Malware Analysis Report

2024-11-15 09:04

Sample ID 241111-jhxj8awaql
Target 5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7
SHA256 5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7
Tags
fabookie privateloader redline socelars faker pablicher discovery evasion execution infostealer loader persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7

Threat Level: Known bad

The file 5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7 was found to be: Known bad.

Malicious Activity Summary

fabookie privateloader redline socelars faker pablicher discovery evasion execution infostealer loader persistence spyware stealer trojan

Privateloader family

RedLine

Windows security bypass

PrivateLoader

Fabookie

Socelars

Fabookie family

RedLine payload

Detect Fabookie payload

Redline family

Socelars payload

UAC bypass

Socelars family

NirSoft WebBrowserPassView

Detected Nirsoft tools

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Checks computer location settings

Windows security modification

Executes dropped EXE

Loads dropped DLL

Looks up geolocation information via web service

Legitimate hosting services abused for malware hosting/C2

Checks whether UAC is enabled

Drops Chrome extension

Checks installed software on the system

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Drops file in Windows directory

Program crash

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

NTFS ADS

Kills process with taskkill

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

System policy modification

Modifies Internet Explorer settings

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-11 07:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-11 07:40

Reported

2024-11-11 07:43

Platform

win7-20240903-en

Max time kernel

37s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe"

Signatures

Detect Fabookie payload

Description Indicator Process Target
N/A N/A N/A N/A

Fabookie

spyware stealer fabookie

Fabookie family

fabookie

PrivateLoader

loader privateloader

Privateloader family

privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A
N/A N/A C:\Windows\system32\WerFault.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zaikais = "C:\\Windows\\Microsoft.NET\\Framework\\mirzas\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2600 set thread context of 2356 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\File.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000003b90bbac78c1b2abf7e67f4ee30b5698243cbf8425bd9ce11270eb79be88ec85000000000e800000000200002000000085ab16bc2c86622e0958065f19b399cf2d32335a909c95f4550ab162a028e8e8200000006d1ef15609921bca1a3e647a41e6b6dafc6ed296cc5e4663a5b9adbdf2ae0e3c40000000f6d87334b777972ba91ff5ce54798825b9a3e118774874017488da5c57ce35a453eb8a109f2ca71e268e8c9c385cc9e3d32027aeb359e200a92f231f75f6f38e C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000781b878fcf646e50e3008e0dc10d38a127a7de2a057db9e86ac77bed5fb5d486000000000e800000000200002000000002499d70c5d9d42fc01c92e6bbb1926b3ade7ba48d52778bdc660a42a72442e990000000dacaa517a0cd5ab876df85668e1d89a40d34bd74b69438749b69288deca5e61306cc6ced4bb982d616ae8b4f4200cd04f70304a7efaaf78bacf7196332c7d388f6a058da57cea36ab160fb9f1bcbc60bb0c50bf023b79a6e9e3b246bd11a8681f3ba54de67f14c168c07c8cdd72224b04db5fcd98fb69e483b12cb98040a22bfe7149d5a2164f3dafccbbc350c1cc89f40000000144495221d5760c14eda2acb50bd2bf4384a53d17e9bc08cbc3a7c751de96e4bce7638f5a09d6232e94eee7995ba25e2a80a96bbd879067dcaafbb85582da927 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43D03751-A000-11EF-9527-EAF82BEC9AF0} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003a3b080d34db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\wwwA42.tmp\:favicon:$DATA C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\RarSFX0\ltt.url:favicon C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\www19F8.tmp\:favicon:$DATA C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\lzst.url:favicon C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\wwwA32.tmp\:favicon:$DATA C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Users\Admin\AppData\Local\Temp\prxza.url:favicon C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 2644 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 2644 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 2644 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 272 wrote to memory of 3000 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 272 wrote to memory of 3000 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 272 wrote to memory of 3000 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 272 wrote to memory of 3000 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2644 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 2644 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 2644 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 2644 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 272 wrote to memory of 2176 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 272 wrote to memory of 2176 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 272 wrote to memory of 2176 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 272 wrote to memory of 2176 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1392 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 1392 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 1392 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 1392 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe
PID 2644 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2644 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2644 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2644 wrote to memory of 5716 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2644 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 2644 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 2644 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 2644 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 5716 wrote to memory of 5856 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 5716 wrote to memory of 5856 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 5716 wrote to memory of 5856 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 5716 wrote to memory of 5856 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 2644 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2644 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2644 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2644 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2644 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2644 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2644 wrote to memory of 5924 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2644 wrote to memory of 5984 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2644 wrote to memory of 5984 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2644 wrote to memory of 5984 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2644 wrote to memory of 5984 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 2644 wrote to memory of 6064 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 2644 wrote to memory of 6064 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 2644 wrote to memory of 6064 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 2644 wrote to memory of 6064 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Files.exe
PID 2600 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 1268 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2600 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe

"C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe"

C:\Users\Admin\AppData\Local\Temp\Proxypub.exe

"C:\Users\Admin\AppData\Local\Temp\Proxypub.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:272 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\Process.exe

"C:\Users\Admin\AppData\Local\Temp\Process.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:272 CREDAT:209927 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe"

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe"

C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

"C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe"

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -u

C:\Users\Admin\AppData\Local\Temp\askinstall492.exe

"C:\Users\Admin\AppData\Local\Temp\askinstall492.exe"

C:\Users\Admin\AppData\Local\Temp\File.exe

"C:\Users\Admin\AppData\Local\Temp\File.exe"

C:\Users\Admin\AppData\Local\Temp\Files.exe

"C:\Users\Admin\AppData\Local\Temp\Files.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 944

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:272 CREDAT:1258503 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\11111.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 6064 -s 488

Network

Country Destination Domain Proto
US 8.8.8.8:53 iplogger.org udp
US 104.26.3.46:443 iplogger.org tcp
US 104.26.3.46:443 iplogger.org tcp
US 104.26.3.46:443 iplogger.org tcp
US 104.26.3.46:443 iplogger.org tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 gp.gamebuy768.com udp
GB 216.58.212.227:80 c.pki.goog tcp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 www.listincode.com udp
US 54.205.158.59:443 www.listincode.com tcp
GB 216.58.212.227:80 c.pki.goog tcp
GB 216.58.212.227:80 c.pki.goog tcp
FR 212.193.30.45:80 tcp
US 8.8.8.8:53 datingmart.me udp
NL 45.9.20.253:11452 tcp
US 52.203.72.196:443 www.listincode.com tcp
SG 51.79.188.112:7110 tcp
US 104.26.3.46:443 iplogger.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 104.26.3.46:443 iplogger.org tcp
US 104.26.3.46:443 iplogger.org tcp
US 8.8.8.8:53 www.hhiuew33.com udp
US 45.144.225.57:80 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.18:80 crl.microsoft.com tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 wfsdragon.ru udp
US 172.67.133.215:80 wfsdragon.ru tcp
SG 2.56.59.42:80 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp

