Malware Analysis Report

2025-01-22 23:11

Sample ID 241205-n9axratmes
Target 53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe
SHA256 53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315
Tags
banload floxif backdoor discovery downloader dropper evasion persistence privilege_escalation trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315

Threat Level: Known bad

The file 53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe was found to be: Known bad.

Malicious Activity Summary

banload floxif backdoor discovery downloader dropper evasion persistence privilege_escalation trojan upx

Floxif, Floodfix

Floxif family

Banload family

Banload

Detects Floxif payload

Drops file in Drivers directory

ACProtect 1.3x - 1.4x DLL software

Checks BIOS information in registry

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Checks whether UAC is enabled

Checks installed software on the system

Enumerates connected drives

UPX packed file

Drops file in Program Files directory

Drops file in Windows directory

Browser Information Discovery

Unsigned PE

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

NSIS installer

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Runs .reg file with regedit

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-05 12:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-05 12:05

Reported

2024-12-05 12:07

Platform

win7-20240708-en

Max time kernel

50s

Max time network

73s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Floxif family

floxif

Floxif, Floodfix

backdoor trojan floxif

Detects Floxif payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\Drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

Checks installed software on the system

discovery

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created \??\c:\program files\common files\system\symsrv.dll.000 C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\IEShims.dll C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\IEShims.dll.tmp C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File created C:\Program Files\Common Files\System\symsrv.dll C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File created C:\Program Files (x86)\Internet Explorer\ieproxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File created C:\Program Files (x86)\Internet Explorer\IEShims.dll.tmp C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File created C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL.tmp C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL.dat C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieproxy.dll C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieproxy.dll.tmp C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
File created C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key opened \REGISTRY\MACHINE\software\Wow6432Node\Microsoft\NetSh C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key opened \REGISTRY\MACHINE\software\Microsoft\NetSh C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regedit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074aac391e4b33d4e83cddfa34399566a000000000200000000001066000000010000200000004055a11607f5dae01e8de437b02f09f762949c0e057a5b995dfcaffd9f4133cc000000000e80000000020000200000002e11388804fa04ab9ac82295637f3a932278ffae906b48b8d8586aa149665b7f200000006206aa33ba90903e05f4d7702bae8659f8dc9aff5395180b874e1128e6c6a3b840000000216dcf9ceeb82d709f5a37541a6e551bad5d99e44563d86a3de79a2ba46f583d012f94d207329ea1fa2bc161ee3847abeda37e959905a3d7d3b900f5b6c41412 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30e33b0b0e47db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000074aac391e4b33d4e83cddfa34399566a00000000020000000000106600000001000020000000760dbf51faf8092f326bbdb6625dbd8b9468831e252c1299d292ced2d2b6b881000000000e80000000020000200000000f9be98383ac18a10e5afd0277ed9379f229e9d8f4fa2735586f5cac923131fe90000000a36f75ef6abd22ea9964af0eb89d4d68429f1d932cde680c4d806a1dbe9226f9f100b12ac3b6aae4c685e5cc89656a772a0fb04ac03799fe4a513a05c05d393b630586cbf4a6dd6a60a3494f91681c8c2a53121655277fcdbb7259f5e6e5765639b327503fad2b7ac223aa54ce3def43f8d7407e16f35090559bf503fb57670832829a442305ba5ff1b5efdaaa5b5880400000000200a72cc0bc94822fe50a63c2a70f416a8bd4c063ae3ca2cda6da86d52ec199ed5eccc907c2fd09726a253eeee52928339b3e564db1cc74d6a89bcf0ce8d769 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33C8C6B1-B301-11EF-80BD-DAEE53C76889} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4B9FB8EA-6414-C02A-1FA0-E5A0E3ECE118} C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4B9FB8EA-6414-C02A-1FA0-E5A0E3ECE118}\ = "Outlook TableView" C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe
PID 3028 wrote to memory of 1072 N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe
PID 1072 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Windows\SysWOW64\regedit.exe
PID 1072 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Windows\SysWOW64\regedit.exe
PID 1072 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Windows\SysWOW64\regedit.exe
PID 1072 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Windows\SysWOW64\regedit.exe
PID 1656 wrote to memory of 780 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1656 wrote to memory of 780 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1656 wrote to memory of 780 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1656 wrote to memory of 780 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 1072 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe
PID 1072 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe
PID 1072 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe
PID 1072 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe

"C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe"

C:\Windows\SysWOW64\regedit.exe

C:\Windows\system32\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DllFixer.reg"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 avxhome.se udp
BG 79.124.60.187:80 avxhome.se tcp
BG 79.124.60.187:80 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
US 8.8.8.8:53 5isohu.com udp
US 8.8.8.8:53 r10.o.lencr.org udp
GB 2.18.190.80:80 r10.o.lencr.org tcp
BG 79.124.60.187:443 avxhome.se tcp
US 8.8.8.8:53 pixhost.icu udp
BG 79.124.60.187:443 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
US 8.8.8.8:53 ajax.googleapis.com udp
US 104.21.66.116:443 pixhost.icu tcp
US 104.21.66.116:443 pixhost.icu tcp
US 104.21.66.116:443 pixhost.icu tcp
US 104.21.66.116:443 pixhost.icu tcp
US 104.21.66.116:443 pixhost.icu tcp
US 104.21.66.116:443 pixhost.icu tcp
GB 142.250.179.234:443 ajax.googleapis.com tcp
GB 142.250.179.234:443 ajax.googleapis.com tcp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 104.18.10.207:443 maxcdn.bootstrapcdn.com tcp
US 104.18.10.207:443 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
GB 142.250.178.3:80 c.pki.goog tcp
US 104.21.66.116:443 pixhost.icu tcp
US 104.21.66.116:443 pixhost.icu tcp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
GB 142.250.178.3:80 o.pki.goog tcp
US 8.8.8.8:53 www.aieov.com udp
US 45.33.23.183:80 www.aieov.com tcp
US 45.33.23.183:80 www.aieov.com tcp
US 45.33.23.183:80 www.aieov.com tcp
US 45.33.23.183:80 www.aieov.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.19.117.22:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 23.192.22.93:80 www.microsoft.com tcp
US 45.33.23.183:80 www.aieov.com tcp
US 45.33.23.183:80 www.aieov.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/3028-3-0x0000000010000000-0x0000000010030000-memory.dmp

\Program Files\Common Files\System\symsrv.dll

MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\DefaultData\Roaming\dll-files.com\Fixer\Version 1.0\TempHLList.rcp

MD5 7319468847d7b1aee40dbf5dd963c999
SHA1 7722745105e9e02e8f1aaf17f7b3aac5c56cd805
SHA256 b0f66adc83641586656866813fd9dd0b8ebb63796075661ba45d1aa8089e1d44
SHA512 c11d53b386f5ee0c042c9246d4a38b1e032a3bc9ea3f6827a9482d4f31b6e4a1973c97190bdc59d961d5b6f1d5b06c25c4b9e94ca04eaef395a928fa851493d6

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe

MD5 f363d40faaa31fa4af15262ff5e60bdd
SHA1 46c826bd456a536d946a21db6d7351ff5afc1d9f
SHA256 cbc4fb6f6576908c152b3687a1e2ff7793e837dff89cf561124ffabde7814a14
SHA512 601d6cae4ae347cafe2850873d09350e2a48935956cebd776bd1b74ad1dc0b55b41dcdcb04273b0eb6ccb6337dd2c46e88bf71b1efc278afab9db15aa2da1daf

\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe.tmp

MD5 7372bd067515fe3d8af6a71eb68ce4b4
SHA1 11ef39e13e1fcb054e22cd7511d83a40f0d2d38a
SHA256 f5bc41c57a7f7b8919870c8802c49c0bcd3b88bbd55680aa9584d156449cf387
SHA512 46db90e3d0392ce8915171ca036d0e070f24c51dc35b5e7562c8a6e2240ad8718cbffcf89d038ddd12af874e7e62c3b0363f39328cdc8fdf4373fb23c0259eab

