6c37ebd1a5fe1abb4b6349df6ad3ec026cd6ee0192fc3388

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1070f5bfb6bd9ba6316af8c6ba610e9b
SHA1 f7c755267a5cddbdb5a049f08aaf3eed14e367db
SHA256 6f164078c8e25cf19f20c0508ffa10032c141e53801aaf46f27ab37b493f91fd
SHA512 7287f401d1e78164ad58495d93d0d8f0b3f3eeb0f624e8a6e7df4836f87848f2bc7438a17c54806008f8cb2c7c406ae18465a3608f888db7593695024df3d1ce

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1f09f6b77c88bc9a418b02ed45be405d
SHA1 ed907d1d4d428d0daebed7a5f119c6872a0114bb
SHA256 9fb3bd1f91cd45b69d9ec0a131d921d6b1c2332882480a131d5946490e8a0f3d
SHA512 d9d233c65819759cb92c57f278d82b668b720b3b3c32fb4d9221cdcdc6de0e4a3a950e9429eaa4153d03a1983278063490d2954cf6290deeb6cd894e843fec38

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 05:40

Reported

2024-11-09 05:43

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe"

Signatures

Detect Fabookie payload

Description Indicator Process Target
N/A N/A N/A N/A

Fabookie

spyware stealer fabookie

Fabookie family

fabookie

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Files.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zaikais = "C:\\Windows\\Microsoft.NET\\Framework\\mirzas\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\manifest.json C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4356 set thread context of 5936 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\File.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133756044624661993" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\File.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1632 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 1632 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 1632 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 1632 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 2672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 2672 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 1632 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 1632 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 1632 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 1632 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 1632 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 4636 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4636 wrote to memory of 4844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 1632 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 1632 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 1632 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 1632 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 1632 wrote to memory of 3676 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 1632 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 1632 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 1632 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2104 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 2104 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 2104 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 2192 wrote to memory of 6240 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2192 wrote to memory of 6240 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2192 wrote to memory of 6240 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 1632 wrote to memory of 6264 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 1632 wrote to memory of 6264 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 1632 wrote to memory of 6264 N/A C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3952 wrote to memory of 5180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe

"C:\Users\Admin\AppData\Local\Temp\35993f126e2e49df8f6c7c50c33b2529e8c4b9c90987ebf5bc52dc05e5d5dcb6.exe"

C:\Users\Admin\AppData\Local\Temp\Proxypub.exe

"C:\Users\Admin\AppData\Local\Temp\Proxypub.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Btnm7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc05b846f8,0x7ffc05b84708,0x7ffc05b84718

C:\Users\Admin\AppData\Local\Temp\Process.exe

"C:\Users\Admin\AppData\Local\Temp\Process.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Ajhp7

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc05b846f8,0x7ffc05b84708,0x7ffc05b84718

C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

"C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe"

C:\Users\Admin\AppData\Local\Temp\askinstall492.exe

"C:\Users\Admin\AppData\Local\Temp\askinstall492.exe"

C:\Users\Admin\AppData\Local\Temp\File.exe

"C:\Users\Admin\AppData\Local\Temp\File.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe"

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -u

C:\Users\Admin\AppData\Local\Temp\Files.exe

"C:\Users\Admin\AppData\Local\Temp\Files.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3920 -ip 3920

C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2327834908255239932,5594813404434349217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"

C:\Users\Admin\AppData\Local\Temp\11111.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Ajhp7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc05b846f8,0x7ffc05b84708,0x7ffc05b84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\11111.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4160 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1rPS67

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc05b846f8,0x7ffc05b84708,0x7ffc05b84718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf355cc40,0x7ffbf355cc4c,0x7ffbf355cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2384,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2396 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1880,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2428 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1968,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2560 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3704,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4548 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4752,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4692,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4768 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4672,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3700 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3660 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5152,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5160 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5156,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5308 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5184,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5452 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5392,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5356 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3564628250550392571,15675890725701559409,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5412,i,12492130331724855713,15779388090378654519,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5232 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 www.listincode.com udp
US 3.225.234.52:443 www.listincode.com tcp
US 8.8.8.8:53 datingmart.me udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 iplogger.org udp
US 104.26.2.46:443 iplogger.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
FR 212.193.30.45:80 tcp
US 8.8.8.8:53 46.2.26.104.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 54.209.42.5:443 www.listincode.com tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 iplogger.org udp
US 104.26.3.46:443 iplogger.org tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 46.3.26.104.in-addr.arpa udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.hhiuew33.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.187.202:443 ogads-pa.googleapis.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 142.250.187.202:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com tcp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.178.14:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 216.58.213.1:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 1.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 45.144.225.57:80 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Proxypub.exe