Files

\Users\Admin\AppData\Local\Temp\Proxypub.exe

MD5 a6ff722fe5cb9ea9444a79e38343241f
SHA1 c297a99afd248fa076654e42ae84b7ca9e1ca59a
SHA256 791999c706f021b4d8eadd56a130dec270b4b366a96b6164abf7a72125d27209
SHA512 8fa87affee6086fa6888a2159dd0a14f122a79c5bb7fb04471dc91c50338feac085e6506e7948270e4c6a1e2610efedc3d56b647ddc7109e9adffb869c335b7a

memory/1604-36-0x0000000000400000-0x000000000043C000-memory.dmp

memory/1604-35-0x0000000000220000-0x0000000000259000-memory.dmp

memory/1604-34-0x0000000000600000-0x0000000000700000-memory.dmp

memory/1604-37-0x0000000001F00000-0x0000000001F34000-memory.dmp

memory/2644-38-0x0000000002370000-0x0000000002372000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\prxza.url

MD5 3e507ecaac6710d93c101c67ae45fdab
SHA1 0f7509702c29f205da48a1d8fc3ef346fcbf5197
SHA256 083f728d22bc6f1ed6bfa9ecaeb68528a9eb433c0e8e67a52426047ec3e41488
SHA512 865d48b26a5cd771cb0407e106da3c4a7b5cbb43a6002f5b70fb4dcdfd55498392bc42b31c054420f295b75807134c6c26574669e435087260a68ef497277531

memory/1604-40-0x0000000001F30000-0x0000000001F62000-memory.dmp

\Users\Admin\AppData\Local\Temp\Process.exe

MD5 532603329a655dc6812c790fdaccf378
SHA1 464b251e62f67f346b262df8eaae7d0bbf0f4b52
SHA256 ab681e11dd1ba868c78016fe08c507b130304a1a1ac4d84a9fa0f00a15a00dca
SHA512 5067268797fa6752bafd9069447d3fa0cb6116ce594d4419f9d8e0891706cac684ad6af425569ec83f404d461b07661f74502918d92e3735d79c427e353000ca

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ltt.url

MD5 44264182fbb802b9671f6abb7faa6a53
SHA1 ccc380eaca3c618f54fdb3d907f50a5f039469da
SHA256 62aad2b0d832421b890138182a25ed331fa39765d0700b84fd6c1c580ea3f0fc
SHA512 43d24f86dd04c479e534fad83efefa2f70bb298ab9e9ea2f737a9adcb79bc330f235d3ff6ae8d413a973968e4951a93a07718a908510f4a0a48017c2b03b824f

\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

MD5 9a20c492f91287895ae49de71f479376
SHA1 376afa85c761170a89cdfa2241498ddc8f9bea1a
SHA256 9504d1a7c7ed4d2ea4b88b1ffc80f19c0efddc4c5964e6f906e70e6089764cdf
SHA512 d502900170e65f22c8e031c8186998428f6a95213c19425d7bb2d0f96a0484522b596e811d0aae791ae1b7e739e85a3687cde83a3c61adba55f3e83f09a6bd4d

memory/1604-132-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-130-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-128-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-126-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-124-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-122-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-120-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-118-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-116-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-114-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-112-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-110-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-108-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-106-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-104-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-102-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-100-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-98-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-96-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-94-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-92-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-90-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-88-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-86-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-84-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-82-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-80-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-78-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-76-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-74-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-72-0x0000000001F30000-0x0000000001F5D000-memory.dmp

memory/1604-71-0x0000000001F30000-0x0000000001F5D000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 67e486b2f148a3fca863728242b6273e
SHA1 452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256 facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512 d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 374f60f198fc5f6680ed143dd3d0b198
SHA1 87a94c854c4fa798976b3bba001a01530932dca0
SHA256 bd408c256fd9b224d2b4ecb95935cc46e3a8faa750baff2de28d689c8f592c47
SHA512 d970efe0c96d538856ff0e81da13d4e64633277b317d9e5fdfec58d28bbc36647fefb50499fb647521bad1d8ad4aeb92486011ece2e75256af1f7536b7857cf7

C:\Users\Admin\AppData\Local\Temp\Files.exe

MD5 57d626d8e6951c2b6d1a883a73b998bb
SHA1 59ccbfce02af3628ef9e34f6d41c1ef9e34e0808
SHA256 c93e60e1b3a6ceb63ce7cbf2e7757763f3fe79fb094e5725759f9b8ecafef1ca
SHA512 2745485dc7fd2da9ac1b81eb4058b32e2fc5c3f990bfab6321a3ef876a14d8a70d66bbe8c392bf18579a80eea3c9272e8cdde63f40ad44a050d5a0db66e71663

C:\Users\Admin\AppData\Local\Temp\File.exe

MD5 90c7efe55fff3704de712084227e84a6
SHA1 b60983bec0346c6fdc0569f641e9091b7f201a5b
SHA256 6bb5f93524d19c19ad102c9577107b7761e1ce94ea2229594fab55fdb98a7e34
SHA512 64556f35c8a13cbe7ff7087bc88e19faaac64091bd1f2ad6251651ab0caabc70c2e388420528893193811a387039e1bfb906c4d2e5f2f8e5deb3d8931b78e65f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 3f03e392cdb1648f3f6064e87ed7ecc7
SHA1 638dff902e2b62b710db9ddce1830b0ea304087f
SHA256 3fb023ee98f3768cef9afeb1f88a03e55261a3677322fcd6721ced1f15613586
SHA512 a2c91aeaaf9d894185887f0d573c8b4755337017e7609a911da67c78df50fbdf5447a0b63ad265bad6528bbd5e6bc0d2f299516150614a2388d5a993207ac6d8

C:\Users\Admin\AppData\Local\Temp\Tar784.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 504e762b3e0518018c48708b8ac977a3
SHA1 738ea95e26d9b640776c2fed809b66980e9341d6
SHA256 2f4cea182c9852ab8561858aadf78f85a01f11b02cca18d33b67a7bb89d050fa
SHA512 d7cdb937ad50dd26719c0c13364248fcf5a9a347eda9e859264775e4c435b7d09272d39dfadde0ec129abf564294f9ba1cbd3a6d482eeda89aa09a80abe58689

C:\Users\Admin\AppData\Local\Temp\Cab780.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/5796-1063-0x0000000000280000-0x0000000000286000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Folder.exe

MD5 4538da85464e576893aec470fc71229a
SHA1 c47826fd48cc1ea12a1ef57818f820ef1da084b5
SHA256 8aff0e13328a2129ca13284d80bed1f72100a78a2c4fa696b2aa95a6152f2983
SHA512 9f62882a237a3619253aa9283303c91d0cb0f18117dc5b86b4a58cfdd7eabc4a389d4c43f93e84315d97fae49345013fbb43eccce29bc381d780a37a9d98f431

memory/5796-1061-0x0000000000DF0000-0x0000000000E0A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

MD5 2f02d5af8f2ad1917f8fc5fe17127da1
SHA1 1bb680702a52dc9046984b87f1e3387530009222
SHA256 bccb32358a54efc1e9f62859c3c6aeb1da93b4e4159a76972f38f8737b0dd69d
SHA512 8aa125a1db54314047066058d051259f56efbf3a20998f12fdafc20418ff12e249d5c1aab4b01e8cc859e3166377d05c217dbd47ae0817c5836333b1b82def67