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\isxdl.dll

MD5 8192b56014894e7869374fd3b042e386
SHA1 8ce1b841723726b2d7f7d0435b4b9b758636f3b4
SHA256 a0ad24d6c6a606200fd2c295c74e551a84cf7282909b6db463fbc022a5202dbc
SHA512 d5e5369d7f0c6c454eb0360ac5025470f56b5f9688ae474cda8df2ff52aa10646cba0413e33023c2194d4d351b140ee8a0ae120acf24a203901ded3c301834ee

\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\isxdl.dll.tmp

MD5 1d48c6d413eee79d4b2ede244461a84b
SHA1 7b54e04e684ac0f0e422353e5c34e01ff27f291b
SHA256 a9b51f258016162989938818218a2657b71c3f3734a707ea5c2aabd5c5fa3e7e
SHA512 0e4231150c20c413d423e0898e0cb928f2f39c3d4594ce2ddd50c8d60b17835803a32817da6b1f9ba3e4e8c8e5b7c2756a9f3a26e33012eed044257bcc86e486

memory/1072-144-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.ini

MD5 9c999a4d95dcf6e82bebae5882dfa95b
SHA1 c3a529ab0dfc68b2f1d4fa82867cf28b1ef3fc09
SHA256 1289c76030eb9e04cb2b2363ae66cefd1b2af957ce1bf7d04d835408690a8e93
SHA512 fed8f935e6930149d1e22dfa9abc32e3723a59218c7a0c399b03256338bcc82360a840a218855cb66a7c34aa4f35d147eacb86595e31980c6f1bbf163b0c6342

\Users\Admin\AppData\Local\Temp\nst9243.tmp\FindProcDLL.dll

MD5 75e7351a0f836b8659e6f315683c29f7
SHA1 66b733d1c978d68cadc245e7efbfcae32807429d
SHA256 7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
SHA512 f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4

memory/1072-152-0x0000000002D60000-0x0000000002DB9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DllFixerPortable.ini

MD5 2694db1d7a4da30651a8c33063861ac2
SHA1 bb6620e930028c6368e5b320ea0040e6a4c454df
SHA256 438aeb00e5e9c87d01f36aad7827a8998e15996e541282b7c1ffc3e4a10e5769
SHA512 e74b848aeade5774481c23693ac044c48d7ceec33506b5bedada8cb792125617e89bc394008b77802ab6fc8a2717ad71d94819601e7b2f0739fa8b8b1a89730e

\Users\Admin\AppData\Local\Temp\nst9243.tmp\Registry.dll

MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

\Users\Admin\AppData\Local\Temp\nst9243.tmp\System.dll

MD5 883eff06ac96966270731e4e22817e11
SHA1 523c87c98236cbc04430e87ec19b977595092ac8
SHA256 44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA512 60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DllFixer.reg

MD5 7509b7c4d13f7dce4cfdd389142cfb9f
SHA1 72d78c2d470a2101b74d07d9418d7b6c15db3149
SHA256 e9530d9998bbc8a08936751c09c56bc10c8eb35b54305261b5a310139fdb983d
SHA512 bdfd1d084dc70673f30d0424ffc298c2fae33f4e0de5fb1f372d7d60ba2f81f43434abc391645ba22649be7fdea78c5929e2c6489765077aeea9e492de3a529f

C:\Users\Admin\AppData\Roaming\dll-files.com\Fixer\Version 1.0\laststatus.lic

MD5 db08d162908130741305e9dbd9046c97
SHA1 a48f5486720064f297f12c3ab5c549aa355fcc44
SHA256 fab24d95d1ccdf8552ee02c7296d056c9b78319379d5fe9ae871c9de875adacc
SHA512 b2887a8bc38e88e03090a446c522aeb05bca9034dc669ef65f3a191871543728af4636d16d2411d21ff33c353633f224676a9efdd6610d77939a4412a39ec24d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\log_06-13-2017.log

MD5 c0617dad5451bbdc9f6a97e55bd4b861
SHA1 d562dd269388bab10e8457b3a22a82e91de16003
SHA256 918ef360fb6c3aa1737ddc8cbc1c69e4cc663dee59c2fcb70a28742b3d10a2fb
SHA512 76533b87523803f2e314a4c43c50ea16314ba9aec910bae547973d69ef9503f293b1e4d2d24a06ea6577817755d8017df80a6f6e4345975ad13ba206ddf785f1

C:\Users\Admin\AppData\Roaming\dll-files.com\Fixer\Version 1.0\log_07-09-2015.log

MD5 29982721715d3cb6c495efdf2de3d490
SHA1 d8853c66e5f3d23e1960d9237a7f1a7782db16d9
SHA256 7f487616e521ed9b0a6245ef7c27e5def54bb6254b753b2eeaca8f3d272ce557
SHA512 c0aa2aecb18537ed3456608da74213faeea892d56107940aebc94828e5afdf5f7243418469631d2d5d5e8d113d41a81320c7181ebfc9d00cfca94232168e3e9e

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\status.lic

MD5 b4fb5b11b409495bf76f2e7764986a75
SHA1 48f7606ec78b4138e1f493911f302ae6bfe4e81e
SHA256 bb862416bc2c3b0858eaedac13290def75fc9b0fcfb0925c6b5c916894854a7e
SHA512 43e82ba62d3acb16039d1a119e7c911c237f3fbc7ea5b1c568f2f23294760eb1cd07b8d9ca842cfb123685cf637fe4c4c9a2fa03948b5f782812561ae3dfd75d

C:\Users\Admin\AppData\Roaming\dll-files.com\Fixer\Version 1.0\results.rcp

MD5 a302a771ee0e3127b8950f0a67d17e49
SHA1 fb3d8fb74570a077e332993f7d3d27603501b987
SHA256 5dcc1b5872dd9ff1c234501f1fefda01f664164e1583c3e1bb3dbea47588ab31
SHA512 0a2cbdc97d1b676a5842dca27a58404af4ac09ce8bf0d4ee3c356082ca7ee203642b1502910fd30afbcbb1eaa4264cc8eff73f1350806a2b82660e3b1e4cb02c

C:\Users\Admin\AppData\Roaming\dll-files.com\Fixer\Version 1.0\rcpupdate.ini

MD5 7c07fb418c90bd39e47886894b3ef592
SHA1 d4bb5c296349ff476a39b1cf43d9b7ff4c36ff2c
SHA256 6275eb3f133d798e748229518aa20b8eb489561ad3cc93ff286750711211686f
SHA512 7f9d63d74e5f34065ead02d3b7dd4b3539fa8e6e071d23004744cd12ab411e130e78a3f068091310f7f82e932a86ce7b6d6c1f948e3f0ba82f9340ce010aff4b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\TempHLList.rcp

MD5 5c115f3bd1ca09744ec80e7ae153cc0b
SHA1 874ccaf89dfe2c247b38bab5bca80c20c250fe78
SHA256 66d32470060b61ec017cc076ce84eff93d93af7e41fec7fd6faa615ac007b90f
SHA512 e66cbdb4f566f2b69db1c8242c21dacdf96cb5e6c5a93de0aeb0736e4f91c30577d59ab46f25f3fc282dde784f89d30d469e26703c59df92ba3cf5ead03879c0

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\Partial Backups\00000001.rxb

MD5 04810653aff82653429ba39cc81bd6c9
SHA1 e4b8276983648256ee71bcd749a9754f2070a0aa
SHA256 8bd083d106e9e71f2bcb842a35ec272c3eb4d8b6b11e8334ebc095316a97d0ff
SHA512 15b4cbe9dee3ff0f727b2a145541687eada1da8cec474e53b40590b18181a423af7325650bd5984bdbf52763330291d0eea4511119e135f2b73b5af44f488545

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\Partial Backups\00000001.rmx