MD5 a6ff722fe5cb9ea9444a79e38343241f
SHA1 c297a99afd248fa076654e42ae84b7ca9e1ca59a
SHA256 791999c706f021b4d8eadd56a130dec270b4b366a96b6164abf7a72125d27209
SHA512 8fa87affee6086fa6888a2159dd0a14f122a79c5bb7fb04471dc91c50338feac085e6506e7948270e4c6a1e2610efedc3d56b647ddc7109e9adffb869c335b7a

C:\Users\Admin\AppData\Local\Temp\Process.exe

MD5 532603329a655dc6812c790fdaccf378
SHA1 464b251e62f67f346b262df8eaae7d0bbf0f4b52
SHA256 ab681e11dd1ba868c78016fe08c507b130304a1a1ac4d84a9fa0f00a15a00dca
SHA512 5067268797fa6752bafd9069447d3fa0cb6116ce594d4419f9d8e0891706cac684ad6af425569ec83f404d461b07661f74502918d92e3735d79c427e353000ca

memory/796-37-0x0000000000400000-0x000000000043C000-memory.dmp

memory/796-36-0x00000000001C0000-0x00000000001F9000-memory.dmp

memory/796-35-0x0000000000750000-0x0000000000850000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ltt.url

MD5 44264182fbb802b9671f6abb7faa6a53
SHA1 ccc380eaca3c618f54fdb3d907f50a5f039469da
SHA256 62aad2b0d832421b890138182a25ed331fa39765d0700b84fd6c1c580ea3f0fc
SHA512 43d24f86dd04c479e534fad83efefa2f70bb298ab9e9ea2f737a9adcb79bc330f235d3ff6ae8d413a973968e4951a93a07718a908510f4a0a48017c2b03b824f

memory/796-41-0x0000000000400000-0x00000000004F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Folder.exe

MD5 4538da85464e576893aec470fc71229a
SHA1 c47826fd48cc1ea12a1ef57818f820ef1da084b5
SHA256 8aff0e13328a2129ca13284d80bed1f72100a78a2c4fa696b2aa95a6152f2983
SHA512 9f62882a237a3619253aa9283303c91d0cb0f18117dc5b86b4a58cfdd7eabc4a389d4c43f93e84315d97fae49345013fbb43eccce29bc381d780a37a9d98f431

C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

MD5 2f02d5af8f2ad1917f8fc5fe17127da1
SHA1 1bb680702a52dc9046984b87f1e3387530009222
SHA256 bccb32358a54efc1e9f62859c3c6aeb1da93b4e4159a76972f38f8737b0dd69d
SHA512 8aa125a1db54314047066058d051259f56efbf3a20998f12fdafc20418ff12e249d5c1aab4b01e8cc859e3166377d05c217dbd47ae0817c5836333b1b82def67

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

MD5 9a20c492f91287895ae49de71f479376
SHA1 376afa85c761170a89cdfa2241498ddc8f9bea1a
SHA256 9504d1a7c7ed4d2ea4b88b1ffc80f19c0efddc4c5964e6f906e70e6089764cdf
SHA512 d502900170e65f22c8e031c8186998428f6a95213c19425d7bb2d0f96a0484522b596e811d0aae791ae1b7e739e85a3687cde83a3c61adba55f3e83f09a6bd4d

memory/796-84-0x0000000002280000-0x00000000022B4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\askinstall492.exe

MD5 5a9ed91a1c2467ae921d52f6df3cd4c6
SHA1 0c0c7cbae68b09c2da22c68dbbf3bf2f27f60545
SHA256 b4a5844e6ed96e04782b9f64f5393509119f2c984d20b74edbcf8b03269f1479
SHA512 f07980049deacffded94a697878649394a95e321e527c88baa608ffd05830ad35c86d5d3ac976a813c0fa2c75304633ec2738b765cda5c128348709ca4260956

memory/3920-99-0x00000000003B0000-0x00000000003CA000-memory.dmp

memory/796-98-0x0000000002630000-0x0000000002662000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\File.exe