C:\Users\Admin\AppData\Local\Temp\askinstall492.exe

MD5 5a9ed91a1c2467ae921d52f6df3cd4c6
SHA1 0c0c7cbae68b09c2da22c68dbbf3bf2f27f60545
SHA256 b4a5844e6ed96e04782b9f64f5393509119f2c984d20b74edbcf8b03269f1479
SHA512 f07980049deacffded94a697878649394a95e321e527c88baa608ffd05830ad35c86d5d3ac976a813c0fa2c75304633ec2738b765cda5c128348709ca4260956

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\C24H5DR8.txt

MD5 28d73b9e8ce8b51754d3e2c956ac121f
SHA1 6e45569abeffadf1ac83be4c86ac37aaa9342ad4
SHA256 8b4287141d36011c5b4a4528558a5032d67c84d1a0c49ae35f20dc13b9225136
SHA512 2310b5e7fd171c474bab8747aec163e5a6edc1ef5b72a594ce24d15af9fa876bd5199ac31041173495a8fb677ede800e71bea0f5d5040676a8ce241715daf726

memory/2600-1160-0x0000000000330000-0x0000000000338000-memory.dmp

memory/2600-1026-0x0000000000F60000-0x0000000000FDC000-memory.dmp

memory/2600-1161-0x0000000000C60000-0x0000000000CC4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X1HXF8VN.txt

MD5 56002875901e8830f48fb2289d1fb976
SHA1 802a3d29b9a030c86bc4db22c4c39e884beff203
SHA256 ca05bf694d21d90e2a3136507f6cb439b5d6a98fcedd13a587db4a62b99e0b74
SHA512 4f61b4df98b897fc3a96ff18e3b111f6415f845f15694296621698822f35d82597851b9a77dd47639010b7facd539a207069caa128733c5299d5b154e003f07f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IAE3FJ0M\favicon[1].png

MD5 18c023bc439b446f91bf942270882422
SHA1 768d59e3085976dba252232a65a4af562675f782
SHA256 e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482
SHA512 a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\gsz3hkd\imagestore.dat

MD5 b201145058964e5af05731957d23f47f
SHA1 827bdafdd109baf07dfad3b76f5ead824a001403
SHA256 5060be0f89bc6e4e159d5849eaa456435887267f2ba24578f4def06fc4866b13
SHA512 1093ec5d4103aabd8b323463913ba6dbe4f72ca5d08d3d680a6f414ce174600476ca2b238bdf142e66b329e09e0a5d1bfff72b01c51d05eed6611751c9a3985c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 c07a4108b81dcb7d0a08de023cd81cbb
SHA1 c62b343f78152d94dca55bf650745961704eee9d
SHA256 52a280bf53e85fdf43be52341c2ed41ecd0d5f10da199584db480fb77fb4f591
SHA512 95615e306b01499d6a758e10421221a14f913659888faaf3bc27e051b27089a5cfd1edd6d3edb04b5cb79f53e3d25fdf80435290a3e05c525cd6c3263383c6a4

memory/2600-1211-0x0000000000EE0000-0x0000000000F00000-memory.dmp

memory/2600-1225-0x0000000000F00000-0x0000000001262000-memory.dmp

memory/2600-1226-0x0000000000A80000-0x0000000000A8E000-memory.dmp

memory/2356-1239-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11111.exe

MD5 7165e9d7456520d1f1644aa26da7c423
SHA1 177f9116229a021e24f80c4059999c4c52f9e830
SHA256 40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
SHA512 fe80996a7f5c64815c19db1fa582581aa1934ea8d1050e686b4f65bcdd000df1decdf711e0e4b1de8a2aa4fcb1ac95cebb0316017c42e80d8386bd3400fcaecb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5fecb5750b009b9ce6f27b64b54d54e4
SHA1 89cbda36db54142b33f2f5d89206e34e0e80a59a
SHA256 6383ea0cf29d6eca6bd7e9927f88312f6e39e735811bf8141c90a6f0128208c0
SHA512 0023f2d4b8869c04d1f25b8e8e78a72165b785bafb649b4499502df09a7590040b25c7375b2415a867bb538afd53befc61385a80a20da9b54063f9651d409142

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3fdf5a865992505f27778163c3bfaf72
SHA1 33299ac80e4354c54dfa73e9d0d4be7bca367c09
SHA256 4db5c0a28b3f6ca6926e614c3edd566e3e1f9411ac86ce91a7e36b910344aea0
SHA512 70b0121fb1866acceeceaab91849ec22ecf826461d0a52791bd04aa587e8f1a4d538caa6908a22433b11d0fe8dec97ee2ade4a19d1f5405f328cf2ce802bd073

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 294b97f6aa958490c112eacc332fcec8
SHA1 e7799f0f4b872c54630d28003caf92e80c07a376
SHA256 f9f9c83bfedb153c6ae7663c80b32209b049d91f7cb96d1bc8f64fd0556c5b26
SHA512 b1548298e5d2c811accb11145f9efe31f5e5fa877a322646263c4165547b8082d35ab08dd62af70d3be8a5e98820b361000f85f737501582be8c765049f0002e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e3139ecd1cd9c2864da2855a8de6c322
SHA1 b936a43de2a577a26661d02025e456441353a450
SHA256 998c0893f62acd2d9cb66b4a14f2f5ca92464c3c0049bcd2ffa00ea973cac4e2
SHA512 196825fcf5bb5b4c59277520e2c80f1a1462c5a4535f215a9d4c1b9ac51c83d5822fa8062a975dd553e110088ec56ea6767dca5c5c90ef8d3b97bd44b0cea352

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7321b10513a665fff9ba117aceec9631
SHA1 af864e3feccb2661fe601474917729d96bced4d1
SHA256 cecde73548a8a4bb6212179a0ed2ea3b1a51be8492c75978cfa5724a201a89cc
SHA512 7814806b9b2883769d5aac591711a135f7dde7394dd661f99ec4c11aa2d9ceb1b83274fbb091de65eea03257b0e1937a6b182187a2ad0dd238cef54825ce45b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67b09a8edb954eca5fe3581e616d07ef
SHA1 1cbf661517719cb896ab671053bc6402315f7af3
SHA256 69dd234b8e8f766bdb152268149f40905c906cf4780725dd63fceb209def0509
SHA512 e388a69d4e61e1b9fd04f8be875d2470b54adec30f34784fbc34e013e05af522128d5b469b45cbbc5680bff5be23b0e3ed105abcc41fc0e936eaa10a4304494e