MD5 8b41e67828d2343381c9cc05984ce281
SHA1 057acd8edce29b029b3f32693e5a7af8b6009c7d
SHA256 412ab4572330ca6ae0a63941d1e23c62407c34a2980a666e5b8c135f09a470b2
SHA512 e7cc90d90a8fe45cad0377879328b30e6cedd96e59afcd03b970d46475859f195870bf62033575aae4eb358d48343586f1f11c9214a590bb8816dc47983c7a3f

\Users\Admin\AppData\Local\Temp\nst9243.tmp\Registry.dll.tmp

MD5 86e135f5b7b92bf597a1c6bd477f23fe
SHA1 035a1ce399ab9e7e26f1abe4a0d7cd547f62d329
SHA256 9da9c8e702d0fb17dabbdb31ad1d38aa147dfea2879ed734c4ffb9660fbe5487
SHA512 ec47f0b21ebed11de292560dd9f44c31e342692c93d3950441c95f3e131454d72bdc238c70d6c24aa4dad3e8840e5f57ff12383473a6c31fd5d886ad76812e6c

\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp

MD5 6cd0b24de8ddaced73245bff1c0bad9a
SHA1 8b02de851118afe77db561cbc64f716a41ada8c9
SHA256 bcae7c2e0b0dea3d8bbf53e729785af450376eb9ecf62277a5d27867882a55e0
SHA512 a7f84e3eeae318844129d74654ccd17470c0eb32824ff3afed89b8ac1399b46b0ad050a323db4d76884521e4c80d12a97b2a181e7ba0623b17ac2328e0a277bb

C:\Users\Public\Desktop\AvaxHome - Cool site.url

MD5 daf3915e3c78a68cc97c69b4a8b02d00
SHA1 7e1b0ca246a5b897cc2aaf9c7594688ec994dede
SHA256 d524322657f6e21b7daa96bb069dfb524bdfa18c6dcf4f3d1d1f67dc580bf7b2
SHA512 9217e6d36051ad7f3a6169709df1f2d940b2765ed7daedaabf872f6523177f2cfc4444a82db1c2128af89002c1f2e6b186857eb135864755d89ffc09fe98ab56

memory/1072-218-0x0000000003120000-0x0000000003122000-memory.dmp

\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL.tmp

MD5 e4caa5c332c4c989478edde35a4bf1ae
SHA1 9f61a202155139d375f6df33919d8f05b3fef683
SHA256 d5b1a7ea9850edb8a8d31353aa99493d37e45e4e76cdcbd8bab428885de29b00
SHA512 f6dbabf7027704b2f5dd2b3a532096421a859bc97e12fa0362c8af23b43cbb7306ab580a53b144afdcd9752f57c729cfb5baf1581e75ccdc40472b93e3094a5c

\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp

MD5 37c1d329ad2de65334d92ea08b4c6828
SHA1 42f34b653713a198e3525312a6e80c3ea2f96ce2
SHA256 d83e03da67266ce0fbf8d22c5e1e99e01fcc351eec33cc7dedbf845193e5de66
SHA512 7a96f53017bcbf08e56174700867a7539866a2c480a54c951f80e9522047cc58aaeff861e5a2e1bb5b10032a2bf7d2d60475d1225f4c9c44af1e9a8a5d3d7549

C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp

MD5 6c0b36547d831b91e799941477cd5bfc
SHA1 667c5ac32e333d5be24c412148f6ad6a5c3c4065
SHA256 bbc43dd01a3001435c0517e64cd3703508812372a371a6578ecb653c83b4fe29
SHA512 4a47b67264d22dc6ecc062b6a8174b70a785fd7ce572cc8d810bd3112630ff27c49616cb70e29ac8d0f0dfd8c6822473b8c391d50d5e9b5a3e8e6fa2c416d807

\Users\Admin\AppData\Local\Temp\nst9243.tmp\advsplash.dll

MD5 ac128600d13ee0cf7aa38f4fce82a53f
SHA1 eafda641d8f1acc0eb7fc83ed0bdc68df226d85d
SHA256 192f9aed83c1130b1b5d302eeaece7d89eaf88d74d7077d61d01d02e0ba7c988
SHA512 671cc196d2e73524f9965bbba158b347e50f97fb45ca376e96dd50cfd073977dcbe2918b672fa421bf0f3aac0fe8d670f6352ff0c8d7f1a603657e65b957aabf

\Program Files (x86)\Internet Explorer\ieproxy.dll.tmp

MD5 15b14ba2d0599113c9de22fb32dd8fd3
SHA1 250521ed27b4e98e3dd69660019671fdca26b3b9
SHA256 9dd0fd4998d68cffc02f0e0b69948428fefe1e43092753880ab0ca343fbc787a
SHA512 e6bd6e49d47bf17650fad787ab1a1584ec7a021325f54b2c50728e7593cf0be533080a034b6c51bbf6d6f4338c6ee75307e6f519581d3c2a47c31f550cbd88c8

\Program Files (x86)\Internet Explorer\IEShims.dll.tmp

MD5 0c779476f459185b0e56818ed48685f8
SHA1 58242a9d5ffda5dabdf80de18b2f8968b6d1e56f
SHA256 ee48dd9047772aba8414d08413ea203e1abfafc24adc4830956f5cfdd564e983
SHA512 6b172342de3987cf3ac117ca2a97d957ccb2a613ec4d8024a431830a26f0fa6567ec76492e4cab4f1ba082d636f748a11bea176d74ce16025b0ce151bd993a41

\Program Files (x86)\Internet Explorer\ieproxy.dll.tmp

MD5 bc69a471110980a0806e523e42562a9c
SHA1 09dfb740e9ec38c106a96b94df026c5ebff70e65
SHA256 2b79b9db73b0177a6f7a881662eb59714f2f6b153422b059aaae17413ad268d0
SHA512 1f07104074287542154da8e6263ffefd039ff0eef83c6293a217939a836a37a81322542edfa7fcbbfe5db2cf56cd7152c0431ad5e79b4da57f789718783da11d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 67e486b2f148a3fca863728242b6273e
SHA1 452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256 facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512 d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 316978ea16fa66abd4af382528cf5f4d
SHA1 bc4221abd67bb215fc75b1a8f66f2864475acfa6
SHA256 b969fe82edca2433623174977c19c86d309990435f3d0569eedaece596941e40
SHA512 c80e0a2941d731bb9fc44b3223769e4c4fa7275ad8bc8fdf2879745c2d63d84909fd1d692f114d9fcc24eb9a21770d22522194638557d4f215e1ce46806fa1ac

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe

MD5 623ebf8ce787ba94ee7e3dd3a2115372
SHA1 77c8c99a345d4ee8a8e700bfab05f87986633f59
SHA256 11f95ff48ebd0259d36ae56628439e21f775edaffe68a215e6959c043bdeb2bb
SHA512 b498675ea9daab67d964026f8442028ecc7686f6bbda79e1dd63f175a472eae9aeded9d0d57289568cf59a01cfa8288a91e74eb9451f72e69905fabf731ec7ca

\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\xmllite.dll

MD5 71a2dca8f626fcef8bff7e2c17c67a7f
SHA1 5aaea93ec3f4d722d7ea0c2d86bc4f3cbdce5c92
SHA256 b55a978443ef0b873875910283bedfab0c3133bac7be72a68ed5146f83f1ef8c
SHA512 5244918679eba6e7af8e367c66c3d1bdcfa2323400994ecda37ccd697fb28b52ffdad992650929ec98b98ae9e0213074368a8881c6a62e48579c30f17051a17d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\RegcleanPro.DLL

MD5 cbac13aeec0b8c35bcd8be3f815cd7e8
SHA1 39f4f1c12a50fb9fc2a2782627eb0396426d8982
SHA256 78ca94130c9463175dc1dd427aabf1be57ebb75c221208401fd78ea595d3040e
SHA512 5729727975b5e0136cc859596b9e8a7393236e083e84a0a88b1650f3588b44ca41cde046ff18bf065159a4c964c15b41d73441d9cb9fa9162ebab4e4a58eec77

memory/1772-408-0x0000000003180000-0x000000000336C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0qn8gcy\imagestore.dat

