Malware Analysis Report

2025-01-02 06:57

Sample ID 220906-wl8g4secdl
Target Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe
SHA256 9cf79bf9432b834bd3ed1cf7b412c773ec06e631685a5b32e245a6e0779b66d9
Tags
r77 persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9cf79bf9432b834bd3ed1cf7b412c773ec06e631685a5b32e245a6e0779b66d9

Threat Level: Known bad

The file Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe was found to be: Known bad.

Malicious Activity Summary

r77 persistence

R77 family

r77 rootkit payload

Adds Run key to start application

Drops file in Program Files directory

Enumerates physical storage devices

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-09-06 18:01

Signatures

R77 family

r77

r77 rootkit payload

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-06 18:01

Reported

2022-09-06 18:05

Platform

win7-20220812-en

Max time kernel

161s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe

"C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 flingtrainer.com udp
US 172.67.177.160:443 flingtrainer.com tcp

Files

memory/1508-54-0x00000000006F0000-0x0000000000722000-memory.dmp

memory/1508-55-0x000000001AEEC000-0x000000001AF0B000-memory.dmp

memory/1508-56-0x000000001AEEC000-0x000000001AF0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-06 18:01

Reported

2022-09-06 18:05

Platform

win10v2004-20220812-en

Max time kernel

154s

Max time network

168s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ac35ab1a-12ff-4c12-9450-4f58a837d54c.tmp C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220906200446.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 3936 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3936 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 1956 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3016 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3016 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2784 wrote to memory of 3096 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe

"C:\Users\Admin\AppData\Local\Temp\Grounded Early Access Plus 18 Trainer Updated 2021.10.25.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc5d84f50,0x7fffc5d84f60,0x7fffc5d84f70

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2008 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3080 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5544 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5440 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5552 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flingtrainer.com/patreon

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffd00746f8,0x7fffd0074708,0x7fffd0074718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://flingtrainer.com/tag/grounded

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffd00746f8,0x7fffd0074708,0x7fffd0074718

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2816 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=972 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6640 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7a3bd5460,0x7ff7a3bd5470,0x7ff7a3bd5480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,18205343161135261998,13941889173212004052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6528 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,13485103123241917950,17829033284647186318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4532 /prefetch:8

Network

Country Destination Domain Proto
IE 20.190.159.68:443 tcp
IE 20.190.159.68:443 tcp
IE 20.190.159.68:443 tcp
US 8.253.208.113:80 tcp
US 8.8.8.8:53 flingtrainer.com udp
US 104.21.35.160:443 flingtrainer.com tcp
US 93.184.220.29:80 tcp
US 8.253.208.113:80 tcp
US 8.253.208.113:80 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 13.107.21.200:443 tcp
US 13.107.21.200:443 tcp
US 8.253.208.113:80 tcp
US 8.253.208.113:80 tcp
US 93.184.220.29:80 tcp
US 13.107.21.200:443 tcp
US 13.107.21.200:443 tcp
US 13.107.21.200:443 tcp
US 13.107.21.200:443 tcp
US 13.107.21.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 tcp
US 204.79.197.200:443 www.bing.com tcp
US 204.79.197.200:443 www.bing.com tcp
US 204.79.197.200:443 www.bing.com tcp
US 93.184.220.29:80 tcp
US 13.107.21.200:443 www.bing.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 clients2.google.com udp
NL 142.251.36.45:443 accounts.google.com udp
NL 172.217.168.238:443 clients2.google.com udp
NL 104.80.225.205:443 tcp
US 8.8.8.8:53 edgedl.me.gvt1.com udp
US 34.104.35.123:80 edgedl.me.gvt1.com tcp
US 34.104.35.123:80 edgedl.me.gvt1.com tcp
US 8.8.8.8:53 apis.google.com udp
NL 216.58.214.14:443 apis.google.com tcp
NL 216.58.214.14:443 apis.google.com tcp
US 13.107.21.200:443 www.bing.com tcp
US 13.107.21.200:443 www.bing.com tcp
US 8.8.8.8:53 ogs.google.com udp
NL 142.251.36.14:443 ogs.google.com tcp
NL 142.251.36.14:443 ogs.google.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
NL 216.58.214.3:443 ssl.gstatic.com tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
NL 20.86.249.62:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 smartscreen-prod.microsoft.com udp
NL 20.86.249.62:443 smartscreen-prod.microsoft.com tcp
NL 20.86.249.62:443 smartscreen-prod.microsoft.com tcp
NL 20.86.249.62:443 smartscreen-prod.microsoft.com tcp
US 8.8.8.8:53 flingtrainer.com udp
US 172.67.177.160:443 flingtrainer.com tcp
US 172.67.177.160:443 flingtrainer.com tcp
NL 20.86.249.62:443 smartscreen-prod.microsoft.com tcp
NL 20.86.249.62:443 smartscreen-prod.microsoft.com tcp
US 204.79.197.200:443 www.bing.com tcp
US 8.8.8.8:53 www.patreon.com udp
US 104.16.7.49:443 www.patreon.com tcp
US 172.67.177.160:443 flingtrainer.com udp
US 8.8.8.8:53 browser.sentry-cdn.com udp
US 151.101.194.217:443 browser.sentry-cdn.com tcp
US 151.101.194.217:443 browser.sentry-cdn.com tcp
US 8.8.8.8:53 s.w.org udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
US 34.120.195.249:443 o83571.ingest.sentry.io tcp
US 8.8.8.8:443 dns.google udp
NL 142.250.179.163:443 update.googleapis.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 96.16.53.134:80 apps.identrust.com tcp
US 204.79.197.200:443 www.bing.com tcp
US 104.16.124.175:443 unpkg.com tcp
US 104.16.124.175:443 tcp
US 8.8.8.8:53 edgedl.me.gvt1.com udp
US 34.104.35.123:80 edgedl.me.gvt1.com tcp
US 204.79.197.239:443 tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
IE 20.67.219.150:443 nav.smartscreen.microsoft.com tcp
US 142.250.102.155:443 stats.g.doubleclick.net tcp
IE 20.67.219.150:443 nav.smartscreen.microsoft.com tcp
NL 142.251.39.98:443 adservice.google.nl tcp
NL 142.251.39.98:443 partner.googleadservices.com tcp
NL 65.9.79.74:443 www.datadoghq-browser-agent.com tcp
NL 142.251.36.1:443 tpc.googlesyndication.com tcp
NL 142.251.36.1:443 udp
NL 142.250.179.170:443 safebrowsing.googleapis.com tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
NL 20.86.249.62:443 nav.smartscreen.microsoft.com tcp
US 104.17.219.15:443 c10.patreonusercontent.com tcp
NL 65.9.86.36:443 datadome.patreon.com tcp
US 142.250.102.155:443 udp
US 104.17.219.15:443 tcp
US 151.101.2.132:443 global.ketchcdn.com tcp
NL 65.9.84.25:443 d24n15hnbwhuhn.cloudfront.net tcp
NL 142.251.36.3:443 www.google.nl tcp
NL 65.9.86.36:443 datadome.patreon.com tcp
ES 31.13.83.4:443 tcp
US 151.101.2.132:443 global.ketchcdn.com tcp
ES 31.13.83.4:443 udp
US 18.236.10.255:443 tcp
NL 157.240.247.35:443 tcp
US 34.96.67.224:443 cdn.siftscience.com tcp
US 104.16.7.49:443 www.patreon.com tcp
NL 157.240.247.35:443 udp
US 34.102.232.42:443 hexagon-analytics.com tcp
US 8.8.8.8:443 dns.google udp
US 204.79.197.239:443 tcp
US 34.120.195.249:443 udp
NL 142.250.179.163:443 udp