memory/1604-1514-0x0000000000600000-0x0000000000700000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ec3fd40b846f5ea25ece4b52a05df908
SHA1 335e93e528ce58c73770ae0bf368e7f495b89e9d
SHA256 939d2321aaaa7d2c6bbbd8f8c9beef227b169a234c7df182b93af2853d1ad802
SHA512 ae457a66a7a76ffe8ca62819fc5998022786c8219d0640d9a584210f136c5df159eed242d2dea007b74498c34c81698d7b8eebe3eab9bf1adff39a24d78fc1c4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9142f06ea9eec5e4573c091d68defc6
SHA1 fc86d6f2bd120189de81f02c7c545ff369c8017e
SHA256 4ab357b552a76a9d90c92241edaeb6d44e8586c1efaef3fc786f819fbaa19bf6
SHA512 3cbcd8a04cac0f9129440919c9feac405e8c66dbed626735a8c6105868de6b8ccb9f2c0d92d41c42c258d9aaa5a549926974937d17fd65be4df983a19972e2dd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 523c12e095e431f227a2d7c9bd9d857b
SHA1 6a2132fd2f8ebfdd6fa93e51bc90a3487ee8843a
SHA256 f2da1d46da8145affd8f8599934cbf012c70bfc61e4a0209b8ef4aab0dedcf6d
SHA512 fc8feab0612327c164d0d84ca65d47e5ae9c0253d23404e0c94a01a0a1353c571e2c992542555eb3a1361811e5ed66a5bfd80c80953124f174cc126e5ff202ee

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 de93d8e46bad45453f72b4bf26c41a13
SHA1 84117ec8e974c256e61c893677377e1b2caaa79e
SHA256 71bd0750c3c469376ad5e9d910f1c056c3ec957fd20ee216f89a37d23cf091e9
SHA512 302214a560014b8d0cfc9d05d323359d29cf140a2b7fbba155f63e884fead7615ab79525cc4cbc26e9c7fe4f3b2a8328a077b253515f27125e8cdc5106c58281

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 42f56fa838bbc70914fe62cd9ba5e3db
SHA1 5a7d0ef12217231ac91b77a6ee3955c618631cea
SHA256 11df8524c4cb16ec76169c224421a71ec6ff6e08d0d5fd22895a78c277b6fd85
SHA512 df516346a4727f40d62a5846bfd9bbc04eb71cf63d8452babe8d2c0c243f45d1624bf5eacf8688fa18273b7de95ea1cf52a0060914a5818ab6100025eb19d5f1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 1247a45aca5a1cd3b4c40977b2d0ad55
SHA1 b6d5b2839343785ce1e53442ccd0c04f77fc41da
SHA256 9b0e6b29b0f517cb16f65f7033e27f2db7297d1630551bab697626c27a5f9ca6
SHA512 3bead1130e6d381bdbc2f18438f78ea9ff12b912a1c5f9f2bdc12250100eee088fa797b213c5b10476ef18aead44fc15c1cfaea9942527535e068b8e221651a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96d8fddb7bb4d0a42f4f7f0eec056407
SHA1 a99dcde1e42f52e7507d0e21d6d44321abe347e9
SHA256 02954265f351a853dd7a130793509edf99d4da9cc0c5ab02076c1099803bbd50
SHA512 90912b38916391c173ab47c2d76aca6c2de91f5aed05a19e153883fb52c35f67b5e3e058eb7aec9d230477b3b2a07db6ce60107323742dc6bbfb8a59abd77770

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7ea6d1abb5ab51d421a228ae15e4a8a5
SHA1 a1a498c3682ebbaa685fd6dad068adfb0f916ae5
SHA256 5f5a481fcd764cb60ad83969c33a15a339ae508ed6c0b4462342607532bf15e6
SHA512 7419bbd5a7008dfd41ba4329a8b5cfe515325fc0522ebacfa5dc80223a2799df35e32bed89ac14f09de2e95325c0acc22bf8f577b8a3f8fa10e34b5e7f9c6d7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ed43225d52d849f2107510471c1b4ee
SHA1 00c64ff3d5b627601e7bf3cbf59999cbdb0919d5
SHA256 3658a7672cdaa3a77e5e56451dd8c7428d63daf8d03450f8bf6e02394db832b1
SHA512 b32ce43a53d6f8fd6641f65628f136dec6b68e422ebb4bbf09af4eda254be1b18e51dc0857bf5baa5bbaa2295e075fe4865216958cc17a589f1c580be0352e7b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 774e66e487442f6523c022743652fd15
SHA1 231e68c4ac5bf9c8331c8cbdb61259cd1faf503f
SHA256 c6a1ce67356dfd49e6271c5abe80f53da0c6c460618573ce45dba97e8a84dd98
SHA512 e22c1a1635d3032824a023334ba945c34d6e19169a35c338f5e216ed7ba282907e0c0e561d56e48664ac81402eb92a9b9e088662a8c6540696a1b3e99265fa6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 777f68aeb8e8ee83f9895c3bf4c0c855
SHA1 cafa444d8243e1dca64636c9ecff20a929b73499
SHA256 37575132c7f866e95736e643547ebfe48419efcd9f96fb2ad1b51efce2105f6f
SHA512 8337c587fee78377a475f64b7b6b6dd49a5a9041a32339ce70347d86275111e07ab0be7712851c76cc7b484dce3dbbc21672ccbb6e2e930fc13fd028ee9358a2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 813f831b2315edf23e6baf5a641c5d21
SHA1 fe6af214833a704d614c78366f0d54c768e501e6
SHA256 601fa00d521d221fa8614d946e5ed33d041b40eec7c317db0a844dd25e4349cf
SHA512 34ec2c597feb2e374a507d2224e642eb0ec70831c5dcfe7e9710a7dc87a62423c7361b45adc528b7d47887da80a119fa2d1425c71b0c720a85e60bd263b4936e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1278d243fef1ba5eef949f800609b32a
SHA1 0294c80009534cd9de245ab88c2624be60c82a01
SHA256 1c2686dabe66eea63d21c398b23791bdf1972106aed6d3e8f0546cf0ab0f39da
SHA512 b866cbc8913d70e5f2905e560ecb3173c0fa99f010d277ca956454be9beba96ea66d610f91be3616569ad983f1126101459ef77fbf8ebb27a6b469b14e9e6188

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 44cbeee0e9092b0f6b53a3ff18ef7c62
SHA1 6afd261b30c54137575b032b3473bdb38913c1e8
SHA256 9be59608f12fec45bbfbec3e9b3442fc08809ed9274cad393e1270cbdfde22dc
SHA512 489cecbee8b117f0c9758d39404fa8edd1efade3f48c59f78e05c988f258c664abf76ae0f8e5d07fa9c149732bae1401f784c8f779122b968004906c81734ecf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3c48b14f014ad8006bc2909f4fd45141
SHA1 d1bd7d9e6da4dae353d7f7f60416d680f5e5a449
SHA256 8754030fc99405966d55b4926788cd31cf3f417559c6c175df8408fae668f24c
SHA512 814a23729ea6ec1fcfa2e066b32e8d42f245c4980b3b593ac2754f75727c89002942d0fb83a8a8061d14fafcce30fb88fdd7041109dcbc7d248f5a5578b68a21

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-11 07:40

Reported

2024-11-11 07:43

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe"