MD5 4b838db58ac503dea5b09d0a11399840
SHA1 0f4d3ea45458143fe8d6923a4b72d5fbf3ea9e09
SHA256 cc7db04f4e47222b4fb75ee46cd49d2b4af267158a3691a9aea2afdecb8cb809
SHA512 638afe74d750e84558f77036292e77809d58719219715a8d779e38f6961d4c6daa7cbb638cb34fd6536516e91701fe12f14a990d9e966d12141ff468c93eb0aa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\favicon[2].ico

MD5 c1cbf09dbd7d366447267a5b3b70cb02
SHA1 b40892e387f76138877c9978a5a70fe61e00dee1
SHA256 7022d620bf34886398ec3ddbb95635fe09cfb871aa3c69ba5fc7249435c473fa
SHA512 6e9f77e6d9bffd9aa3af6240f16ced04aea77083f9341d60c9da72bc723dab60a95e2159709944c291a2c89ea82b6ecbd8d3bd32bcba46ff9ef2db36631f9ba1

memory/1772-425-0x0000000010000000-0x000000001049F000-memory.dmp

memory/1772-430-0x0000000010000000-0x000000001049F000-memory.dmp

memory/1772-429-0x0000000003CB0000-0x0000000003CD0000-memory.dmp

memory/1772-428-0x0000000010000000-0x000000001049F000-memory.dmp

memory/1772-427-0x0000000010000000-0x000000001049F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\eng_rcp.ini

MD5 edb38b19512c080c36256e67e0875aff
SHA1 c8732d10c6a55a6bc6780d6fc6172b4a9d7a7ec3
SHA256 175e1dbfca76083abfe0b342fb508a77f0b51e54b27ea71124c9bd4240d3fd13
SHA512 9e0e32d9fc0d850dcb3dcc1eef0ba4ef8caebd99edd6962dca1e95b849d5f625e986b9afb9500a871d77ba608c953a360c66e669c391458da8beefa7c5b31cf3

C:\ProgramData\Logs\43DBA3A8.license.log

MD5 f9d93853a436595ff317b37ab752959e
SHA1 a4098e833205c49a6d752b3da5f80d499742cd04
SHA256 949419cd38a920427d10462dfaeb7b205c5f600689ed02844cabfd8ea014a3d5
SHA512 aee9ceedb1444d873ecc86f696489832160b0aa08d17e32040b45853dded61d8487012deba367aabcf533f9b1aadf51e26c719b3cdcd5f34420fd5e338c42a02

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\RCP[2]

MD5 f8bf449cc7a54a2422486a984cda8f10
SHA1 dfc453ed99722df9e729ed7f8016275a381b83ad
SHA256 5a03c63862c9b84befcb17976b2683d813a5361b301bd73ccd3b8f559247ac6f
SHA512 9d83222d4373307c15ebf7d866d4e2f94e9a818216d2871f50016b98733a93c677c4958d635e9828e0e8701bb0bce3fb595c98a5fd26b3e95373e3dbbe55ef1b

memory/3028-561-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1072-563-0x0000000002D60000-0x0000000002DB9000-memory.dmp

memory/1072-562-0x0000000010000000-0x0000000010030000-memory.dmp

memory/3028-559-0x00000000002E0000-0x000000000039A000-memory.dmp

memory/3028-565-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\alttxt[1]

MD5 ceac94607a86429e7927f7b85cdcad25
SHA1 6ab8d7fd80fc8e2288357cc83dd3d73a34cc8bb7
SHA256 cf8639233a6aec75c5b3d0d5877a01e758bf7c184e4eed261994240c52d18ccf
SHA512 8d5052701e27d09416fe992b41bb35f3a0d3cbd3a5187222601a9c049cf96213094557b8e6c7b24053802440242d1419a50361cad54c24d9416f36f095c77866

C:\Users\Admin\AppData\Local\Temp\TarBE15.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Temp\CabBE14.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c9d3f5da24f2a0262d1f748d31fe075
SHA1 4a8144f9b66c69efd61103272e6fc6ba8b052a5c
SHA256 dcfee56d2d4d04e73b65340c039c1f2f978dee00c31a8bf7fea4a2d58d4ab025
SHA512 3c419924f8d6929de83e968eac244632fc0aeb4fd2789e9654143c65f3dd1d6c4b962a18a3613d6c4ab5e6884be1e91e64e3533dac1ef105b14b10cb67c9d499

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9e6f33b8968ac2dddcb66bf240b3dc4d
SHA1 c6c08fd365e210d70ef0ee416ebbead068abb8b0
SHA256 48884ca771ee962363fd616d54bb49ae88c48a88ededdd00ca9f8f80b54756fd
SHA512 4a17caadacb9c843050abf444b736800bf152518114002c9cba5b10f82ca18d20de71197f186f509e542c897bcdbec21584ab28060187bb99a9bc322adf35b0b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87096ec39d9e145a4af168b5d1c97da2
SHA1 b527ed8b417907e0ad950ac0c473294f4fb091f9
SHA256 d096d8f3a00575e409f302cb6095596967a1204d071684f3fba2d8391f7799e9
SHA512 a7c903edbf78f14da7d7d6a845544acbd7dcf842d7d92f341a2e50580213ca143c5302838d37bdf549b341d5821fdfd6451585eeea99ebab3b317d2df1a57a20

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf07b122b1a0e9ef771d5490890e69b3
SHA1 9222dc01269a6251fa09c9ad7f4d9a22f4d6c95d
SHA256 9af15e5de0bc88b4f5baa19a8a85f75796786a9e7a48f46b4bbba6959ef9a4b0
SHA512 e7ff8f1c461c5ddf3316121adffe0dfc2194121824db2427edb21b5f6d15c1f231baac50cfffeb33666f4b64dfcd1f0f0b8a9ef32f5f8a7f04906c78f1a2903a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1a75ac915822f6f4b001c0e8c616e91f
SHA1 1335e96beae2e6c2c5a1e1c968fea9adda1523ea
SHA256 2452f5176dc734fc6930f86996290b06bb0c518c5287351a8b035bbeae22237a
SHA512 d06f7b9a7df4bf89a98772a41d7960a0707cd30d701da1dd02daf4a0e8a74448f061a890684587e7c61022f9a918444852e509eaec9e0316a52a71f1c6f0cfd7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b749efc912e4b5d13c860d61c7ada3a
SHA1 ad10d62a642e2a28c93f6210dd1fa698b1e98630
SHA256 281c621cd36f516189acdb5b6cc9469c5254ff2d8b6eb7a5deeb169309969598
SHA512 79b850c23fa35e9e755ce6a6368ddd8afc3ce955219fbfffe24c1b2cae426331bbc3c34638c44f8fb920bfb9c8fe46b71ffb4344ecbafdf8d88df202383b04e6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 71a4af3bdf634899184e4815d6aef500
SHA1 2c50b6ef11d21400038f83e5baff34cc5f65d219
SHA256 0af840086f5b42f96951924d91d74683f4cd4e25cdab5b1aef891ceda7ae2187
SHA512 a2aeada286f78c7ce48abba6c3f9dde092a1bc553500e7c3260e16560ce285ebbb8a3671e58f7a39ac6063d785d4dd87d5bde470d4fc89f99924c908b8b72586

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4c8898ea8f60e362e5cb288f7f8636c2
SHA1 a9bd609bec3f471e3b4dd713e50c67d1f782f689
SHA256 cd65859b628b5dfd760d0a0aa9a263309dbf6a4f37e886bec9fed470c8809a3c
SHA512 e33e0140f497397d2fdc0607bd8144f98240d25cf05a23093dc2be6284c7fa3eb213a83110493ba4ec1282618c19fafd65495ede93f2d9af6ea1af73da9a4aca