MD5 90c7efe55fff3704de712084227e84a6
SHA1 b60983bec0346c6fdc0569f641e9091b7f201a5b
SHA256 6bb5f93524d19c19ad102c9577107b7761e1ce94ea2229594fab55fdb98a7e34
SHA512 64556f35c8a13cbe7ff7087bc88e19faaac64091bd1f2ad6251651ab0caabc70c2e388420528893193811a387039e1bfb906c4d2e5f2f8e5deb3d8931b78e65f

memory/796-97-0x0000000004E10000-0x00000000053B4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

memory/3920-102-0x0000000002530000-0x0000000002536000-memory.dmp

memory/796-140-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-170-0x0000000002630000-0x000000000265D000-memory.dmp

memory/3920-449-0x0000000007130000-0x00000000071C2000-memory.dmp

memory/796-169-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-166-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-164-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-162-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-160-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-158-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-156-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-154-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-152-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-150-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-148-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-146-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-144-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-142-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-138-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-136-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-135-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-132-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-130-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-128-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-126-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-124-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-122-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-120-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-118-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-116-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-114-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-112-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-110-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-108-0x0000000002630000-0x000000000265D000-memory.dmp

memory/796-107-0x0000000002630000-0x000000000265D000-memory.dmp

memory/4356-1076-0x0000000002320000-0x0000000002328000-memory.dmp

memory/4356-1078-0x0000000004B10000-0x0000000004B74000-memory.dmp

memory/796-1079-0x0000000004CC0000-0x0000000004DCA000-memory.dmp

memory/796-1081-0x0000000005A20000-0x0000000005A5C000-memory.dmp

memory/796-1083-0x0000000005A60000-0x0000000005AAC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Files.exe

MD5 cab647efcbaa4d2a81e3bfd8122a2a67
SHA1 8783a13798a427cef74baee553c2dec8f123e52a
SHA256 8b682d2e77e42f985975b4d77fd8e94136a45850b5b5f5633c2b6b51f2cd4c99
SHA512 5d3549a7eb1ee7f56478cb810ce867b48cfa624e8ea9726406b87e692e24dbb09be61edb5081a7ed80196c78199b254173ea08144ad21046a220c960c56d95c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

\??\pipe\LOCAL\crashpad_3952_DBEYFGFLXXTAAMTS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\RarSFX1\frlzd.exe

MD5 57d626d8e6951c2b6d1a883a73b998bb
SHA1 59ccbfce02af3628ef9e34f6d41c1ef9e34e0808
SHA256 c93e60e1b3a6ceb63ce7cbf2e7757763f3fe79fb094e5725759f9b8ecafef1ca
SHA512 2745485dc7fd2da9ac1b81eb4058b32e2fc5c3f990bfab6321a3ef876a14d8a70d66bbe8c392bf18579a80eea3c9272e8cdde63f40ad44a050d5a0db66e71663

memory/796-1077-0x0000000004CA0000-0x0000000004CB2000-memory.dmp

memory/796-1075-0x00000000053C0000-0x00000000059D8000-memory.dmp

memory/4356-1037-0x0000000004A00000-0x0000000004A9C000-memory.dmp

memory/4356-717-0x0000000000120000-0x000000000019C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a356bf2fc79f2a2ab4cb7c5d8c63c27c
SHA1 a0837d6ae956859992fd4c99face59edb6639752
SHA256 c609c3280f139fdcedcaa4d9bdfc435792c5cb7f72a9a29cbf105bba2c3fe096
SHA512 7fc8680fee8c2bc7d473d9001410fb075c5af2cd08e837c315fa3ab8b29c64c7fe0d9b283ff0fedff285cfc0599132110fe6e4b562b3047bc63ff10c4c333227

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9cb5b35012655ac974df5ebc8830af72
SHA1 0cfa822b6ae21841d656b86f96be9a10085e818c
SHA256 e2f29188e105e787551bc79e9534058445955f4eb3650fa22f02894f10e5b48f
SHA512 604d7097ce954eb32233159ec0043ab0cb7b126ae1f03c30bbfbd8f20afd36a3e836c28bb6016c85d615d9c40c51bfbb3cc54dd1fe7e9c1cf9407217ec88d092