Signatures

Detect Fabookie payload

Description Indicator Process Target
N/A N/A N/A N/A

Fabookie

spyware stealer fabookie

Fabookie family

fabookie

PrivateLoader

loader privateloader

Privateloader family

privateloader

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Socelars

stealer socelars

Socelars family

socelars

Socelars payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Detected Nirsoft tools

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NirSoft WebBrowserPassView

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zaikais = "C:\\Windows\\Microsoft.NET\\Framework\\mirzas\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfhgpjbcoignfibliobpclhpfnadhofn\10.59.13_0\manifest.json C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A iplogger.org N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Looks up geolocation information via web service

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3864 set thread context of 4444 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Folder.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\File.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Process.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\11111.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757844662400187" C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11111.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Proxypub.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\askinstall492.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\File.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4128 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 4128 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 4128 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Proxypub.exe
PID 4128 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4128 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 4960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4128 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 4128 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 4128 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Process.exe
PID 4128 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4128 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 100 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 100 wrote to memory of 1072 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4128 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 4128 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 4128 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 4128 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 4128 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 4128 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe
PID 4128 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 4128 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 4128 wrote to memory of 3124 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\askinstall492.exe
PID 2184 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Windows\system32\svchost.exe
PID 2184 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Windows\system32\svchost.exe
PID 2184 wrote to memory of 3864 N/A C:\Users\Admin\AppData\Local\Temp\Process.exe C:\Windows\system32\svchost.exe
PID 4128 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 4128 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 4128 wrote to memory of 3764 N/A C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe C:\Users\Admin\AppData\Local\Temp\File.exe
PID 1608 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 1608 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 1608 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\Folder.exe C:\Users\Admin\AppData\Local\Temp\Folder.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3008 wrote to memory of 2996 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe

"C:\Users\Admin\AppData\Local\Temp\5c6629c6f9b373d11f3777588c5cd425d7e5ec0990140924047a999a95f218e7.exe"

C:\Users\Admin\AppData\Local\Temp\Proxypub.exe

"C:\Users\Admin\AppData\Local\Temp\Proxypub.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Btnm7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdfe2f46f8,0x7ffdfe2f4708,0x7ffdfe2f4718

C:\Users\Admin\AppData\Local\Temp\Process.exe

"C:\Users\Admin\AppData\Local\Temp\Process.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Ajhp7

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe2f46f8,0x7ffdfe2f4708,0x7ffdfe2f4718

C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

"C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe"

C:\Users\Admin\AppData\Local\Temp\askinstall492.exe

"C:\Users\Admin\AppData\Local\Temp\askinstall492.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe"

C:\Users\Admin\AppData\Local\Temp\File.exe

"C:\Users\Admin\AppData\Local\Temp\File.exe"

C:\Users\Admin\AppData\Local\Temp\Folder.exe

"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -u

C:\Users\Admin\AppData\Local\Temp\Files.exe

"C:\Users\Admin\AppData\Local\Temp\Files.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1540,9807161710880054681,2421527097742472124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 /prefetch:3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4912 -ip 4912

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4012 /prefetch:1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 1484

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe" -Force

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\mirzas\svchost.exe" -Force

C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"

C:\Users\Admin\AppData\Local\Temp\11111.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Ajhp7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffdfe2f46f8,0x7ffdfe2f4708,0x7ffdfe2f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe

C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6408 /prefetch:8

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdebb6cc40,0x7ffdebb6cc4c,0x7ffdebb6cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1980,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1972 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2080 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2324,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2596 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3228 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4568,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4600 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4832,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4508 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4536,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4940,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4928 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4776,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4864 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5308,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5316 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5312,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5368 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5508,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5516 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4908,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4904 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,8714181253719322008,10863603093861555344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5012 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5180,i,16591435824839576936,8791024900983705745,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5360 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.listincode.com udp
US 52.203.72.196:443 www.listincode.com tcp
US 8.8.8.8:53 datingmart.me udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 iplogger.org udp
US 104.26.3.46:443 iplogger.org tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 46.3.26.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
FR 212.193.30.45:80 tcp
US 54.205.158.59:443 www.listincode.com tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 iplogger.org udp
US 172.67.74.161:443 iplogger.org tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 161.74.67.172.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 www.hhiuew33.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.180.4:443 www.google.com udp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 apis.google.com udp
GB 142.250.187.234:443 ogads-pa.googleapis.com tcp
GB 216.58.201.110:443 apis.google.com tcp
GB 142.250.187.234:443 ogads-pa.googleapis.com udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 play.google.com udp
GB 142.250.200.14:443 play.google.com tcp
GB 142.250.200.14:443 play.google.com udp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.178.14:443 clients2.google.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
GB 216.58.213.1:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 1.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 45.144.225.57:80 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 gp.gamebuy768.com udp
NL 45.9.20.253:11452 tcp
SG 51.79.188.112:7110 tcp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
GB 216.58.213.3:443 beacons.gcp.gvt2.com tcp
US 8.8.8.8:53 3.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 gp.gamebuy768.com udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Proxypub.exe

MD5 a6ff722fe5cb9ea9444a79e38343241f
SHA1 c297a99afd248fa076654e42ae84b7ca9e1ca59a
SHA256 791999c706f021b4d8eadd56a130dec270b4b366a96b6164abf7a72125d27209
SHA512 8fa87affee6086fa6888a2159dd0a14f122a79c5bb7fb04471dc91c50338feac085e6506e7948270e4c6a1e2610efedc3d56b647ddc7109e9adffb869c335b7a

C:\Users\Admin\AppData\Local\Temp\Process.exe

MD5 532603329a655dc6812c790fdaccf378
SHA1 464b251e62f67f346b262df8eaae7d0bbf0f4b52
SHA256 ab681e11dd1ba868c78016fe08c507b130304a1a1ac4d84a9fa0f00a15a00dca
SHA512 5067268797fa6752bafd9069447d3fa0cb6116ce594d4419f9d8e0891706cac684ad6af425569ec83f404d461b07661f74502918d92e3735d79c427e353000ca

memory/4160-33-0x00000000001C0000-0x00000000001F9000-memory.dmp

memory/4160-32-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/4160-34-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

memory/4160-45-0x0000000000400000-0x00000000004F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ltt.url

MD5 44264182fbb802b9671f6abb7faa6a53
SHA1 ccc380eaca3c618f54fdb3d907f50a5f039469da
SHA256 62aad2b0d832421b890138182a25ed331fa39765d0700b84fd6c1c580ea3f0fc
SHA512 43d24f86dd04c479e534fad83efefa2f70bb298ab9e9ea2f737a9adcb79bc330f235d3ff6ae8d413a973968e4951a93a07718a908510f4a0a48017c2b03b824f

memory/4160-50-0x0000000002710000-0x0000000002744000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Folder.exe

MD5 4538da85464e576893aec470fc71229a
SHA1 c47826fd48cc1ea12a1ef57818f820ef1da084b5
SHA256 8aff0e13328a2129ca13284d80bed1f72100a78a2c4fa696b2aa95a6152f2983
SHA512 9f62882a237a3619253aa9283303c91d0cb0f18117dc5b86b4a58cfdd7eabc4a389d4c43f93e84315d97fae49345013fbb43eccce29bc381d780a37a9d98f431