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e11df6f34f82cdfbec5654d3686ce742
SHA1 e834b574e99d5956acae0b36090750d4ad5e028a
SHA256 f266eaec7429c827c3659dbd94cdf3ae10358cd85c63e280ae8f4771d0c62140
SHA512 866be378c1607c2e7b088957e8466e7ccf4eb95a313c4a739550b1d8b3ea696ad2618a08506e8e08da64582cb3654c27e7883f50c113bf27c8713bea7c53d49a

memory/1772-1044-0x0000000010000000-0x000000001049F000-memory.dmp

memory/1072-1047-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1072-1055-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1072-1063-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Program Files\Common Files\System\symsrv.dll.000

MD5 1130c911bf5db4b8f7cf9b6f4b457623
SHA1 48e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256 eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA512 94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

memory/1072-1075-0x0000000010000000-0x0000000010030000-memory.dmp

\Program Files (x86)\Internet Explorer\IEShims.dll.tmp

MD5 644fd90ea91260def4310f9e3a9f5003
SHA1 fd0944bdc46bdc9f1933b36c4393dccc2caef7a4
SHA256 700fb02abde0c55b591226b522f090ed45a89b9637f7562e3d0d8a53f45c5ba0
SHA512 354b905bbfdcf782d262749250a4fa9a0d175aa8dcc3074d9e5c813a9ee9da4314baf4f8841202a819e3794ab92f5842fe4a0c812b4ec74a6dda7c965802753f

\Program Files (x86)\Internet Explorer\ieproxy.dll.tmp

MD5 24f6b66ff051750491d8b842b54bdb58
SHA1 71709966c5a14ab37dc64de1232cdf8e8df0d746
SHA256 77819c4063a778ee354a1b4511c812bd6835f78836cc26848580f62af3d0fa54
SHA512 5d7fd554385d84a830032f7434756a5ca017acf350c5140b85ef32e8cca138fea480533646bd8dfc664ebf663a03bfe5531a4b32464b137a47fb4911b01ab1e6

\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\XmlLite.dll.tmp

MD5 889ab499a65398203084f160021047e0
SHA1 3d0ef88ca08c6387321f6eae7e1328cf113fa6e6
SHA256 274f4798c7c5b823ddbc3e6cfa92f747111838bb81fd1e0e76bb86397f230865
SHA512 7486a4774732c0c6fd195b380787363cdf962b0ec07068d3b4acddd4225bd5b31e9566c144f092d3abdd13ff0aee451e36e2dc8e2fad01ad53b9b4e86758fce2

memory/1772-1094-0x0000000073420000-0x0000000073442000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\Small_level_1[1]

MD5 281681776d56cc91225927412c1a784e
SHA1 62907cf9d229d456719348237c04a9351730604a
SHA256 a94c0887c6b8f5db2b4fe79ffac4c376b470f120ea7e596f2a86080d4532c68d
SHA512 c5cebcf911400f90e0552d823383474af95723ba14d40279e6ccd4f7a94765eaea6d83ddb468217b5e67da28d3f7b4bb21c6592766561fd1940acade76255cb3

memory/1072-1114-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0b472188c73c2a74887d3015b46ce8fc
SHA1 9f1e419c3313cbad01cf34a55b01e844fcfda85f
SHA256 cc99d9848379b3d5a6186a42ce2bc36575df8a19ff1cb92c643ba02ebcf03b16
SHA512 1dc4b44941e08d32446981a2d2612d81672eeefdd88010d61db6243d0b9db4e0214d41eda00fc5ccac3ea126f0c6285c77e6cc415cf1eba6042b214ebbd422f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ff20eeb7d7744c6f7dd86ecc0f49878
SHA1 435bff0186e3191cfd873714a02f77ebc327a210
SHA256 21fdc684804eea3783ddfbec64aba79c83971a2cdf887902db49d595eaf54f1f
SHA512 0f4251cdf3b5ca855a04a05588c0a5dad76efda39759040b0ffb692c69088bba745e824ad0e6234717ede92f5eff4b602d011399e269a1a45db72d4353d34b94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 365e970107e15e39e03d0637caed10b9
SHA1 7132b5549e0881ac854f31895a5314fabfde0713
SHA256 a466740158300ce516e4b111b5f064ccc9eca69d1fd99caddf1902c25c4ee6ce
SHA512 5eeff099a6b9506f1b97f9661147a9e9e79feb68c2a624b9796dfa4ed29b9ca07c3f1eacf50157a5ce9f87de7a693d9e9b020108f8b317f7fcfc6b3176bb538b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1a457169ca2cc87c65b8c6b2f248ed4e
SHA1 5d8857dd78f5eaad3bff6fc1429f7a6b35d3c50f
SHA256 192ecab89c087df3ff467ef95bed870767b0353ad061b835c35c34a300036958
SHA512 b43c87cabbf1120a0674b291f336e71b38449068a539b76a24ef75659ae0e0a7f979d984f26a71da2bb95f27eba98d284ba6268f6527bf10f0e7705239329be1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da3889c0a597c7523815168d9addb1cd
SHA1 f6aa6fba951688a1f9c3da3a7c5ba6070dc0d4de
SHA256 f660d037cdc0054d271e7cd62f371537c00cb9cf0aeaafbe83d4acd39e499b52
SHA512 a820479203d2aa2a1245e960c4b1a23bb0b7f9e6886e39cd58ec321bbe97606ae4ccdfacbe647c972154de27cd83590207c74363fa86a5c24db145540a1ba460

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0882360f96917feafb9c8dd926bbea94
SHA1 0df463ea97ac501d432fc0260363e7fc96564686
SHA256 7b55ebcdd162d4c79ab7faa327ebeadaf846627570ed3b2c18926e803f88f2c5
SHA512 51dfa428c6b2c3fefd5aa4843a9a7970fe1a2dd39e337e1fb21030b60ae39a32c708df65dfb1ff95b60aace8c2671fe6d6c6cedf4154f36dbe558a91d5931442

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2fe713170842e39f5497269046e30b9c
SHA1 d7e5cc4311aa01827f27d9ccbfff85c7d12e0e47
SHA256 c3f0acf3218b0704ca469d8b8b5cf8707b5b384608129afe0e6c48c4cba07230
SHA512 e93bb5c7d9b51a1303c7fb460f75ae2f3f30ef1eb954bd748c9deadd987e8c2e41cb0492338f9fd9842f7d6438336e014c57978233ff49741b0d663d14bd8326

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 b667febb8c8783473e403916a87ca44e
SHA1 da4d7c778d831ef4620894b9afe0916f1134d5fe
SHA256 0677b788c0c178553880a25409c0b03ec532b06d672f2d3355c76e64d0be9c90
SHA512 dacdc5ac8c2d9414c13029c46352fa5a582c55961905b467a239e5d5411610de3cf4376eb4b7fa710706d4043e25a1e6e186f2766cddc486b216b4432c224ee6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 427d9940ed4732fe6248bee1b1d15ddd
SHA1 3c2d932a06e5950d6c3d39540484e6e0750a88c0
SHA256 e4d01e5af21fceaa28c832c601de97c3503fc435c52569c65337d64c10957d08
SHA512 97b78204675bab4d729ffa0ed395926af6505dbc5399312b76315b5225585bd2743b3c4d633ba393103b6537059d8e0273fc302bc547b37c3465ff95988b0623

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c1de85543e151aba51972cc5322de9a3
SHA1 09651eb037c4d56c37a5b18df4fd0e21115f256e
SHA256 2a993b77a9a2f1e267a2b51fefbd972b2e51d81505c89625c10d25c601ce1426
SHA512 fbfbf58fe7382bee51d9c7f7bf7ea32f1741fd8298945cefe8e8ee6a9c1e7b50e756e47b6ea87c96c958da6dc035b4c09e44f132a8af7b1326af093328777020