memory/7096-1124-0x0000000004DC0000-0x0000000004DF6000-memory.dmp

memory/7096-1125-0x0000000005480000-0x0000000005AA8000-memory.dmp

memory/4356-1128-0x0000000004BE0000-0x0000000004BEA000-memory.dmp

memory/4356-1129-0x0000000004DD0000-0x0000000004DF0000-memory.dmp

memory/4356-1131-0x0000000004E60000-0x0000000004EB6000-memory.dmp

memory/4356-1130-0x0000000004DF0000-0x0000000004DFC000-memory.dmp

memory/7096-1139-0x0000000005C10000-0x0000000005C76000-memory.dmp

memory/7096-1138-0x0000000005BA0000-0x0000000005C06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mi3wtgz4.llm.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4356-1142-0x0000000005C70000-0x0000000005CAE000-memory.dmp

memory/7096-1132-0x00000000053E0000-0x0000000005402000-memory.dmp

memory/4356-1150-0x0000000005E90000-0x0000000005F4A000-memory.dmp

memory/6460-1154-0x0000000005E60000-0x00000000061B4000-memory.dmp

memory/4356-1149-0x0000000004EC0000-0x0000000004ECE000-memory.dmp

memory/4356-1148-0x0000000005DD0000-0x0000000005DE9000-memory.dmp

memory/4356-1144-0x00000000050F0000-0x000000000510A000-memory.dmp

memory/5936-1156-0x0000000000400000-0x0000000000420000-memory.dmp

memory/6460-1188-0x0000000006450000-0x000000000646E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11111.exe

MD5 cc0d6b6813f92dbf5be3ecacf44d662a
SHA1 b968c57a14ddada4128356f6e39fb66c6d864d3f
SHA256 0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498
SHA512 4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

memory/6460-1196-0x0000000072BC0000-0x0000000072C0C000-memory.dmp

memory/6460-1195-0x0000000007410000-0x0000000007442000-memory.dmp

memory/6460-1207-0x0000000007450000-0x00000000074F3000-memory.dmp

memory/7096-1208-0x0000000072BC0000-0x0000000072C0C000-memory.dmp

memory/6460-1206-0x0000000006A30000-0x0000000006A4E000-memory.dmp

memory/5744-1218-0x0000000072BC0000-0x0000000072C0C000-memory.dmp

memory/7096-1228-0x0000000007D10000-0x000000000838A000-memory.dmp

memory/6460-1229-0x0000000007790000-0x00000000077AA000-memory.dmp

memory/7096-1231-0x0000000007730000-0x000000000773A000-memory.dmp

memory/6340-1233-0x0000000072BC0000-0x0000000072C0C000-memory.dmp

memory/7096-1243-0x0000000007940000-0x00000000079D6000-memory.dmp

memory/6460-1245-0x0000000007990000-0x00000000079A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

memory/6460-1252-0x00000000079C0000-0x00000000079CE000-memory.dmp

memory/6460-1253-0x00000000079D0000-0x00000000079E4000-memory.dmp

memory/6460-1254-0x0000000007AD0000-0x0000000007AEA000-memory.dmp

memory/6460-1255-0x0000000007AB0000-0x0000000007AB8000-memory.dmp

memory/796-1256-0x0000000000750000-0x0000000000850000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 61cf9a0269e5dc9047ffa0261897a617
SHA1 e24b7dd4c6d2cf4638cf3ea37cea321a67da4ffc
SHA256 edc066f5ec9e76c37513acd8ddf9fe26401cb640be6b4f9fd68f5fc895ff8c4d
SHA512 74a26b1a29df858f83aafdc03730acd60ef20905201417f5cf8d2c0c8a34335ef667688b2ddf0c92199e4955cd5125bcb069adfe475f1a45db44b8c3844962d0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a3a96f2f0433fb3a3ad827829a4d8ecc
SHA1 b365382d0e56a5d847c8c5589d398ae88f0f04b5
SHA256 a96a74825e38772d0c8b3f252d8d60f1fd11c52b777d09f1a409eb62ad6e217d
SHA512 9a6db29d463c30f5743522cf3e2c6712c0c748e98533d427e8d5e99b9d4c4fa461711ed90312703a1b230b3898774009ba21ae1f9a89a72d0e16e06b590d56fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Temp\11111.exe