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Processes.exe

MD5 9a20c492f91287895ae49de71f479376
SHA1 376afa85c761170a89cdfa2241498ddc8f9bea1a
SHA256 9504d1a7c7ed4d2ea4b88b1ffc80f19c0efddc4c5964e6f906e70e6089764cdf
SHA512 d502900170e65f22c8e031c8186998428f6a95213c19425d7bb2d0f96a0484522b596e811d0aae791ae1b7e739e85a3687cde83a3c61adba55f3e83f09a6bd4d

memory/4160-78-0x00000000051B0000-0x00000000051E2000-memory.dmp

memory/4160-77-0x0000000004C00000-0x00000000051A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RobCleanerInstlSo22812.exe

MD5 2f02d5af8f2ad1917f8fc5fe17127da1
SHA1 1bb680702a52dc9046984b87f1e3387530009222
SHA256 bccb32358a54efc1e9f62859c3c6aeb1da93b4e4159a76972f38f8737b0dd69d
SHA512 8aa125a1db54314047066058d051259f56efbf3a20998f12fdafc20418ff12e249d5c1aab4b01e8cc859e3166377d05c217dbd47ae0817c5836333b1b82def67

C:\Users\Admin\AppData\Local\Temp\askinstall492.exe

MD5 5a9ed91a1c2467ae921d52f6df3cd4c6
SHA1 0c0c7cbae68b09c2da22c68dbbf3bf2f27f60545
SHA256 b4a5844e6ed96e04782b9f64f5393509119f2c984d20b74edbcf8b03269f1479
SHA512 f07980049deacffded94a697878649394a95e321e527c88baa608ffd05830ad35c86d5d3ac976a813c0fa2c75304633ec2738b765cda5c128348709ca4260956

memory/4160-138-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-129-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-107-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-99-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-150-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-164-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-152-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/3864-586-0x0000000005010000-0x00000000050AC000-memory.dmp

memory/4160-1078-0x0000000005280000-0x000000000538A000-memory.dmp

memory/4160-1077-0x0000000005260000-0x0000000005272000-memory.dmp

memory/4160-1079-0x00000000053B0000-0x00000000053EC000-memory.dmp

memory/4160-1080-0x0000000005420000-0x000000000546C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

C:\Users\Admin\AppData\Local\Temp\Files.exe

MD5 57d626d8e6951c2b6d1a883a73b998bb
SHA1 59ccbfce02af3628ef9e34f6d41c1ef9e34e0808
SHA256 c93e60e1b3a6ceb63ce7cbf2e7757763f3fe79fb094e5725759f9b8ecafef1ca
SHA512 2745485dc7fd2da9ac1b81eb4058b32e2fc5c3f990bfab6321a3ef876a14d8a70d66bbe8c392bf18579a80eea3c9272e8cdde63f40ad44a050d5a0db66e71663

\??\pipe\LOCAL\crashpad_3008_XSIPOFMRGUPURTVV

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\File.exe

MD5 90c7efe55fff3704de712084227e84a6
SHA1 b60983bec0346c6fdc0569f641e9091b7f201a5b
SHA256 6bb5f93524d19c19ad102c9577107b7761e1ce94ea2229594fab55fdb98a7e34
SHA512 64556f35c8a13cbe7ff7087bc88e19faaac64091bd1f2ad6251651ab0caabc70c2e388420528893193811a387039e1bfb906c4d2e5f2f8e5deb3d8931b78e65f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c00074a0c68d8831853110c340023b1d
SHA1 1829a00d313075fa0afb5450c083718989d045a7
SHA256 a5842496ce54532f26849ca3873631628f7a8909fe4f63144fec928424a96e59
SHA512 98ba0fc7c84b70bbc5d636c4235051f1737533966a0df9e33c013bcabae509165dc2be366e9b8d4cc5a016914cb7da056f8bc1643129dceb496804af5f3a86ab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5f87527107519f20e7a68b5d17a8ac31
SHA1 d131af905e859c83902e00ef1de97f79f4c94c4e
SHA256 6e42d8499981e1aee686fb712d8e6e2a089c9db671010f7d62fe131b2150ce57
SHA512 f13cff8fe56e748e0c19e511cc19a02333d87c75a93e08ccd48f4341f5a153513d054544682bc2547a82fc7d399304aed3236198961affeba7c52d752b3d28f2

memory/4160-1075-0x0000000005840000-0x0000000005E58000-memory.dmp

memory/3864-1073-0x0000000005120000-0x0000000005184000-memory.dmp

memory/3864-1072-0x0000000004F90000-0x0000000004F98000-memory.dmp

memory/3864-526-0x0000000000750000-0x00000000007CC000-memory.dmp

memory/4912-522-0x0000000005070000-0x0000000005076000-memory.dmp

memory/4912-585-0x0000000007650000-0x00000000076E2000-memory.dmp

memory/4912-154-0x00000000008E0000-0x00000000008FA000-memory.dmp

memory/4160-149-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-146-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-144-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-142-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-140-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-135-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-133-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-131-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-127-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-125-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-123-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-121-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-119-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-117-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-115-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-113-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-111-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-109-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-105-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-103-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-101-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-97-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-95-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/4160-93-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/5856-1113-0x0000000002330000-0x0000000002366000-memory.dmp

memory/4160-91-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/5856-1114-0x0000000004E10000-0x0000000005438000-memory.dmp

memory/4160-90-0x00000000051B0000-0x00000000051DD000-memory.dmp

memory/3864-1128-0x0000000005210000-0x000000000521A000-memory.dmp

memory/5856-1125-0x0000000004D90000-0x0000000004DB2000-memory.dmp

memory/3864-1129-0x0000000005300000-0x0000000005320000-memory.dmp

memory/3864-1131-0x0000000005340000-0x0000000005348000-memory.dmp

memory/5856-1132-0x0000000005690000-0x00000000059E4000-memory.dmp

memory/3864-1133-0x0000000005380000-0x0000000005392000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_onfyrznm.dc5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5856-1127-0x0000000005620000-0x0000000005686000-memory.dmp

memory/5856-1126-0x00000000055B0000-0x0000000005616000-memory.dmp

memory/3864-1130-0x0000000005320000-0x0000000005328000-memory.dmp

memory/3864-1143-0x0000000005470000-0x00000000057D5000-memory.dmp

memory/3864-1144-0x00000000053C0000-0x00000000053CC000-memory.dmp

memory/3864-1157-0x00000000053F0000-0x0000000005400000-memory.dmp

memory/3864-1156-0x0000000006480000-0x000000000668F000-memory.dmp

memory/3864-1158-0x00000000069B0000-0x0000000006EDC000-memory.dmp

memory/4444-1160-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11111.exe

MD5 cc0d6b6813f92dbf5be3ecacf44d662a
SHA1 b968c57a14ddada4128356f6e39fb66c6d864d3f
SHA256 0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498
SHA512 4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

memory/5856-1171-0x0000000005B50000-0x0000000005B6E000-memory.dmp

memory/4160-1187-0x00000000001C0000-0x00000000001F9000-memory.dmp

memory/4160-1186-0x00000000006B0000-0x00000000007B0000-memory.dmp

memory/5856-1189-0x0000000072400000-0x000000007244C000-memory.dmp

memory/5856-1188-0x0000000006DE0000-0x0000000006E12000-memory.dmp

memory/5856-1200-0x0000000006E20000-0x0000000006EC3000-memory.dmp

memory/5856-1199-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

memory/5856-1201-0x00000000075B0000-0x0000000007C2A000-memory.dmp

memory/5856-1202-0x0000000006F70000-0x0000000006F8A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