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c8c6aa6de24304f6ae5cc2382cc610c7
SHA1 ecc02028c9d818b06a86e2a4404da70e4369afea
SHA256 604d03544ea64515ff87a6b5e56685fef6059cc38bbcc46f40b9242d3e5e5ffd
SHA512 503ae0a404e53d6af75093c36c500f7cd7829b1e2dad8b0db7c6d0d70dc42f2ec52737fc83bab69295c957745b3dbe29d959671810ee2b9e9c4438dab3d27dd9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b8a34a6fef359ef8a0b5ccfc2e01e5fc
SHA1 fb3b904b971dda3def851db7f964f70b66d20472
SHA256 56f228445392af4b85fb346727648721fce176acc7ed58e2f95d99dd9f5a717c
SHA512 2417b8cfbbe6551f34c2eb90c52819d9ef9f1fcdbcf6c2cff37bcaf01aee462ebad89a6934e50ae65c2a8489e304c209e1363d0ff61065cd12a2b1f45806129d

memory/1772-1670-0x0000000010000000-0x000000001049F000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\Small_level_6[1]

MD5 647a5d61126a8166dd8c85075765f23d
SHA1 be371b23cb84edecd90091c16c817c321bec692a
SHA256 54312b797f4a93f8f8f3cc6d699cf7406faf35f37333284b11af85c399584ce5
SHA512 a70e39c44811ef4873c7d8b26ffda0d27d481a9c2d342aa5a2f980287fd101fad9d6ddbddf54e82d68ae42d003538cfbb56068a756ab5c528081a5af78e634d5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\Small_level_2[1]

MD5 25c580fa422d99857459e41d9b16c83a
SHA1 ce852f4968377e8857756e41164c144998f47b49
SHA256 f6c207e2fccd2fcecab74143934a154385a352c00308166cb5fab021bba6268d
SHA512 a093f40fe84e4d5476bb38277a65e955669782c3fce921510dd0f2d61e3dae9ac85194e8e6a4b4f1637d4199b6ee6e42fdad15b8e664547c2805ef1d551b5639

memory/1772-1681-0x0000000010000000-0x000000001049F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-05 12:05

Reported

2024-12-05 12:07

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe"

Signatures

Banload

trojan dropper downloader banload

Banload family

banload

Floxif family

floxif

Floxif, Floodfix

backdoor trojan floxif

Detects Floxif payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\System32\Drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File created \??\c:\program files\common files\system\symsrv.dll.000 C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
File created C:\Program Files\Common Files\System\symsrv.dll C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regedit.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B9FB8EA-6414-C02A-1FA0-E5A0E3ECE118}\InProcServer32\ = "%SystemRoot%\\SysWow64\\shell32.dll" C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B9FB8EA-6414-C02A-1FA0-E5A0E3ECE118}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B9FB8EA-6414-C02A-1FA0-E5A0E3ECE118} C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B9FB8EA-6414-C02A-1FA0-E5A0E3ECE118}\ = "Undo Command" C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B9FB8EA-6414-C02A-1FA0-E5A0E3ECE118}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4032 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe
PID 4032 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe
PID 4032 wrote to memory of 3528 N/A C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe
PID 3528 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Windows\SysWOW64\regedit.exe
PID 3528 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Windows\SysWOW64\regedit.exe
PID 3528 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Windows\SysWOW64\regedit.exe
PID 3528 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3528 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 4680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 4680 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 512 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 4528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 4528 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1876 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe

"C:\Users\Admin\AppData\Local\Temp\53e33e85ba0c94c616283fe2f88b6bf085ed5c20bb3460aa15e6ccf0bf83c315N.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe"

C:\Windows\SysWOW64\regedit.exe

C:\Windows\SYSTEM32\regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DllFixer.reg"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://avxhome.se/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc739846f8,0x7ffc73984708,0x7ffc73984718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13063857040720190730,1649208933466042659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 avxhome.se udp
US 8.8.8.8:53 5isohu.com udp
BG 79.124.60.187:80 avxhome.se tcp
BG 79.124.60.187:80 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
US 8.8.8.8:53 www.aieov.com udp
US 45.79.19.196:80 www.aieov.com tcp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 pixhost.icu udp
US 8.8.8.8:53 187.60.124.79.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.19.79.45.in-addr.arpa udp
GB 142.250.187.202:443 ajax.googleapis.com tcp
US 104.21.66.116:443 pixhost.icu tcp
BG 79.124.60.187:443 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
BG 79.124.60.187:443 avxhome.se tcp
US 8.8.8.8:53 maxcdn.bootstrapcdn.com udp
US 104.18.11.207:443 maxcdn.bootstrapcdn.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 216.239.34.36:443 region1.analytics.google.com tcp
BE 74.125.71.157:443 stats.g.doubleclick.net tcp
GB 172.217.169.3:443 www.google.co.uk tcp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 72.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 116.66.21.104.in-addr.arpa udp
US 8.8.8.8:53 195.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 207.11.18.104.in-addr.arpa udp
US 8.8.8.8:53 36.34.239.216.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 157.71.125.74.in-addr.arpa udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 nav.smartscreen.msiserver.lan udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 5isohu.com udp
US 45.79.19.196:80 www.aieov.com tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 5isohu.com udp
US 45.79.19.196:80 www.aieov.com tcp
US 45.79.19.196:80 www.aieov.com tcp
US 8.8.8.8:53 5isohu.com udp
US 45.79.19.196:80 www.aieov.com tcp
US 8.8.8.8:53 5isohu.com udp
US 45.79.19.196:80 www.aieov.com tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

C:\Program Files\Common Files\System\symsrv.dll

MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

memory/4032-2-0x0000000010000000-0x0000000010030000-memory.dmp

memory/4032-5-0x0000000000421000-0x0000000000422000-memory.dmp

memory/4032-6-0x0000000000420000-0x00000000004DA000-memory.dmp

memory/4032-10-0x0000000000420000-0x00000000004DA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\DefaultData\Roaming\dll-files.com\Fixer\Version 1.0\TempHLList.rcp

MD5 7319468847d7b1aee40dbf5dd963c999
SHA1 7722745105e9e02e8f1aaf17f7b3aac5c56cd805
SHA256 b0f66adc83641586656866813fd9dd0b8ebb63796075661ba45d1aa8089e1d44
SHA512 c11d53b386f5ee0c042c9246d4a38b1e032a3bc9ea3f6827a9482d4f31b6e4a1973c97190bdc59d961d5b6f1d5b06c25c4b9e94ca04eaef395a928fa851493d6

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.exe

MD5 f363d40faaa31fa4af15262ff5e60bdd
SHA1 46c826bd456a536d946a21db6d7351ff5afc1d9f
SHA256 cbc4fb6f6576908c152b3687a1e2ff7793e837dff89cf561124ffabde7814a14
SHA512 601d6cae4ae347cafe2850873d09350e2a48935956cebd776bd1b74ad1dc0b55b41dcdcb04273b0eb6ccb6337dd2c46e88bf71b1efc278afab9db15aa2da1daf

C:\Users\Admin\AppData\Local\Temp\RarSFX0\DllFixerPortable.ini

MD5 9c999a4d95dcf6e82bebae5882dfa95b
SHA1 c3a529ab0dfc68b2f1d4fa82867cf28b1ef3fc09
SHA256 1289c76030eb9e04cb2b2363ae66cefd1b2af957ce1bf7d04d835408690a8e93
SHA512 fed8f935e6930149d1e22dfa9abc32e3723a59218c7a0c399b03256338bcc82360a840a218855cb66a7c34aa4f35d147eacb86595e31980c6f1bbf163b0c6342

C:\Users\Admin\AppData\Local\Temp\nse785E.tmp\Registry.dll

MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

C:\Users\Admin\AppData\Local\Temp\nse785E.tmp\FindProcDLL.dll

MD5 75e7351a0f836b8659e6f315683c29f7
SHA1 66b733d1c978d68cadc245e7efbfcae32807429d
SHA256 7ffc549e7f679a08c77fa230654b77cdffb3444296bb7c6b8b5769db374b61ee
SHA512 f03400798b07ccca5e12fa119a586ee9444deb0d2419aced24d93fd84a4702d66864a71b40a11b04b1dbe56e36481cd6a644aec0347bc82bc7375b27bc403fe4