MD5 7165e9d7456520d1f1644aa26da7c423
SHA1 177f9116229a021e24f80c4059999c4c52f9e830
SHA256 40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
SHA512 fe80996a7f5c64815c19db1fa582581aa1934ea8d1050e686b4f65bcdd000df1decdf711e0e4b1de8a2aa4fcb1ac95cebb0316017c42e80d8386bd3400fcaecb

memory/796-1293-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

MD5 2000d6a0592cad8bef0049fbeef58f6a
SHA1 bc1a19c9e373cf9d8a29c8cd470566d9379c8633
SHA256 feda2c22119e11647416b3a193446e54ee5e3aea2e1354db7ee22f1fe2af511c
SHA512 f65d4fa09340f7aaa3200fe1a1a5deedd7ad4027245293458da00bda2fd5c777487e66c6c641722ddc12fb6d877fada16f31c798f079a42d5f40e58a5117f7c2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 6efc271a1ef6ac8e0be9b526a759fe93
SHA1 98cd18080fef04290fbcfae1b32337bff044bffa
SHA256 69f3809f4a204b428047aa10a7bb1c7fc048ea97dfe509e56f270b707fc7cd8d
SHA512 e4de6c0a5690ed8fcb093a02ff298aaf37e7eb7063979fc7252f4e30417c2ac21c2020e440e27788f8d544732791114945a6f1f4e2352732945a6902f22ac69e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 e148f399adb02bb3d0c33237e15ea862
SHA1 fc4cabe5d8fc0fc8a7b9a1e05adfb025940bbdef
SHA256 ea18d3454e96914e6d248c67541725d705d3fed2284c819b65bfee914123160f
SHA512 1fe3060ac7af13894a728220da665074d1f60498f18e3b17e1a154ffbe387314b1b51a4447ee2a4c6a249022fd240711040d7a1d6b0a4b04dc9ecc901e1bad63

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 30627dc84ef9079a7b9842811117eb3a
SHA1 b51a6072dfa0893864a0b74ce7887f263f315ecc
SHA256 f221ce86a346bc0b5f9afd2178b19b61c018ca0d12200420fa1db5b3d52844de
SHA512 1fd181cb74efa7dda294f1b09f51e69a1a9ffa45ca0b9e9d97ff57c2ec8a23f27c01e9f9500fd4c2dc4f2444dca6a8fd2481c11a894b3687bed4b5f1b9df7e0d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\6327aba9-8966-4908-89a0-6324b5871d15.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Temp\scoped_dir6228_273927539\83f9c5ca-601e-420b-8c17-13517a165404.tmp

MD5 da75bb05d10acc967eecaac040d3d733
SHA1 95c08e067df713af8992db113f7e9aec84f17181
SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA512 56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

C:\Users\Admin\AppData\Local\Temp\scoped_dir6228_273927539\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Temp\RarSFX1\aprt.url

MD5 e8d2bf8df88d0ea7314b1a256e37a7a9
SHA1 eaca56a92db16117702fde7bb8d44ff805fe4a9a
SHA256 57fa081cc5827a774e0768c5c1f6e4d98c9b91174ad658640bea59a17546752b
SHA512 a728e6ef3e9a8dc2234fe84de7c0b15d42d72886745a4e97a08cf3dc5e8c7619c5e517f3f23fe1a5c9868360d0e89c8b72d52b7ee6012bd07c1589c6a78402b7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 3fcd158e76141afc16301956d7ea560b
SHA1 f89423c2e107f9eea084a0f3bd17d46711609453
SHA256 30f539bcb9a2d1f8d3c379a220891eabd11a1308c4f4f3f4aef4453049e35b6a
SHA512 8d7ea97ebf956c68707a2448b7692d891d1a658c5e99023f47f965006bb92d2fdf7bd5d95f8c4220fa7c037a50f01862132875f5f2246d6facd3e0bb6954d67f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4ba1492ee5e98c99d3d06d04b7c38bc6
SHA1 a61fc478f2fc854b5f23bd25c02abbda75e9549b
SHA256 fb0efff27d92f66e148a161ac7dfce56400fefb4f38addc7261a03c38593fb1c
SHA512 406561fbf086b2857c9bb0fc0c05f828c0fbdea0663a63ca0032bc92d17e2729c27038f82702702925e6b84dc0ca78cc71f75d28d00b4f27e0c602cfe61ca3ba