MD5 b7161c0845a64ff6d7345b67ff97f3b0
SHA1 d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256 fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA512 98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

memory/3276-1205-0x0000000072400000-0x000000007244C000-memory.dmp

memory/5856-1215-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

memory/5300-1216-0x0000000072400000-0x000000007244C000-memory.dmp

memory/5856-1226-0x00000000071F0000-0x0000000007286000-memory.dmp

memory/5856-1227-0x0000000007170000-0x0000000007181000-memory.dmp

memory/3088-1228-0x0000000072400000-0x000000007244C000-memory.dmp

memory/4160-1239-0x0000000000400000-0x000000000043C000-memory.dmp

memory/5856-1241-0x00000000071A0000-0x00000000071AE000-memory.dmp

memory/5856-1243-0x00000000071B0000-0x00000000071C4000-memory.dmp

memory/5856-1244-0x00000000072B0000-0x00000000072CA000-memory.dmp

memory/5856-1245-0x0000000007290000-0x0000000007298000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11111.exe

MD5 7165e9d7456520d1f1644aa26da7c423
SHA1 177f9116229a021e24f80c4059999c4c52f9e830
SHA256 40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
SHA512 fe80996a7f5c64815c19db1fa582581aa1934ea8d1050e686b4f65bcdd000df1decdf711e0e4b1de8a2aa4fcb1ac95cebb0316017c42e80d8386bd3400fcaecb

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3941467966588d1d11f0c8d0b565667c
SHA1 f324f457bb0e2c576010b710b921bcf6850bfa35
SHA256 0616de8d7b8268900773a4aea06fbcd45099d876d8e695bd443501e1f1988245
SHA512 7be9ec2e5913ffb141f9845ad2de745e00ed09ef1c47e8250f09247800a508f786be1d2bb480f13e4a890d580626a304964c03b3e1e2d5aba0d7d608d5c8bf84

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 fde1af744dadebb441d56b0f51fcbf28
SHA1 e5f82dc78a22a0782f1906a9ec2cc276e316da04
SHA256 355216fa84922a33d93629320007a1bb0a434036d02da94d802390f059adabf2
SHA512 2e94f5673233d0af5e18d3a17d123cffb250965279e07b76b6596613c231f0992e680a0bc1880e3307fac48c43a66e42f26f1b848eb2a59e73bcc52560cab81e

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2788eb9709e6e620b5f0c849736aca7d
SHA1 5c0ce0bbeca911a8a9c075d319159a12508e7534
SHA256 f3b1c0bb2091252079b461bfda8957a8af35d8c1dae062344ff348d801954971
SHA512 4251fbabbb24930a80a69f887e5d3f9c4808a51e63364cadc46a0a1384c5010fd5fe189aa51746e308a24e3cfe405b7fb2eb6218b5081e5cc2229d200671ecee

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt

MD5 7f0841790db9c7f1f082c81e976eb103
SHA1 18183bde138f7ceac2f15d9334a53be2c2db3016
SHA256 b32b0673cf09b8f215db036bfb0a6b878937779f5ca525e54f12cd04b27a651a
SHA512 35c6870ebbde32c7dced4100cdebf59cfd6dcf75acca39147971ae4703fb68c4071a2173446c8b67acd3d4d1b0c91dbdf6df157cd7d3ed75922821eeedf163c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c222e27432d15e1cc4f8fca78da67e4d
SHA1 b8740e7355c672ebc6f69ae20b3cb79d0f2733f1
SHA256 5e7928a4b2d7a587161e622b2713c1013f27e437bdc94b6c15eae6705af2ba2e
SHA512 9010fd7174e5f1762b6db81d1f0ea005d018c00a4e6d82c73eda453724d207eaffe6bce4189ed99f59b9c85c9fe21b50ee1bf7cbbd032db86b334a6905111340

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5ce982f705f5289884e32cd15c3db130
SHA1 dc0ad63ca16ffb512b254fa2a067a7de1706fa4c
SHA256 4f1fef38762e1ae3bf8c81ebebc6e883319a752e41f5d18fe317701dc2d5a5a8
SHA512 a512d943cad901b2efada005510f7b93ea024620a509429015f053f4945b3b314288dee7c0327b9977bd1a5cc64c0e52708be887d2347228fd021e4337b8cad3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 09ed7abe7f53f088a521e8d81f6c3dc6
SHA1 d8b0fceab80957b44e24fb0f11dec0dbf8a944db
SHA256 0452f6ded757cc1b7cba91b9ef98912d44c33d8b3613c6901f997b4bdbf47b6d
SHA512 1c9ebefcc5512d1737c736a68c24cb9888018c65e297121fe175ccdc117999545742170ce04ddfa6812136636eb8c5c7b53b329a7719f6c406617c67770d3c7d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\bfc1faa8-3845-4fc4-8944-32a9cf0e4497.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Temp\a4dba3cd-6e15-4a0b-b796-5d6fa99f8267.tmp

MD5 da75bb05d10acc967eecaac040d3d733
SHA1 95c08e067df713af8992db113f7e9aec84f17181
SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
SHA512 56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

C:\Users\Admin\AppData\Local\Temp\scoped_dir5228_7760405\CRX_INSTALL\_locales\en_CA\messages.json

MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 f4731797b758847d6c02867914385a5e
SHA1 24dd54691d68a1e0ec1288b059673b95af7ac2ac
SHA256 c84bb4f665b0b810426a17164c7bf297a997ccbb08aae438874d7eb080e72c4b
SHA512 7271779019ce9c4d1a33cc985d9b1209a0521dd9f442284e125679f9396b7204b1a0456b0d8b798f86fd836ace57def069359ec1449c5d2e4645ee6aa83443d2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 1a2d2acf9a17dd02e2ff7e30632d242e
SHA1 a967edc1904843484a32fb1df352a16f83b9217c
SHA256 19f0f7eea35e6e00393c8369786fb9cc2d63a2f58d45a1a9560eb50d87c44f1e
SHA512 25b38c6fe7a30b11cb3721b057c834bde6da4418171ce947016d26df4c88aa4db5a15f2c410a31ba00564d1c7d754fc580c3219fd3b91b322515bbe9118cae58