Files

memory/1324-132-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmp

memory/1324-133-0x00000184297FA000-0x00000184297FF000-memory.dmp

memory/1324-134-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmp

memory/1324-135-0x00000184297FA000-0x00000184297FF000-memory.dmp

memory/5964-136-0x0000000000000000-mapping.dmp

memory/5984-137-0x0000000000000000-mapping.dmp

memory/5280-139-0x0000000000000000-mapping.dmp

memory/6060-140-0x0000000000000000-mapping.dmp

\??\pipe\LOCAL\crashpad_5964_DOMUWDLBVRBMOGFY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/5472-143-0x0000000000000000-mapping.dmp

memory/5320-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 71b657795f1d63721f304fcf46915016
SHA1 d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256 f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512 dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

memory/2096-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 bf1b770d5cf7d76d170f6788ba1e720c
SHA1 e26f381831f3854a9ddd6a5d99855ac2f2d3f347
SHA256 a2ab2bc2393d6e32cb1322d5e44d329763391ed4f9edd7797aa71001af255ebd
SHA512 1b9bd593df9464b487bc369ad8518d23fd1b051f88f6a9cb85584bcbb187bd74019c0502478036bdee8e3858e19f2fa4b9c29d4fb46a228f38026cddb74e3fde

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 71b657795f1d63721f304fcf46915016
SHA1 d2cabf753a2b8888642a3a26878e7f47784153b2
SHA256 f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28
SHA512 dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

memory/1292-150-0x0000000000000000-mapping.dmp

memory/5516-152-0x0000000000000000-mapping.dmp

memory/4544-154-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 cf256af4baeda610169be3f8e43f9a55
SHA1 087d058d959cf812bdb1b905975368c2eb02807c
SHA256 e0806ac108b89bb03dca444c1ac3e091cccfe661789c56169aeac2f04e24a1ae
SHA512 e8edcde8e3eba556d463df2a2d356436c2398ea7faf815319468f685aa677ca0afb277934c3355bc684c2e9262beb5342ce5fe5b62d528492af8d4d041749c88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

MD5 bf0959bd43182643e2155f92199ab42d
SHA1 ec689d7d13147632bf9bd2c1196411897eb1c87e
SHA256 8f6b8938536d124bfe86ae8cbf77150d9b0c558934212d6053d98c2bf37c09f9
SHA512 2558c68b41a4a521847be61a493261658e64e78f7e962dd4e1577daa3f2612a1350c8e74274b56e2e8d5a5c97a3bcbaa3346d9a7f65e59c4af7af1a35fba752c

memory/3356-158-0x0000000000000000-mapping.dmp

memory/5336-160-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk

MD5 dc4768cd60a5c7829815fd32f4844085
SHA1 953df2fd84601ae63162150a948273dc92495ee1
SHA256 ab221ebc5072d2f1ceb645818d5e4351ee08ecdba6eaf85e46ccf648fcadf5d7
SHA512 34c32eeb6a9e0a8f23c8c520f2de122146e54707c949164b63474028ad0e2257dba2b7b4548b9e0dc76215d6bae410766ea745b95afd33d4b25303d3d04684bf

memory/5504-163-0x0000000000000000-mapping.dmp

memory/5532-165-0x0000000000000000-mapping.dmp

memory/2252-167-0x0000000000000000-mapping.dmp

memory/4224-169-0x0000000000000000-mapping.dmp

memory/3676-171-0x0000000000000000-mapping.dmp

memory/2344-172-0x0000000000000000-mapping.dmp

memory/3240-173-0x0000000000000000-mapping.dmp

memory/1616-174-0x0000000000000000-mapping.dmp

memory/1324-175-0x00007FFFCE4A0000-0x00007FFFCEF61000-memory.dmp

memory/1324-176-0x00000184297FA000-0x00000184297FF000-memory.dmp