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 ae47613201f86d59bc957d905c939fda
SHA1 bf0a9ccb2e676822f1fee2659c20f754dcf2ef52
SHA256 7010ae6ef7e42ccc499b3d199e406e679c13219a167ee4e9e24ad9865d2313a7
SHA512 55e3a639e04ab02c27d5f4c469e7b6a2f99dd61bc712250406e5a8770929ca533b10d68ffca72e29f3bf3571d8c4c95457e2b9eef5f01bf7451e21f034e96a4c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 68bf84cfa5a103d65981893c03ddd32e
SHA1 77477b9086a2f044a68d54e25e42cfc784ae5c77
SHA256 90109bdbc39a5566ee69dc40d5f9f3b1050df3ce121b9c94c2d2667ab58151da
SHA512 ff19b11988449134e01cf57520d6795ba73f87b0c51f931eb0ece5a567835dfd163bcef0a63972a29765a07144701ab97e1c5c53da16320a974086272c37cdc7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 360614cdd24b4077f8a6867c42a7f6fb
SHA1 a2224743354f67f509879000e6352cb40217e2b3
SHA256 10c2dec72ec639c8d5fe39515a2c777b2e48389c45470407c7ec7360384db091
SHA512 03a46623a0afda7ac1c48b9fadf8b2347def762f6e23170f3b7236e8256f86bfaee009f49bb4e715f2030a7a4df14d3370844fe21e020814be5f54004a2fe7de

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 4cdacf60d061698d307ab041fcd1e0b1
SHA1 ba7c55efd9a78851d3de0272b166ea5332b81ae8
SHA256 f7c7007e01dfdafc3ec906e992c680d78f0a3f1601db7fa0ddee8450fbb38fee
SHA512 b295bb94166db0f509be60f59c59462b6ac8fcbc0dc91dd2aa0f2fd4f17a81eaa38907967754c624518616b0900249b6e9eee3629bac1ed4cf09de1dbdbf4310

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 1aba511278e9cee9ba1e53024ec9231a
SHA1 5c8b50815ed87b32abec686cb82efdbea4a10d27
SHA256 533ac09445889c6cd4cb90e9bdb98762c57617ae0ba38761551ce95abab60c88
SHA512 e181e2fbebb573d12e5e91f859a2c9f2d67fe6bdf94cf88534423483ef04302a2bccae5c43f422c83e8b7f567fcecd2d926217685d842a0f16f0d013b524e1ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 29e57fd47308573d553211f93c6f04f1
SHA1 741b59524b7d4a4af25f07978a1d7f1029fb8c82
SHA256 4504b329a279a04c2cc38e01eab1e31c733b5494ee2f49f7bc5334ecd7f3f952
SHA512 ab36d38600cacdd369bdea860c73f2cbe82520f8a777a900f5d53e0d16e2b150ad1028d77af49e5f5d074c2833fd53812aadc3f18f9a05177f47122344e0c913

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 f0fd6bef48fd3245d7d1cd9d362d7059
SHA1 18d23515f20057ae8b403defc8fcfe1067b6c933
SHA256 80f850db4869474bf17b55f4e59a050431a63a183fabaa26f37ba37d480cb342
SHA512 e6f1fef1b02b80718c57ff0304bc76c75d37dcca84d70c2ae4955d07088406a1a0a27893afe4e71d6ad62ebe4e7ae09a85eeb16706ae973cb89a6b9c2c140d11

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 4bc8a3540a546cfe044e0ed1a0a22a95
SHA1 5387f78f1816dee5393bfca1fffe49cede5f59c1
SHA256 f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca
SHA512 e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 cfd407d1019d4c9f66095573cc3f1f13
SHA1 2bd5251211022ca278b7d75edf6a54c6f6ea6cb0
SHA256 4b0f160881cb15f608a92738c478232c11730d2a2c38bdc9725dc5f33c26f969
SHA512 3aad6d69ec1541f1fe22a32b7093e8046492b93d6ea422ed0f9f9d38488a16299c5c8ca8af1698fc40bcccc6d31719547562bc4881fa250f51ffa29aea0b6e96

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 252e776c1d5e784e4fbafe0fce8ca878
SHA1 16ac32f1c7d4832c26a487b7d854eaf5b80e2ded
SHA256 3f11935120f517bbfd46f7def2c10f89c3f675cc1cf336c5489f17c7dc028255
SHA512 9aa73d890ef51d87f2d2359805f6e839db110d56d2b89da061ee97105b436c38706e9d34b167d7a65e6e783915dbf80cc4ddb200255d87633752a7ff8151a199

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 32a8d189ba64727f5aad7954a1d57ea0
SHA1 5a87b6afd6dbb4a92b833109a060de8a2484d7bc
SHA256 ee904c08ed0b84ba6113745c7c75977193b26af9105d04d90ddb41756ca127c4
SHA512 488c8919f9bd599f720f9fce6eaa95804d03f450b88ac58c4ccf9cbe43f505fa7ab3bb4164fbb33070488649ffb32fb08a981f60c93a002acd6b273206e20f8a