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 ee1165bebb5ab4cf6dee2da74ca8973a
SHA1 65bfcbb68beba27ddb9a0a7d1170293362671f6f
SHA256 de731feb18271d6e483f1896bf29f7b87419d75b7a23b3545f948a455cbb45e4
SHA512 fa1f3b67147d5e9c0b9a648fe00138c56673f7b225ecc3a7ee4e7e929f75f8afbbd7de966303cb588e8a9a4f1eea5a2da89f83ded59cd47936cfba3ff6bdbc15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 271f14223c642c3dd810fcb3e100ae61
SHA1 4f2bdd912b3949f2e9565a0732617385ce6553f5
SHA256 29b8665e8b03057ff8e14c1d2a0ccab4cd35919dcb249ce4b6409d386b423952
SHA512 c653dd2a844ec1ed3c3f55b5610aecf3bbd8258b0c813dff3b70bd5cef68c87e9e4ab5a9c065124a0156c4a6c59cf12bd1a762b87198ae1f9f350ced0949d500

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 672b2c5b9e8d7179c808921742ca40d8
SHA1 ed8093138a7d9e71d2076ac6a67e267620cabe4b
SHA256 39cb7b0c4c6734685b6a57457d1205ded17a8e3b139292514a169c81b230b4ec
SHA512 8df4c51589dc8d99c8642748aab53b87d0d14498da12d645077d1795d49a3f1430b0733c52f2c839e37991f5e7da7bbcaf43e684239814cd73b20e6956c5ad4a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 8f0dc2abf44818b8116de53f2976fa37
SHA1 3729bc5867e462853e837aac634c24b50d3adf31
SHA256 0689c1ad6500fab071ef02f98cf744005da85d88033f3298d75782b9911539f9
SHA512 67064621372ce62e52861ba1308289b6329259214911f53eed57289f5f2b847ff801607d8fd89820643e7e5b848b14f24bc3fab9747437bb8ff39031d881bf84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 ff87517a0d587410c368f5cd5e8fc62a
SHA1 3fbad0a6e8ce6f9e4384f58937dcbbbf3cacf9a5
SHA256 333516581496e1fdd23512d579bb91f79f161b21be7bb87ed25778a716e576d2
SHA512 2113ccaff21a2eb307b57f74d83d05c475267041817cf255e6f0d8a823fdb65ef78ee083cb1bdd2978d71e5c399c0ac8fb21bcc7e3d63ae772615b214d171670

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 55bd8fc1ad11b5610101a41c71445caa
SHA1 548040c2f9fec2b6be7972638b1a4dfb813e1166
SHA256 05e49bcdd371263d85a13dab650f753732794156937248a1539a8b37435dbe50
SHA512 20c990136181e610e0dc66977330d47d8699e4ea35e35197c71e7c5f04f7b2303ce8592dec55cbc86053602d0b47b921cd0dbcbabcb54c3028ecb2c759cc931a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2e5558bb8b338ea0295720d9cbcba584
SHA1 93339cb33ea19c6190ec81707e269eca1656c3c0
SHA256 95e6cbe17e2b3f49a0c27dd6f42116e0556ef315a3763ff5dcbc995f539bc577
SHA512 817e99705e5014a849ea719a5aed87c54f356ed013f1f13c61117df6b830f14c0054e86ba1fb947b36f33927853edde02039e63855f5b2b2a4d7c0371ef55cc3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f89e0a4c583296b59da3a1592b99f68c
SHA1 6f07760c30cb24c624d8a7ce3ac1948da2eca084
SHA256 5d09d7d3321f27d42a2c0bed875ce3edbc48b63fa48a819b59e8a104ea692d72
SHA512 1aa6d92cecc9678c8c73cba82b658c6bf3d0451535131cce6ded9671841b3fb787b6ae87ba514fff6cb11d8e4712cc52c6cfe82fb81c576973650c039ac83e00

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 cfdcc53b24fed62bbe05d519db53cb9d
SHA1 77b7549e8bed06ab51dea45bbe652c9566641a7d
SHA256 79efbe40fae2ab229e33420d82ae3f2b27c5f3b4ba226b1d10a1a3513265e8d0
SHA512 041a860c94916454d55fbd1e561cc3c42b08459d2fce85a2a78ad34ca3fcd6b3d24fc5d589eaf785cd24dddc8498da6f1e735a5e37bfe812f0e2f0672419833c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 4bc8a3540a546cfe044e0ed1a0a22a95
SHA1 5387f78f1816dee5393bfca1fffe49cede5f59c1
SHA256 f90fcadf34fbec9cabd9bcfdea0a63a1938aef5ea4c1f7b313e77f5d3f5bbdca
SHA512 e75437d833a3073132beed8280d30e4bb99b32e94d8671528aec53f39231c30476afb9067791e4eb9f1258611c167bfe98b09986d1877ca3ed96ea37b8bceecf

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 b6ed5278135ca13f4d704b9e0550910f
SHA1 dde44d2d0428e87c59f14ecd0967c287c24adbed
SHA256 c89ba068d574a8629aaa0cae508cf9819534cf1df12aa2e8be4ad7d7231b430e
SHA512 fdca8974c1395bf90c78e3739e75cbf5e6dfb70bdcb9ab8f97c53bb6abc85687be5ffeaa5dfe4a849e5e4d3c376e31db9f8c2ea730279fde720c09c8415fdcfc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 feb862ab68aff5b30a0d085a4a94c1e8
SHA1 dd3e62019503b6502ca301ed864e79e0113dbbc1
SHA256 72335ccfda2ed02d25a2d9ad08874f3f907953f69fa4f012854cc72b4c0ceeb7
SHA512 a6675d1065828a0e1af38764bcf74472cc21293aae51a7e893d3952321c2b9a1d11c87f645944449b7c9a5a4bbb69537cc5d4e988a39a0304d868219b124eb6f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1daec76bd7cdf0144a79aeb8dc345ea2
SHA1 5b218996863b1f99ca22c2af4126959ab359188d
SHA256 eb74ebd985c484349fc980cbef8c8980ea28795506f08455f17d6f3146146c85
SHA512 876241c6eb12a0b4323d706f9529e3e5f3648909125eed7dc3182b5f07ca0620018a4adf41fc7967ac6baa5449675b4987d1989d0964ec96e9d26af0263b1591

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 01bae26cdcc08731d3e49089ed7d65e8
SHA1 99efeaa48178a50f0c8c8f9004d5a46372675b40
SHA256 0ef8c60370a70921497b43a70ae37ddd5c01e9a12256d9a7a2dc94c6b139c59f
SHA512 946b2c407bf41554402760df74ba76f969ff5a88a3abada0b59add29bc0ba9f1c028c66599cfc4df2592c653f19664b31a3a5574c36ab7fcc344546cb97e2984

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 3a77e58bf8cd4d5ebd215279929568a0
SHA1 57c4d949f0130b4a688eb4f158dced8e7915173a
SHA256 74272cacdb9c235c5530a7162d4634d6336fa148ab592576b35bd73d25c2ee3f
SHA512 f49cc4833426b6d2f5b335526de63f7ce9c333be9cc9641440fd88a419f0ab379ee87df3983cc9de37083638e3dd239b3d6776794bb951d826ea89270dfc7cf1