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DllFixerPortable.ini

MD5 2694db1d7a4da30651a8c33063861ac2
SHA1 bb6620e930028c6368e5b320ea0040e6a4c454df
SHA256 438aeb00e5e9c87d01f36aad7827a8998e15996e541282b7c1ffc3e4a10e5769
SHA512 e74b848aeade5774481c23693ac044c48d7ceec33506b5bedada8cb792125617e89bc394008b77802ab6fc8a2717ad71d94819601e7b2f0739fa8b8b1a89730e

C:\Users\Admin\AppData\Local\Temp\nse785E.tmp\System.dll

MD5 883eff06ac96966270731e4e22817e11
SHA1 523c87c98236cbc04430e87ec19b977595092ac8
SHA256 44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82
SHA512 60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\DllFixer.reg

MD5 7509b7c4d13f7dce4cfdd389142cfb9f
SHA1 72d78c2d470a2101b74d07d9418d7b6c15db3149
SHA256 e9530d9998bbc8a08936751c09c56bc10c8eb35b54305261b5a310139fdb983d
SHA512 bdfd1d084dc70673f30d0424ffc298c2fae33f4e0de5fb1f372d7d60ba2f81f43434abc391645ba22649be7fdea78c5929e2c6489765077aeea9e492de3a529f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\laststatus.lic

MD5 db08d162908130741305e9dbd9046c97
SHA1 a48f5486720064f297f12c3ab5c549aa355fcc44
SHA256 fab24d95d1ccdf8552ee02c7296d056c9b78319379d5fe9ae871c9de875adacc
SHA512 b2887a8bc38e88e03090a446c522aeb05bca9034dc669ef65f3a191871543728af4636d16d2411d21ff33c353633f224676a9efdd6610d77939a4412a39ec24d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\log_06-13-2017.log

MD5 c0617dad5451bbdc9f6a97e55bd4b861
SHA1 d562dd269388bab10e8457b3a22a82e91de16003
SHA256 918ef360fb6c3aa1737ddc8cbc1c69e4cc663dee59c2fcb70a28742b3d10a2fb
SHA512 76533b87523803f2e314a4c43c50ea16314ba9aec910bae547973d69ef9503f293b1e4d2d24a06ea6577817755d8017df80a6f6e4345975ad13ba206ddf785f1

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\log_07-09-2015.log

MD5 29982721715d3cb6c495efdf2de3d490
SHA1 d8853c66e5f3d23e1960d9237a7f1a7782db16d9
SHA256 7f487616e521ed9b0a6245ef7c27e5def54bb6254b753b2eeaca8f3d272ce557
SHA512 c0aa2aecb18537ed3456608da74213faeea892d56107940aebc94828e5afdf5f7243418469631d2d5d5e8d113d41a81320c7181ebfc9d00cfca94232168e3e9e

C:\Users\Admin\AppData\Roaming\dll-files.com\Fixer\Version 1.0\rcpupdate.ini

MD5 7c07fb418c90bd39e47886894b3ef592
SHA1 d4bb5c296349ff476a39b1cf43d9b7ff4c36ff2c
SHA256 6275eb3f133d798e748229518aa20b8eb489561ad3cc93ff286750711211686f
SHA512 7f9d63d74e5f34065ead02d3b7dd4b3539fa8e6e071d23004744cd12ab411e130e78a3f068091310f7f82e932a86ce7b6d6c1f948e3f0ba82f9340ce010aff4b

C:\Users\Admin\AppData\Roaming\dll-files.com\Fixer\Version 1.0\results.rcp

MD5 a302a771ee0e3127b8950f0a67d17e49
SHA1 fb3d8fb74570a077e332993f7d3d27603501b987
SHA256 5dcc1b5872dd9ff1c234501f1fefda01f664164e1583c3e1bb3dbea47588ab31
SHA512 0a2cbdc97d1b676a5842dca27a58404af4ac09ce8bf0d4ee3c356082ca7ee203642b1502910fd30afbcbb1eaa4264cc8eff73f1350806a2b82660e3b1e4cb02c

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\status.lic

MD5 b4fb5b11b409495bf76f2e7764986a75
SHA1 48f7606ec78b4138e1f493911f302ae6bfe4e81e
SHA256 bb862416bc2c3b0858eaedac13290def75fc9b0fcfb0925c6b5c916894854a7e
SHA512 43e82ba62d3acb16039d1a119e7c911c237f3fbc7ea5b1c568f2f23294760eb1cd07b8d9ca842cfb123685cf637fe4c4c9a2fa03948b5f782812561ae3dfd75d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\TempHLList.rcp

MD5 5c115f3bd1ca09744ec80e7ae153cc0b
SHA1 874ccaf89dfe2c247b38bab5bca80c20c250fe78
SHA256 66d32470060b61ec017cc076ce84eff93d93af7e41fec7fd6faa615ac007b90f
SHA512 e66cbdb4f566f2b69db1c8242c21dacdf96cb5e6c5a93de0aeb0736e4f91c30577d59ab46f25f3fc282dde784f89d30d469e26703c59df92ba3cf5ead03879c0

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\Partial Backups\00000001.rmx

MD5 8b41e67828d2343381c9cc05984ce281
SHA1 057acd8edce29b029b3f32693e5a7af8b6009c7d
SHA256 412ab4572330ca6ae0a63941d1e23c62407c34a2980a666e5b8c135f09a470b2
SHA512 e7cc90d90a8fe45cad0377879328b30e6cedd96e59afcd03b970d46475859f195870bf62033575aae4eb358d48343586f1f11c9214a590bb8816dc47983c7a3f

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data\Roaming\dll-files.com\Fixer\Version 1.0\Partial Backups\00000001.rxb

MD5 04810653aff82653429ba39cc81bd6c9
SHA1 e4b8276983648256ee71bcd749a9754f2070a0aa
SHA256 8bd083d106e9e71f2bcb842a35ec272c3eb4d8b6b11e8334ebc095316a97d0ff
SHA512 15b4cbe9dee3ff0f727b2a145541687eada1da8cec474e53b40590b18181a423af7325650bd5984bdbf52763330291d0eea4511119e135f2b73b5af44f488545

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp

MD5 16cc44da55879e56734b6440a964292f
SHA1 8f60cd7662b481b044d77c342b558c54de8bdf48
SHA256 2069fef9a4ecce8f1f61871edd8623c5dbeefb336a0aefd2511e2f5a85a80030
SHA512 79b5168dc1c06d1bc19ea157dc1249a3740e13604151ff7652fbd6f799d582029a97c3e1139cf9d9c6816769aae9adcb3ebbad5b2e91464bd1f5220778e56245

C:\Program Files (x86)\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp

MD5 ba444ce89e51032b8d7c8e55c80f5fb8
SHA1 b0b540de38a9e6acebc6e86726a51c5dd99c5865
SHA256 1fddbe5f455e59aa44b6d858a7d5cd1b38e2c12cccd761a19fc5ebf934cff0fc
SHA512 f0b844e400ecb5e2fd6beb4fbdf10d8a2ea45328062024d70647f97da0fb8c39012ea4bae875bab8adb2116583e5ed58cb4494aabb61e21caca08dbc274f07d8

C:\Users\Admin\AppData\Local\Temp\nse785E.tmp\Registry.dll.tmp

MD5 727906f8e9c58e4155bada80d2a6e44a
SHA1 6b6cbb007337004d3dc752d7dfab5c692e3a00cf
SHA256 14d6d0abbe4ce1bec5ff80b373ce3a8944c17761c732dba04e434ae2b6024642
SHA512 43aee5fd4acdf24855dcce0d9d2c8ea281fe81e2e4229c98d2a37699e86e418dbfc21b254bb3d72b7c376a2ff445fc6450e14b16dd34f6672f1de20ea603a256

C:\Users\Admin\AppData\Local\Temp\nse785E.tmp\advsplash.dll

MD5 ac128600d13ee0cf7aa38f4fce82a53f
SHA1 eafda641d8f1acc0eb7fc83ed0bdc68df226d85d
SHA256 192f9aed83c1130b1b5d302eeaece7d89eaf88d74d7077d61d01d02e0ba7c988
SHA512 671cc196d2e73524f9965bbba158b347e50f97fb45ca376e96dd50cfd073977dcbe2918b672fa421bf0f3aac0fe8d670f6352ff0c8d7f1a603657e65b957aabf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

C:\Windows\system32\drivers\etc\hosts

MD5 9a9b492d91e00ee8451e6b8aa3aede17
SHA1 150a9285cbf9385d92eab98ef10deb9503cebfd2
SHA256 53adf1195fd1beebc770f22a685233d0aac280e6426d5493275de9b8b7dcde96
SHA512 97d9a6e3d4c2a91799c4bfe1a42e2a0513018045984bc994e348b345d3dc755d567b63e717cec2a29bd8296d014fc6e3024676d65603e31e75d606f973d3a92d

\??\pipe\LOCAL\crashpad_1876_EESEZEBWXWYZDUOE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f443375badcab338153b4e00dfcffd3e
SHA1 6ab9a4e907f0abee98c74875f3f5a103b9b9c64a
SHA256 f2bc0670e338d2da45addced51135a0ba55e7fb627692c07853ed42a362d013a
SHA512 efc8183ff9a047c42d74751ba2cee7627d0c2def1b128c7a05c5ab5bae3e1addb1a03d80b2ecc5c7f2bc060f5fc30c6115a95e7540fc751cacd2ca9e63390c83

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\DLLFixer.exe

MD5 623ebf8ce787ba94ee7e3dd3a2115372
SHA1 77c8c99a345d4ee8a8e700bfab05f87986633f59
SHA256 11f95ff48ebd0259d36ae56628439e21f775edaffe68a215e6959c043bdeb2bb
SHA512 b498675ea9daab67d964026f8442028ecc7686f6bbda79e1dd63f175a472eae9aeded9d0d57289568cf59a01cfa8288a91e74eb9451f72e69905fabf731ec7ca

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\xmllite.dll

MD5 71a2dca8f626fcef8bff7e2c17c67a7f
SHA1 5aaea93ec3f4d722d7ea0c2d86bc4f3cbdce5c92
SHA256 b55a978443ef0b873875910283bedfab0c3133bac7be72a68ed5146f83f1ef8c
SHA512 5244918679eba6e7af8e367c66c3d1bdcfa2323400994ecda37ccd697fb28b52ffdad992650929ec98b98ae9e0213074368a8881c6a62e48579c30f17051a17d

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\RegCleanPro.dll

MD5 cbac13aeec0b8c35bcd8be3f815cd7e8
SHA1 39f4f1c12a50fb9fc2a2782627eb0396426d8982
SHA256 78ca94130c9463175dc1dd427aabf1be57ebb75c221208401fd78ea595d3040e
SHA512 5729727975b5e0136cc859596b9e8a7393236e083e84a0a88b1650f3588b44ca41cde046ff18bf065159a4c964c15b41d73441d9cb9fa9162ebab4e4a58eec77

memory/1088-267-0x0000000003B80000-0x0000000003D6C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/1088-277-0x0000000010000000-0x000000001049F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\isxdl.dll

MD5 8192b56014894e7869374fd3b042e386
SHA1 8ce1b841723726b2d7f7d0435b4b9b758636f3b4
SHA256 a0ad24d6c6a606200fd2c295c74e551a84cf7282909b6db463fbc022a5202dbc
SHA512 d5e5369d7f0c6c454eb0360ac5025470f56b5f9688ae474cda8df2ff52aa10646cba0413e33023c2194d4d351b140ee8a0ae120acf24a203901ded3c301834ee

memory/1088-282-0x0000000010000000-0x000000001049F000-memory.dmp

memory/1088-286-0x00000000033A0000-0x00000000033CA000-memory.dmp

memory/1088-281-0x0000000003350000-0x0000000003370000-memory.dmp

memory/1088-279-0x0000000010000000-0x000000001049F000-memory.dmp

memory/1088-280-0x0000000010000000-0x000000001049F000-memory.dmp

memory/4032-294-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\eng_rcp.ini

MD5 edb38b19512c080c36256e67e0875aff
SHA1 c8732d10c6a55a6bc6780d6fc6172b4a9d7a7ec3
SHA256 175e1dbfca76083abfe0b342fb508a77f0b51e54b27ea71124c9bd4240d3fd13
SHA512 9e0e32d9fc0d850dcb3dcc1eef0ba4ef8caebd99edd6962dca1e95b849d5f625e986b9afb9500a871d77ba608c953a360c66e669c391458da8beefa7c5b31cf3

memory/4032-386-0x0000000000420000-0x00000000004DA000-memory.dmp

memory/4032-385-0x0000000010000000-0x0000000010030000-memory.dmp

memory/3528-387-0x0000000010000000-0x0000000010059000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dcfe33b0e1c5275fdbb9c8683b3eaad2
SHA1 7f4ede6cc1bb04a9ad7db24a6ba3ab143697b6c5
SHA256 a3c18e271d184719e1383ed9896769a9618fe51d87a43282bc9a64ffa05af25c
SHA512 d0c6dab176c80052b728b44ed2bd1a804b6ae5f5f65a8193215be49573386333de1f951927116ffd9c4b1df85f4fe68791f209d5e2e1d3628f5f3330965dd5d0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 71c6aad504568f5261714881041feead
SHA1 e35eb8c2c7e6e5687e7abdb6b856442d3aed168a
SHA256 96345988a38a4d1c07b68a74d5406357c2a57582e78258bc0a68d996160b05e3
SHA512 bfab646daed2604f15dfe1f8a1b88de07983f4454ab1af7a940b8715601c3f95707d759392618968ac50d50e43650353644563fe4a2f969c95278812abbdfff2

memory/1088-406-0x0000000010000000-0x000000001049F000-memory.dmp

memory/4032-410-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Program Files\Common Files\System\symsrv.dll.000

MD5 1130c911bf5db4b8f7cf9b6f4b457623
SHA1 48e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256 eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA512 94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 8a8b58ef0ea6f75946c4d69fcba0c7ae
SHA1 474af3e213a649987d7860f1b37c2331c40404dc
SHA256 9892805d1481792419267976da403f0bb1373c209185b1eeeddb598055056865
SHA512 113aa0109c1f9caf9680e476e85a9cb410f9b7aa9ba6914209458192de8a092d89363e620b028dde6884a1e1f2b09cf413ad9da8193f0b77864bd92567e660d8

C:\Users\Admin\AppData\Local\Temp\RarSFX0\App\Dll-Files.com Fixer\XmlLite.dll.tmp

MD5 3297ad16c1636c1a55ca77490e304fa0
SHA1 8a5a335c63cb904287c156845d3e7d3dc5bdfb9c
SHA256 0033cdda4b80580259464d52eecb0d0113d2851ef6555f409f44363ccae7f595
SHA512 971a25a0ac8b8369ed0cfa5e931fba0acd890fd8bc0f0604a165da837a425e376cdd669469c851e2f49bb91e71868b80ccb808d50fb567dd8a2688a2fce0bc97

memory/4032-436-0x0000000010000000-0x0000000010030000-memory.dmp

memory/1088-438-0x0000000072DB0000-0x0000000072DD2000-memory.dmp

memory/4032-441-0x0000000010000000-0x0000000010030000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 3e1311583f98ce6c0f4e9fd2a3cdc3b9
SHA1 6a47cf91245ab8e190041224437e01ff9ea45794
SHA256 bb3d8a2ce911e4b9d5613cf5025cd41e513e22ebe7b0a01bf9c0d08237a49eb6
SHA512 94088b9f06f5d59cf2caf365e263d37747dd7779a6eed1621ff343ed3c8fa17fd1da4892c62abcee30304416ce8febd6b21449b0e095e36168fb24cac2dc8998

memory/4032-506-0x0000000010000000-0x0000000010030000-memory.dmp